Back to Checks
aws

S3 account-level Block Public Access ignores public ACLs and restricts public buckets

s3_account_level_public_access_blocks
Service: s3Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsS3AccountPublicAccessBlock

Amazon S3 account-level Block Public Access is assessed for ignore_public_acls and restrict_public_buckets to confirm centralized blocking of ACL-based public access and limiting buckets with public policies to in-account principals.

Prowler logoProwlerprowler-provider-aws

Risk

Absent these settings, public ACLs and broad bucket policies may grant internet or cross-account access. This risks:

  • Confidentiality: bulk data exfiltration
  • Integrity: object overwrite/tampering
  • Availability: malicious deletions or malware hosting, triggering takedowns

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_account_level_public_access_blocks

Recommendation

Turn on account-level Block Public Access (prefer enabling all four: block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets) to enforce least privilege. For legitimate access, use private buckets with CloudFront, VPC endpoints, or presigned URLs. Regularly review policies with IAM Access Analyzer.

Remediation

CLI

aws s3control put-public-access-block --account-id <account_id> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

Terraform

# Terraform: Enable required S3 Account-level Block Public Access settings
resource "aws_s3_account_public_access_block" "<example_resource_name>" {
  ignore_public_acls     = true  # Critical: Ignores any public ACLs account-wide
  restrict_public_buckets = true # Critical: Restricts buckets with public policies to same-account principals
}

NativeIaC

# CloudFormation: Enable required S3 Account-level Block Public Access settings
Resources:
  <example_resource_name>:
    Type: AWS::S3::AccountPublicAccessBlock
    Properties:
      AccountId: !Ref AWS::AccountId
      IgnorePublicAcls: true         # Critical: Ignores any public ACLs at the account level
      RestrictPublicBuckets: true    # Critical: Restricts buckets with public policies to only same-account principals

Other

1In the AWS Console, go to S3
2Click Block public access (account settings)
3Click Edit
4Turn on: Ignore public ACLs and Restrict public buckets
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client
from prowler.providers.aws.services.s3.s3control_client import s3control_client


class s3_account_level_public_access_blocks(Check):
    def execute(self):
        findings = []
        if s3control_client.account_public_access_block is not None:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=s3control_client.account_public_access_block,
            )
            if (
                s3control_client.account_public_access_block
                and s3control_client.account_public_access_block.ignore_public_acls
                and s3control_client.account_public_access_block.restrict_public_buckets
            ):
                report.status = "PASS"
                report.status_extended = f"Block Public Access is configured for the account {s3control_client.audited_account}."
                report.region = s3control_client.region
                report.resource_id = s3control_client.audited_account
                report.resource_arn = s3_client.account_arn_template
                findings.append(report)
            elif s3_client.buckets or s3_client.provider.scan_unused_services:
                report.status = "FAIL"
                report.status_extended = f"Block Public Access is not configured for the account {s3control_client.audited_account}."
                report.region = s3control_client.region
                report.resource_id = s3control_client.audited_account
                report.resource_arn = s3_client.account_arn_template
                findings.append(report)

        return findings

References