Back to Checks
aws

S3 Multi-Region Access Point has all Block Public Access settings enabled

s3_multi_region_access_point_public_access_block
Service: s3Severity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsS3AccessPoint

Amazon S3 Multi-Region Access Points are evaluated for Block Public Access being fully enabled (block_public_acls, ignore_public_acls, block_public_policy, restrict_public_buckets).

Focus is on the MRAP's own settings, separate from bucket or account configurations.

Prowler logoProwlerprowler-provider-aws

Risk

Without MRAP Block Public Access, the global endpoint can accept internet traffic, exposing linked buckets.

This undermines confidentiality (object listing/reads) and integrity (unauthorized writes or policy abuse), and can trigger costly egress and data tampering across Regions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_multi_region_access_point_public_access_block

Recommendation

Adopt deny-by-default: keep all MRAP Block Public Access settings enabled; avoid public ACLs or policies.

  • Enforce least privilege
  • Prefer private access (VPC endpoints)
  • Periodically review permissions and logs

MRAP public access settings are immutable after creation.

Remediation

Terraform

# Terraform: MRAP with Block Public Access enabled (must be set at creation)
resource "aws_s3control_multi_region_access_point" "<example_resource_name>" {
  account_id = "<example_account_id>"

  details {
    name = "<example_resource_name>"

    public_access_block {                 # Critical: enable all Block Public Access settings
      block_public_acls       = true      # Critical
      ignore_public_acls      = true      # Critical
      block_public_policy     = true      # Critical
      restrict_public_buckets = true      # Critical
    }

    region { bucket = "<example_bucket_name_1>" }
    region { bucket = "<example_bucket_name_2>" }
  }
}

NativeIaC

# CloudFormation: MRAP with Block Public Access enabled (cannot be changed after creation)
Resources:
  <example_resource_name>:
    Type: AWS::S3::MultiRegionAccessPoint
    Properties:
      Name: <example_resource_name>
      PublicAccessBlockConfiguration:           # Critical: enable all Block Public Access settings
        BlockPublicAcls: true                   # Critical: blocks ACLs granting public access
        IgnorePublicAcls: true                  # Critical: ignores any public ACLs
        BlockPublicPolicy: true                 # Critical: blocks public bucket policies
        RestrictPublicBuckets: true             # Critical: restricts public bucket policies
      Regions:
        - Bucket: <example_bucket_name_1>
        - Bucket: <example_bucket_name_2>

Other

1In the AWS Console, go to S3 > Multi-Region Access Points
2Select the failing Multi-Region Access Point and choose Delete (settings cannot be edited after creation)
3Click Create Multi-Region Access Point
4Enter a name and select at least two buckets in different Regions
5Ensure Block public access is enabled for all four settings (default): BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets
6Create the Multi-Region Access Point

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3control_client import s3control_client


class s3_multi_region_access_point_public_access_block(Check):
    """Ensure that Multi Region Access Points have Public Access Block enabled.

    This check is useful to ensure that Multi Region Access Points have Public Access Block enabled.
    """

    def execute(self):
        """Execute the Multi Region Access Points have Public Access Block enabled check.

        Iterates over all Multi Region Access Points and checks if they have Public Access Block enabled.

        Returns:
            List[Check_Report_AWS]: A list of reports for each Multi Region Access Point.
        """
        findings = []
        for mr_access_point in s3control_client.multi_region_access_points.values():
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=mr_access_point
            )
            report.status = "PASS"
            report.status_extended = f"S3 Multi Region Access Point {mr_access_point.name} of buckets {', '.join(mr_access_point.buckets)} does have Public Access Block enabled."

            if not (
                mr_access_point.public_access_block.block_public_acls
                and mr_access_point.public_access_block.ignore_public_acls
                and mr_access_point.public_access_block.block_public_policy
                and mr_access_point.public_access_block.restrict_public_buckets
            ):
                report.status = "FAIL"
                report.status_extended = f"S3 Multi Region Access Point {mr_access_point.name} of buckets {', '.join(mr_access_point.buckets)} does not have Public Access Block enabled."

            findings.append(report)

        return findings

References