How to Lock Down a Public S3 Bucket

How a bucket ends up public

Two things have to be true for a bucket to be world-readable, and both are common leftovers: 1. A bucket policy (or ACL) that grants access to everyone - "Principal": "*". 2. Block Public Access (BPA) turned off, so AWS doesn't override that policy.

Fix both: remove the open grant, then turn BPA on so it can never happen again - even by accident.

Step 1: remove the public policy

aws s3api get-bucket-policy --bucket acme-uploads   # see what's there first
aws s3api delete-bucket-policy --bucket acme-uploads

Step 2: turn on all four Block Public Access settings

aws s3api put-public-access-block --bucket acme-uploads \
  --public-access-block-configuration \
  'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'

All four matter: - BlockPublicAcls / IgnorePublicAcls - reject and ignore public ACLs. - BlockPublicPolicy - reject any new policy that grants public access. - RestrictPublicBuckets - even if a public policy somehow exists, restrict access to it.

With BPA on, a future "Principal": "*" policy is simply refused.

Step 3: verify

aws s3api get-public-access-block --bucket acme-uploads   # all four true
aws s3api get-bucket-policy --bucket acme-uploads         # should be gone (or scoped)

Defense in depth

• Account-level BPA - enable Block Public Access for the whole account so no bucket can be made public.
• Grant access narrowly - if some objects must be shared, use presigned URLs or a CloudFront origin access setup instead of a public bucket.
• IAM Access Analyzer - continuously flags any bucket exposed outside the account.