S3 Block Public Access does not block all access types

Severity: Low
Service: S3
Check ID: S3_ACCESS_BLOCK_ALL_ACCESS_TYPES

What this check finds

This control prevents S3 buckets from being made public. Confirm that the exception that has been made is necessary.

Passing looks like: S3 Block Public Access covers all access types.

How to fix it

Enable all four Block Public Access flags unless a specific bucket intentionally requires public access.

AWS CLI

aws s3control put-public-access-block --account-id ACCOUNT_ID --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to S3 Block Public Access does not block all access types
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	2.1.4 Ensure that S3 is configured with 'Block Public Access' enabled
SOC 2 — Trust Services Criteria	C1.2 Access Restrictions and Secure Disposal
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement SC-7 Boundary Protection
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More S3 checks

All S3 checks