# Ensure there are no S3 buckets open to the Everyone or Any AWS user - Source: https://support.icompaas.com/support/solutions/articles/a_1793292222273898-ensure-there-are-no-s3-buckets-open-to-the-everyone-or-any-aws-user - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no Amazon S3 bucket is open to everyone (the AllUsers group) or to any AWS user (the AuthenticatedUsers group) through its access control list (ACL), and that no bucket policy grants public access. Buckets are not considered public when the S3 Block Public Access settings **Ignore public ACLs** and **Restrict public buckets** are both enabled, either for the whole account or for the bucket. **Rationale** A public bucket can be read, and in some cases changed, by anyone on the Internet or by any AWS customer. This can lead to mass data exposure, malware hosting, tampering with objects or deletion of data, and attackers may find secrets stored in objects that allow further access. S3 Block Public Access at account and bucket level, explicit principals in bucket policies, and disabling ACLs through S3 Object Ownership provide layered protection. Content that must be public should be served through Amazon CloudFront or presigned URLs instead. **Impact** - Prevents anonymous and cross-account public access to bucket contents - Reduces the risk of data exposure, tampering and deletion - Websites, downloads or integrations that rely on public access to the bucket stop working until they are moved to an alternative such as CloudFront with origin access control or presigned URLs **Default Value** New buckets are private: they have no bucket policy, ACLs are disabled through S3 Object Ownership (**Bucket owner enforced**), and all four S3 Block Public Access settings are enabled by default for buckets created since April 2023. **Pre-Requisites** - IAM permissions: s3:ListAllMyBuckets, s3:GetBucketAcl, s3:GetBucketPolicy, s3:GetBucketPolicyStatus, s3:GetBucketPublicAccessBlock, s3:PutBucketPublicAccessBlock, s3:GetAccountPublicAccessBlock and s3:PutAccountPublicAccessBlock - A list of buckets that must legitimately serve public content, and an agreed alternative for them - A copy of the current Block Public Access settings **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon S3 console and select **Block Public Access settings for this account**. If both the public ACL setting (**Block public access to buckets and objects granted through any access control lists (ACLs)**) and the public policy setting (**Block public and cross-account access to buckets and objects through any public bucket or access point policies**) are **On**, all buckets pass. 3. Otherwise, select **Buckets**, select a bucket and open the **Permissions** tab. 4. If both of the same settings are **On** under **Block public access (bucket settings)**, the bucket passes. 5. Otherwise, in the **Access control list (ACL)** section, check whether **Everyone (public access)** or **Authenticated users group (anyone with an AWS account)** has any permission. 6. In the **Bucket policy** section, check for a statement with "Effect": "Allow" and a principal of "\*" or {"AWS": "\*"} without a restricting condition. 7. Repeat for each bucket. 8. If public access is granted through the ACL or the policy, follow the implementation steps. **CLI:** Show the account-level Block Public Access settings: aws s3control get-public-access-block --account-id Show the bucket-level Block Public Access settings: aws s3api get-public-access-block --bucket Show the group grants in the bucket ACL: aws s3api get-bucket-acl --bucket --query "Grants\[?Grantee.Type=='Group'\].\[Grantee.URI,Permission\]" --output table Show whether the bucket policy is public: aws s3api get-bucket-policy-status --bucket --query PolicyStatus.IsPublic A bucket fails if IgnorePublicAcls and RestrictPublicBuckets are not both true at account level or at bucket level, and either the ACL has a grant to a URI ending in AllUsers or AuthenticatedUsers, or the bucket policy is public. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon S3 console, select the bucket found in the Test Plan and open the **Permissions** tab. 3. Under **Block public access (bucket settings)**, choose **Edit**. 4. Select **Block all public access**, or at least: - **Block public access to buckets and objects granted through any access control lists (ACLs)**, and - **Block public and cross-account access to buckets and objects through any public bucket or access point policies**. 5. Choose **Save changes** and confirm. 6. Remove any public grants from the bucket ACL and public statements from the bucket policy, or disable ACLs by setting **Object Ownership** to **Bucket owner enforced**. 7. Repeat for each affected bucket. 8. To protect all buckets at once, apply the same settings under **Block Public Access settings for this account**. Warning: the account-level settings apply to every bucket in the account and will break buckets that are public on purpose, such as static websites or public downloads. Save the current account-level settings first (see the CLI steps below). **CLI:** Turn on S3 Block Public Access for the bucket. The command replaces the whole Block Public Access configuration of the bucket, and any setting not included is turned off, so all four settings are given here: aws s3api put-public-access-block --bucket --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true To protect all buckets in the account, S3 Block Public Access can be turned on at account level. Warning: this applies to every bucket in the account and will break buckets that are public on purpose. Before changing it, save the current account-level settings: aws s3control get-public-access-block --account-id > account-public-access-block-backup.json Turn on S3 Block Public Access at account level: aws s3control put-public-access-block --account-id --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true **Backout Plan** Before making changes, save the current Block Public Access settings: aws s3api get-public-access-block --bucket --query PublicAccessBlockConfiguration > public-access-block-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon S3 console, select the bucket and open the **Permissions** tab. 3. Under **Block public access (bucket settings)**, choose **Edit**. 4. Restore the previous settings from the saved backup and choose **Save changes**. 5. If the account-level settings were changed, restore them under **Block Public Access settings for this account**. **CLI:** aws s3api put-public-access-block --bucket --public-access-block-configuration file://public-access-block-backup.json If the account-level settings were changed, restore them with the values saved in account-public-access-block-backup.json. The example below turns all four settings off; set each one to true or false as recorded in the backup: aws s3control put-public-access-block --account-id --public-access-block-configuration BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false If no account-level configuration existed before (the backup command returned a NoSuchPublicAccessBlockConfiguration error), remove it instead: aws s3control delete-public-access-block --account-id Note: rolling back makes the bucket publicly accessible again. Use it only as a temporary measure while an alternative for public content is arranged. **Reference** - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) - [https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) - [https://docs.aws.amazon.com/cli/latest/reference/s3api/put-public-access-block.html](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-public-access-block.html) - [https://docs.aws.amazon.com/cli/latest/reference/s3control/put-public-access-block.html](https://docs.aws.amazon.com/cli/latest/reference/s3control/put-public-access-block.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.