S3 bucket ACL is set to public-read or public-read-write

What it checks

S3 bucket ACL is set to public-read or public-read-write

Where it applies

Terraform: aws_s3_bucket_acl

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Change acl to "private" or remove the acl attribute (private is the default since April 2023).
2. Confirm all four block_public_access flags are true on aws_s3_bucket_public_access_block for this bucket.

Frameworks

• AWS FSBP S3.2
• SOC 2 CC6.1
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules