How to Secure a Leaking S3 Bucket With Terraform

Why the bucket is public

This bucket is world-readable because the Terraform that provisioned it attaches an open bucket policy - Principal = "*" with Action = "s3:GetObject" - and nothing overrides it. Any anonymous request on the internet can GetObject and download the data. Two conditions have to be true for that to happen, and both are common leftovers:

1. A bucket policy (or ACL) that grants access to everyone.
2. Block Public Access turned off, so AWS does not veto that policy.

The offending resource looks like this:

resource "aws_s3_bucket_policy" "public_read" {
  bucket = aws_s3_bucket.customer_data.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "s3:GetObject"
      Resource  = "${aws_s3_bucket.customer_data.arn}/*"
    }]
  })
}

Step 1 - delete the public policy

Remove the entire aws_s3_bucket_policy.public_read resource from main.tf. There is no legitimate reason for a customer-data bucket to grant s3:GetObject to Principal = "*". If specific objects must be shared, use presigned URLs or CloudFront - never a wildcard grant.

Step 2 - add Block Public Access

Add an aws_s3_bucket_public_access_block with all four flags set to true. This is the belt-and-braces control: even if someone later re-runs a put-bucket-policy with Principal = "*", AWS refuses it.

resource "aws_s3_bucket_public_access_block" "customer_data" {
  bucket                  = aws_s3_bucket.customer_data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

What each flag does:

• block_public_acls / ignore_public_acls - reject and ignore any public ACL.
• block_public_policy - reject any new bucket policy that grants public access.
• restrict_public_buckets - restrict access even if a public policy somehow exists.

Step 3 - apply and verify

cd /workspace
terraform apply -auto-approve
aws s3api get-bucket-policy --bucket customer-data          # should now fail: no policy
aws s3api get-public-access-block --bucket customer-data    # all four true

A successful get-public-access-block returns a PublicAccessBlockConfiguration with every flag true, and get-bucket-policy no longer returns a wildcard Principal.

Add AWS S3 encryption at rest

Locking down access is half of hardening a bucket - the other half is AWS S3 encryption, so objects are unreadable even if storage is somehow accessed directly. Add a server-side encryption resource next to the bucket:

resource "aws_s3_bucket_server_side_encryption_configuration" "customer_data" {
  bucket = aws_s3_bucket.customer_data.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"   # SSE-S3; use "aws:kms" with a key for SSE-KMS
    }
  }
}

With default encryption on, every new upload is encrypted at rest even when the client omits the x-amz-server-side-encryption header. For stricter control, switch sse_algorithm to aws:kms and reference a customer-managed KMS key so you own the key rotation and audit trail.