Back to Checks
aws

S3 bucket has Block Public Access with IgnorePublicAcls and RestrictPublicBuckets enabled at bucket or account level

s3_bucket_level_public_access_block
Service: s3Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsS3Bucket

Amazon S3 buckets are evaluated for Block Public Access settings, ensuring ignore_public_acls and restrict_public_buckets are enabled at the bucket or account scope.

Account-wide protections, when present, are treated as effective for the bucket.

Prowler logoProwlerprowler-provider-aws

Risk

Absent S3 Block Public Access, public ACLs or broad policies can grant Internet or cross-account access.

  • Data disclosure (confidentiality)
  • Object overwrite or uploads (integrity)
  • Deletion or outages from misuse (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_level_public_access_block

Recommendation

Enable Block Public Access at account and bucket levels with block_public_acls, ignore_public_acls, block_public_policy, and restrict_public_buckets set to true. Apply least privilege and defense in depth. If public access is required, narrowly scope policies to fixed principals and conditions.

Remediation

CLI

aws s3api put-public-access-block --bucket <BUCKET_NAME> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true

Terraform

# Enable required S3 Block Public Access settings on a bucket
resource "aws_s3_bucket_public_access_block" "<example_resource_name>" {
  bucket                   = "<example_resource_id>"
  ignore_public_acls       = true  # CRITICAL: Ignore public ACLs
  restrict_public_buckets  = true  # CRITICAL: Restrict public buckets
}

NativeIaC

# CloudFormation - enable required S3 Block Public Access settings on a bucket
Resources:
  <example_resource_name>:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        IgnorePublicAcls: true        # CRITICAL: Ignore public ACLs on the bucket/objects
        RestrictPublicBuckets: true   # CRITICAL: Restrict buckets with public policies to same-account/AWS services

Other

1In AWS Console, open S3 and select the target bucket
2Go to Permissions > Block public access (bucket settings)
3Enable only:
4- Ignore public ACLs
5- Restrict public buckets
6Click Save changes
7(Alternatively, to apply account-wide) S3 > Account settings > Block Public Access: enable the same two options and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client
from prowler.providers.aws.services.s3.s3control_client import s3control_client


class s3_bucket_level_public_access_block(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            if bucket.public_access_block:
                report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
                report.status = "PASS"
                report.status_extended = f"Block Public Access is configured for the S3 Bucket {bucket.name}."
                if not (
                    bucket.public_access_block.ignore_public_acls
                    and bucket.public_access_block.restrict_public_buckets
                ):
                    if (
                        s3control_client.account_public_access_block
                        and s3control_client.account_public_access_block.ignore_public_acls
                        and s3control_client.account_public_access_block.restrict_public_buckets
                    ):
                        report.status_extended = f"Block Public Access is configured for the S3 Bucket {bucket.name} at account {s3_client.audited_account} level."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"Block Public Access is not configured for the S3 Bucket {bucket.name}."
                findings.append(report)
        return findings

References