c1.12 Block public access to storage

S3 Block Public Access

S3 Block Public Access (BPA) blocks public access to your buckets at the account level (the default for new accounts) and at the bucket level. If your organization does not need public buckets, enable account-level BPA in every account. Where one account genuinely needs a public bucket, keep BPA on for every other bucket in that account. Account-level BPA overrides bucket policies, so it is a hard backstop against a misconfigured policy.

Enforce it with a Service Control Policy so no one can remove BPA where it is not needed, and use AWS Security Hub CSPM controls S3.1 and S3.8 to spot accounts and buckets where BPA is off.

Turn it on with the CLI

Enable all four account-level Block Public Access settings (run in each account, with its account id):

aws s3control put-public-access-block \
  --account-id 111122223333 \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Verify what is currently set:

aws s3control get-public-access-block --account-id 111122223333

Do not forget AMIs and EBS snapshots

Public access is not only an S3 problem. Also block public access for AMIs and for EBS snapshots unless you have a clear, reviewed reason to share them — a public AMI or snapshot can leak an entire machine image or disk.

If you must publish content

To serve public content (for example a static website), do not open the bucket. Put it behind an Amazon CloudFront distribution with AWS WAF so you keep BPA on and add protection in front.