How to audit S3 public access on AWS

A bucket can go public three different ways

Auditing S3 exposure is not a single check — it is three, because S3 grants public access through three independent mechanisms. A bucket ACL can grant the built-in AllUsers group (anyone on the internet) or AuthenticatedUsers (any AWS account). A bucket policy can set Principal: "*" with no condition. And a bucket configured for static-website hosting is only private if Block Public Access is on. You have to look at all three, at both the account and bucket level, to say a bucket is genuinely closed.

Turn on account-level Block Public Access

The account-level setting is the master switch: it overrides every bucket in the account, so a future public policy or ACL simply cannot take effect. It has 4 independent flags — turn all of them on unless you have a specific reason not to. First read the current state (an empty or errored response means it has never been configured, which is the risk), then set all four.

# Read the account-level setting (no output / error = not configured)
aws s3control get-public-access-block --account-id 111122223333

# Turn all four flags on at the account level
aws s3control put-public-access-block \
  --account-id 111122223333 \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Verify each bucket, and let S3 tell you if it's public

Each bucket also carries its own Block Public Access settings. You don't have to reason about policies by hand — S3 exposes a get-bucket-policy-status call that returns an IsPublic boolean it computes itself. Loop it over every bucket to get a one-line public/not-public report for the whole account.

# Per-bucket Block Public Access settings
aws s3api get-public-access-block --bucket my-bucket

# Ask S3 whether the bucket is public (it computes IsPublic for you)
aws s3api get-bucket-policy-status --bucket my-bucket
# => {"PolicyStatus": {"IsPublic": false}}

# Sweep every bucket in the account
for b in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  echo "$b -> $(aws s3api get-bucket-policy-status --bucket "$b" \
    --query PolicyStatus.IsPublic --output text 2>/dev/null || echo 'no-policy')"
done

Read the bucket policy and ACL directly

For anything flagged public — or anything you want to confirm manually — pull the policy and ACL and look for two tells: a statement with "Principal": "*" and no restricting condition, and any ACL grant to the AllUsers or AuthenticatedUsers group URIs.

# The full bucket policy (look for Principal "*" without a condition)
aws s3api get-bucket-policy --bucket my-bucket --query Policy --output text

# The ACL — a grant to this URI is world-readable:
#   http://acs.amazonaws.com/groups/global/AllUsers
aws s3api get-bucket-acl --bucket my-bucket

Cross-check with IAM Access Analyzer

IAM Access Analyzer is an AWS service that identifies resources — including S3 buckets — shared with a principal outside your account or organisation. It is a valuable second, independent signal: it catches cross-account sharing that a simple "is it world-public?" check misses. Enable an external-access analyzer (console: IAM → Access Analyzer), then list its S3 findings.

aws accessanalyzer list-findings \
  --analyzer-arn arn:aws:access-analyzer:eu-north-1:111122223333:analyzer/ExternalAccess \
  --filter '{"resourceType": {"eq": ["AWS::S3::Bucket"]}}'

Codify it so it can't regress

A one-time console fix drifts. Put both the account-level and per-bucket Block Public Access blocks in Terraform so any new bucket is private by default and a reviewer sees an exposure change in the plan.

# Account-wide guard rail
resource "aws_s3_account_public_access_block" "this" {
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# Per-bucket (defence in depth)
resource "aws_s3_bucket_public_access_block" "assets" {
  bucket                  = aws_s3_bucket.assets.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Intentionally-public bucket (a static site)? Keep these blocks on and serve it through Amazon CloudFront with Origin Access Control, so the bucket stays private and only CloudFront can read it.

How CloudArq detects this for you

CloudArq runs the same logic on a schedule across every region so you never have to remember to sweep. Two of its 192 read-only checks cover this issue directly: public_s3 flags any bucket made public by an ACL or policy, and no_account_s3_block flags an account with no account-level Block Public Access. It reads configuration metadata only — never your objects — and each finding ships with the exact CLI and Terraform fix from the steps above. It detects and hands you the fix; it never changes your account.

Frequently asked