Amazon S3 provides four independent Public Access Block settings to prevent public access from being granted to a bucket through ACLs or bucket policies. This rule flags S3 bucket configurations where any of these settings is set to false.
Amazon S3 buckets are private by default, but their access control can be relaxed using ACLs or bucket policies that allow public access. Although AWS enables all four Public Access Block settings by default, infrastructure code can inadvertently re-expose a bucket by setting any of them to false.
If public access is not fully blocked on an S3 bucket that contains sensitive data, any unauthenticated user on the internet can read, download, or exfiltrate that data. This can lead to data breaches, compliance violations, and reputational damage to the organization.
bucket = s3.Bucket(self,
"bucket",
block_public_access=s3.BlockPublicAccess(
block_public_acls=False, # Noncompliant
ignore_public_acls=True,
block_public_policy=True,
restrict_public_buckets=True
)
)
bucket = s3.Bucket(self,
"bucket",
block_public_access=s3.BlockPublicAccess(
block_public_acls=True,
ignore_public_acls=True,
block_public_policy=True,
restrict_public_buckets=True
)
)
The attribute BLOCK_ACLS_ONLY only blocks and ignores public ACLs, but public policies can still affect the S3 bucket:
bucket = s3.Bucket(self,
"bucket",
block_public_access=s3.BlockPublicAccess.BLOCK_ACLS_ONLY # Noncompliant
)
bucket = s3.Bucket(self,
"bucket",
block_public_access=s3.BlockPublicAccess.BLOCK_ALL
)
The BlockPublicAccess class controls public access to an S3 bucket through four independent settings:
block_public_acls: blocks new public ACLs from being set on the bucket.ignore_public_acls: causes existing public ACLs on the bucket to be ignored.block_public_policy: blocks new public bucket policies from being set.restrict_public_buckets: restricts access to the bucket to principals within the bucket owner account when a public policy is in
effect.When block_public_access is not set, or when BlockPublicAccess(…) is used with some attributes omitted, AWS CDK defaults
the missing attributes to True. The BlockPublicAccess.BLOCK_ALL preset enables all four settings explicitly, providing
complete protection. The BlockPublicAccess.BLOCK_ACLS_ONLY preset only enables block_public_acls and
ignore_public_acls, explicitly setting block_public_policy and restrict_public_buckets to
False.