Back to Checks
aws

S3 access point has all Block Public Access settings enabled

s3_access_point_public_access_block
Service: s3Severity: critical
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsS3AccessPoint

Amazon S3 access points have Block Public Access configured with all settings enabled: block_public_acls, ignore_public_acls, block_public_policy, and restrict_public_buckets.

The evaluation inspects each access point's public access block configuration.

Prowler logoProwlerprowler-provider-aws

Risk

Without block public access on an access point, ACLs or policies can expose objects publicly despite intended restrictions. This enables unauthorized reads (confidentiality loss), writes or deletions (integrity/availability impact), and supports bulk data exfiltration or destructive actions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_access_point_public_access_block

Recommendation

Enable all access-point Block Public Access settings (block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets).

Apply least privilege, prefer VPC-only access points, and layer account and bucket blocks for defense in depth. Regularly audit for public principals like Principal: *.

Remediation

Terraform

# Terraform: S3 Access Point with all Block Public Access settings enabled
resource "aws_s3_access_point" "<example_resource_name>" {
  name   = "<example_resource_name>"
  bucket = "<example_bucket_name>"

  public_access_block_configuration {
    block_public_acls       = true  # Critical: block public ACLs
    ignore_public_acls      = true  # Critical: ignore any public ACLs
    block_public_policy     = true  # Critical: block public policies
    restrict_public_buckets = true  # Critical: restrict public buckets
  }
}

NativeIaC

# CloudFormation: S3 Access Point with all Block Public Access settings enabled
Resources:
  <example_resource_name>:
    Type: AWS::S3::AccessPoint
    Properties:
      Bucket: <example_bucket_name>
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true        # Critical: block public ACLs
        IgnorePublicAcls: true       # Critical: ignore any public ACLs
        BlockPublicPolicy: true      # Critical: block public policies
        RestrictPublicBuckets: true  # Critical: restrict public buckets

Other

1In the AWS console, go to S3 > Access points
2Select the noncompliant access point and click Delete access point
3Click Create access point, select the same bucket
4Ensure Block public access is enabled (all options On by default)
5Click Create access point

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3control_client import s3control_client


class s3_access_point_public_access_block(Check):
    def execute(self):
        findings = []
        for access_point in s3control_client.access_points.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=access_point)
            report.status = "PASS"
            report.status_extended = f"Access Point {access_point.name} of bucket {access_point.bucket} does have Public Access Block enabled."

            if not (
                access_point.public_access_block.block_public_acls
                and access_point.public_access_block.ignore_public_acls
                and access_point.public_access_block.block_public_policy
                and access_point.public_access_block.restrict_public_buckets
            ):
                report.status = "FAIL"
                report.status_extended = f"Access Point {access_point.name} of bucket {access_point.bucket} does not have Public Access Block enabled."

            findings.append(report)

        return findings

References