S3 bucket uses a legacy public ACL (inline acl attribute)

What it checks

S3 bucket uses a legacy public ACL (inline acl attribute)

Where it applies

Terraform: aws_s3_bucket

CloudFormation: AWS::S3::Bucket

How to fix it

1. Remove the acl attribute from aws_s3_bucket and create a separate aws_s3_bucket_acl with acl = "private".
2. Add aws_s3_bucket_public_access_block with all four flags = true.

Frameworks

• AWS FSBP S3.2
• SOC 2 CC6.1
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules