S3 bucket must restrict public bucket access
Critical
AWS
General
aws-s3-bucket-no-public-access-2
Applies to
AWS::S3::Bucket
What CGPulse checks
A resource passes this rule when restrictPublicBuckets must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.
How to fix it
Enable Restrict Public Buckets to limit access to AWS service principals and authorized users only. In AWS Console: S3 > Bucket > Permissions > Block public access > enable. See: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
Terraform
resource "aws_s3_bucket_public_access_block" "{name}" {
bucket = aws_s3_bucket.{name}.id
restrict_public_buckets = true
}
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related AWS rules
- ACM certificate must be eligible for renewal
- ACM certificate must be in issued status
- Amplify app should have basic auth disabled for production
- API Gateway REST API must have an endpoint configuration
- API Gateway V2 API must be properly configured
- App Runner service must have encryption enabled
- AppSync API must have logging configured
- AppSync API must have X-Ray tracing enabled