S3 bucket is not publicly accessible to Everyone or Authenticated Users
s3_bucket_public_access
Amazon S3 buckets are evaluated for public access via ACLs and bucket policies. The check identifies account or bucket PublicAccessBlock protections (IgnorePublicAcls, RestrictPublicBuckets) and flags buckets granting group access to AllUsers or AuthenticatedUsers, or with a public bucket policy.
Risk
Publicly accessible buckets jeopardize confidentiality through unauthenticated reads, integrity through write or ACL changes, and availability via object deletion or overwrite. Attackers can mass-exfiltrate data, host malware, or pivot after discovering secrets stored in objects.
prowler aws --checks s3_bucket_public_access
prowler aws --checks s3_bucket_public_access --fixer
Recommendation
Enforce defense in depth: enable S3 Block Public Access at org/account and bucket levels (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets). Apply least privilege with explicit principals; avoid ACLs via Object Ownership. Use private access patterns (e.g., CloudFront OAC or presigned URLs) and monitor with analyzers.
Remediation
aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true
- In the AWS Console, go to S3 and open the bucket <example_resource_name>
- Select the Permissions tab
- Under Block public access (bucket settings), click Edit
- Check only:
- Ignore public ACLs (true)
- Restrict public buckets (true)
- Click Save changes and confirm
Source Code
Resource Type
AwsS3Bucket