# Turn on all four S3 Block Public Access settings at the account and bucket level, and know what they cannot cover > New S3 buckets are private by default, but bucket policies, ACLs and access points can still open them. AWS recommends enabling all four Block Public Access settings for the account and each bucket, applies the most restrictive combination, and notes the settings cannot be set per object. - Canonical URL: https://update.dsesecurity.com/updates/amazon-s3-block-public-access-four-settings-account-organization/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:00:54+00:00 - Modified: 2026-10-18T22:22:07+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Guide - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know New S3 buckets are private by default, but bucket policies, ACLs and access points can still open them. AWS recommends enabling all four Block Public Access settings for the account and each bucket, applies the most restrictive combination, and notes the settings cannot be set per object. ## Potentially affected Organizations storing backups, video exports, website assets or application data in Amazon S3, and the integrators or developers who create buckets for them. ## DSE recommendation DSE recommends enabling all four Block Public Access settings at the account level, and at the organization level where AWS Organizations is used, before creating new buckets. ## Article New S3 buckets are private by default, but bucket policies, ACLs and access points can still open them. AWS recommends enabling all four Block Public Access settings for the account and each bucket, applies the most restrictive combination, and notes the settings cannot be set per object. ## Source facts AWS’s [Block Public Access guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html) says new buckets, access points and objects don’t allow public access by default, but users can modify bucket policies, access point policies or object permissions to allow it. Block Public Access settings override those policies and permissions and can be managed at the organization, account, bucket and access point levels. There are four independent settings. When levels differ, S3 applies the most restrictive combination, and organization-level policies apply all four settings together and override account-level settings in selected member accounts. AWS recommends turning on all four settings for the account and for each bucket, in line with Security Hub control S3.8, after verifying applications work without public access. Block Public Access cannot be set on a per-object basis. Account settings apply to all Regions but may not take effect everywhere simultaneously, and AWS says to also inspect identity-based and other resource-based policies, such as KMS key policies, for public grants. ## Applicability Use this for any AWS account that holds S3 data. Buckets that must serve public content, such as a static website, need a documented exception with customized settings rather than disabling protection account-wide. ## DSE recommendation DSE recommends enabling all four Block Public Access settings at the account level, and at the organization level where AWS Organizations is used, before creating new buckets. Keep publicly served content in a separate, documented bucket or behind a content delivery service, and review exceptions whenever a project ends. Treat buckets that hold camera exports or backups as sensitive by default. ## Verification Use IAM Access Analyzer for S3 or the S3 console to list buckets with public access, confirm all four settings at account and bucket level, and check Security Hub S3.8 findings monthly. Record each approved public-content exception with an owner and review date. ## Official reference [Amazon S3 User Guide — Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html). Reviewed October 18, 2026. ## Primary reference - Name: Amazon S3 User Guide — Blocking public access to your Amazon S3 storage - Authority: docs.aws.amazon.com - URL: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Turn on all four S3 Block Public Access settings at the account and bucket level, and know what they cannot cover,” DSE Security, https://update.dsesecurity.com/updates/amazon-s3-block-public-access-four-settings-account-organization/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.