S3 bucket has `block_public_acls` disabled Affecting S3 service in AWS

Set the aws_s3_bucket_public_access_block or aws_s3_account_public_access_block block_public_acls field to true or use the default settings.

To enable block public access settings explicitly at the bucket level:

• Ensure that the aws_s3_bucket is referenced in an aws_s3_bucket_public_access_block bucket field and that all of the following aws_s3_bucket_public_access_block fields are set to true:

  • block_public_acls

To enable block public access settings explicitly at the account level:

• Ensure that all of the following aws_s3_account_public_access_block fields are set to true:

  • block_public_acls

Example configuration:

# Enable for a single bucket
resource "aws_s3_bucket" "private" {
  acl           = "private"
  # other required fields here
}

resource "aws_s3_bucket_public_access_block" "private" {
  bucket                = "${aws_s3_bucket.private.id}"
  block_public_acls     = true
}

resource "aws_s3_bucket_ownership_controls" "private" {
  bucket = "${aws_s3_bucket.private.id}"
  rule {
    object_ownership = "BucketOwnerPreferred"
  }
}

resource "aws_s3_bucket_acl" "private" {
  depends_on = [aws_s3_bucket_ownership_controls.private]

  bucket = "${aws_s3_bucket.private.id}"
  acl    = "private"
}

# Enable for an entire AWS account
resource "aws_s3_account_public_access_block" "main" {
  block_public_acls     = true
}

Configure a PublicAccessBlockConfiguration for the AWS::S3::Bucket or use the default settings.

Block public access settings currently cannot be explicitly enabled at the account level in CloudFormation. Enable these settings for each bucket instead.

Example configuration:

JSON example configuration:

{
  "Type" : "AWS::S3::Bucket",
  "Properties" : {
    "PublicAccessBlockConfiguration" : {
      "BlockPublicAcls" : true,
      "BlockPublicPolicy" : true,
      "IgnorePublicAcls" : true,
      "RestrictPublicBuckets" : true
      }
    }
  # other required fields here
}

YAML example configuration:

Type: AWS::S3::Bucket
Properties:
  PublicAccessBlockConfiguration:
    BlockPublicAcls: true
    BlockPublicPolicy: true
    IgnorePublicAcls : true
    RestrictPublicBuckets : true
# other required fields here