# Ensure S3 Bucket Public Read Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000218915-ensure-s3-bucket-public-read-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:** 

The Amazon S3 Block Public Access feature provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects don't allow public access. However, users can modify bucket policies, access point policies, or object permissions to allow public access. S3 Block Public Access settings override these policies and permissions so that you can limit public access to these resources.

  

**Rational:**

With S3 Block Public Access, account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created. When Amazon S3 evaluates whether an operation is prohibited by a block public access setting, it rejects any request that violates an access point, bucket, or account setting.

  

**Impact:**

When you apply block public access settings to an account, the settings apply to all AWS regions globally. The settings might not take effect in all regions immediately or simultaneously, but they eventually propagate to all regions.

  

**Default Value:**  

By default, S3 Bucket public read access is disabled.

  

### Pre-requisite:

-   Sign in as an admin or IAM user with the required permissions
    

  

**Remediation:**

**Test Plan****:**

**Step 1:** Sign in to the AWS Management Console.

**Step 2:** Open the S3 dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/").

**Step 3:** Select the S3 bucket that you want to examine.

![](https://support.icompaas.com/assets/kb/5efe7471a5fae76d.png)

****Step 4:**** Click **the Permissions tab.**

  

**![](https://support.icompaas.com/assets/kb/abe449a9018153d3.png)****Step 5:** In the Access Control List (ACL) section, a grantee can be an AWS account or an AWS S3 predefined group. The grantee called **"Everyone"** is an AWS predefined group that allows access to everyone (i.e. anonymous users). If the bucket ACL configuration does specify the **"Everyone"** predefined group with the **List** (READ) permission enabled: 

  
![](https://support.icompaas.com/assets/kb/cabc29e622d1a5de.png)

The selected S3 bucket is publicly accessible for content listing .

### **CLI Commands**

To know the public access

aws s3api get-public-access-block \\  
    --bucket my-bucket

**Implementation Steps :**

**Step 1:** Sign in to the AWS Management Console.

**Step 2:** Open the S3 dashboard at [https://console.aws.amazon.com/s3/](https://console.aws.amazon.com/s3/ "https://console.aws.amazon.com/s3/").

**Step 3:** Select the S3 bucket that you want to modify![](https://support.icompaas.com/assets/kb/3a7a13058d11cc3a.png)

**Step4:** Click **Permissions** to expand the bucket Access Control List (ACL) configuration tab and search for the grantee (predefined group) named **"Everyone"**. uncheck-the-list-read-permission-applied-to-everyone![](https://support.icompaas.com/assets/kb/5cffc43bdde5bc61.png)

**Step5:** Uncheck the List (READ) **permission** applied to "Everyone"![](https://support.icompaas.com/assets/kb/cde35524edaceca5.png)

**Step6:** Click **Save** to apply the new ACL configuration and remove the bucket public READ (LIST) access.

**Using AWS CLI:**

**To make the** **private**

aws s3api put-bucket-acl  
  --bucket cc-production-access-logs  
  --acl private

**Backout plan:**

To revoke the changes made, do follow steps 1-4 in the implementation section, and step5 check  the-list-read-permission-applied-to-everyone

  

![](https://support.icompaas.com/assets/kb/1b390fbc3c9909e9.png)

**Using AWS CLI:**

  

To make it public

aws s3api put-bucket-acl  
  --bucket cc-production-access-logs  
  --acl public

**References**:

[![](https://support.icompaas.com/assets/kb/f3a55e76e7c9badb.png)Blocking public access to your Amazon S3 storage - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.