Amazon_S3_31

Ensure that S3 Buckets are configured with Block public access (bucket/account settings)

Description

Amazon S3 provides `Block public access (bucket settings)` and `Block public access (account settings)` to help you manage public access to Amazon S3 resources. By default, S3 buckets and objects are created with public access disabled. However, an IAM principal with sufficient S3 permissions can enable public access at the bucket and/or object level. While enabled, `Block public access (bucket settings)` prevents an individual bucket, and its contained objects, from becoming publicly accessible. Similarly, `Block public access (account settings)` prevents all buckets, and contained objects, from becoming publicly accessible across the entire account.

Remediation

From Console:
1. Login to AWS Management Console and open the Amazon S3 console using https://console.aws.amazon.com/s3/
2. Select the Check box next to the Bucket
3. Click on ‘Edit public access settings’
4. Click ‘Block all public access’
5. Repeat for all the buckets in your AWS account that contain sensitive data

From Command Line:
To set Block Public Access configurations, run:

aws s3api put-public-access-block –bucket BUCKET_NAME –public-access-block-configuration BlockPublicAcls=trueIgnorePublicAcls=true

Service

S3

Severity

High

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!