By default S3 buckets are private, it means that only the bucket owner can access it.
This access control can be relaxed with ACLs or policies.
To prevent permissive policies to be set on a S3 bucket the following settings can be configured:
BlockPublicAcls: to block or not public ACLs to be set to the S3 bucket. IgnorePublicAcls: to consider or not existing public ACLs set to the S3 bucket. BlockPublicPolicy: to block or not public policies to be set to the S3 bucket. RestrictPublicBuckets: to restrict or not the access to the S3 endpoints of public policies to the principals within the bucket
owner account. There is a risk if you answered yes to any of those questions.
It’s recommended to configure:
BlockPublicAcls to true to block new attempts to set public ACLs. IgnorePublicAcls to true to block existing public ACLs. BlockPublicPolicy to true to block new attempts to set public policies. RestrictPublicBuckets to true to restrict existing public policies. By default, when not set, the aws_s3_bucket_public_access_block is fully deactivated (nothing is blocked):
resource "aws_s3_bucket" "example" { # Sensitive: no Public Access Block defined for this bucket
bucket = "example"
}
This aws_s3_bucket_public_access_block allows public ACL to be set:
resource "aws_s3_bucket" "example" { # Sensitive
bucket = "examplename"
}
resource "aws_s3_bucket_public_access_block" "example-public-access-block" {
bucket = aws_s3_bucket.example.id
block_public_acls = false # should be true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}
This aws_s3_bucket_public_access_block blocks public ACLs and policies, ignores existing public ACLs and restricts existing public
policies:
resource "aws_s3_bucket" "example" {
bucket = "example"
}
resource "aws_s3_bucket_public_access_block" "example-public-access-block" {
bucket = aws_s3_bucket.example.id
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}