AWS S3 Support
AWS S3 public access audit and lockdown.
Publicly readable buckets are still a common cause of data leaks. A real audit looks past a single toggle: account and bucket Block Public Access, bucket policies, ACLs and access points all matter. We find what is exposed, confirm what must stay public, and close the rest without breaking applications.
When You Need This
The situations where this work pays for itself.
Signs it is time
- A security review or customer questionnaire asks which buckets are public
- You inherited an account and do not know what is exposed
- Security Hub or Trusted Advisor reports public buckets
- A website or asset bucket must stay public but nothing else should
- You are preparing for an audit and need evidence of controls
What you get
- A bucket-by-bucket exposure report with risk ranking
- Block Public Access applied at account and bucket level
- CloudFront origin access control setup for intentionally public content
- Config rules or SCP guardrails and alerting
How we do it
A clear, safe process you can follow along with.
1. Inventory every bucket and Region
We list all buckets across the account or organization and record owner, purpose, Region and whether it hosts a website or sits behind CloudFront.
2. Check Block Public Access at both levels
We read the account-level and bucket-level Block Public Access settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets). Account-level settings are the strongest safety net.
3. Read policies, ACLs and access points
We look for Principal of "*" without restrictive conditions, grants to AllUsers or AuthenticatedUsers in ACLs, and access points with permissive policies.
4. Use IAM Access Analyzer for S3
Access Analyzer reports buckets reachable from outside your zone of trust, including cross-account and public paths. We triage each finding as intended or not.
5. Classify what is inside
For buckets that were exposed, we use Amazon Macie or targeted sampling to learn whether sensitive data was reachable, and review server access logs or CloudTrail data events if enabled to see who read it.
6. Lock down and serve legitimately
We enable Block Public Access, then move legitimate public content behind CloudFront with origin access control so the bucket itself stays private.
7. Add guardrails
We add an organization service control policy or AWS Config rule to block future public buckets and alert on changes.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Turning on Block Public Access without checking websites
Static websites served straight from S3 stop working. We migrate them behind CloudFront first.
Only checking bucket policies
ACLs and access points can also grant public access.
Assuming private means safe
A bucket shared too broadly with other accounts can be as risky as a public one. Access Analyzer covers both.
Frequently Asked Questions
How do I find all public S3 buckets?
Use IAM Access Analyzer for S3, review Block Public Access settings and bucket policies, and check Trusted Advisor or Security Hub findings. Combine them, since each covers different paths.
Can public S3 buckets be blocked for the whole account?
Yes. Block Public Access can be set at the account level, and in an organization you can enforce it with service control policies and Config rules.
How do I serve public files without a public bucket?
Put CloudFront in front of the bucket and use origin access control. Users reach the content through CloudFront while the bucket stays private.
Want Help With AWS S3 public access audit and lockdown?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required