HIGH
Source
Trivy
ID
AVD-AWS-0093

S3 Access block should restrict public bucket to limit access

S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

Impact

Public buckets can be accessed by anyone

Follow the appropriate remediation steps below to resolve the issue.

Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
Resources:
  GoodExample:
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
    Type: AWS::S3::Bucket

Limit the access to public buckets to only the owner or AWS Services (eg; CloudFront)

1
2
3
4
5
resource "aws_s3_bucket_public_access_block" "good_example" {
  bucket = aws_s3_bucket.example.id
  
  restrict_public_buckets = true
}