Turn on all four S3 Block Public Access settings at the account and bucket level, and know what they cannot cover

New S3 buckets are private by default, but bucket policies, ACLs and access points can still open them. AWS recommends enabling all four Block Public Access settings for the account and each bucket, applies the most restrictive combination, and notes the settings cannot be set per object.

Source facts

AWS’s Block Public Access guide says new buckets, access points and objects don’t allow public access by default, but users can modify bucket policies, access point policies or object permissions to allow it. Block Public Access settings override those policies and permissions and can be managed at the organization, account, bucket and access point levels.

There are four independent settings. When levels differ, S3 applies the most restrictive combination, and organization-level policies apply all four settings together and override account-level settings in selected member accounts. AWS recommends turning on all four settings for the account and for each bucket, in line with Security Hub control S3.8, after verifying applications work without public access.

Block Public Access cannot be set on a per-object basis. Account settings apply to all Regions but may not take effect everywhere simultaneously, and AWS says to also inspect identity-based and other resource-based policies, such as KMS key policies, for public grants.

Applicability

Use this for any AWS account that holds S3 data. Buckets that must serve public content, such as a static website, need a documented exception with customized settings rather than disabling protection account-wide.

DSE recommendation

DSE recommends enabling all four Block Public Access settings at the account level, and at the organization level where AWS Organizations is used, before creating new buckets. Keep publicly served content in a separate, documented bucket or behind a content delivery service, and review exceptions whenever a project ends. Treat buckets that hold camera exports or backups as sensitive by default.

Verification

Use IAM Access Analyzer for S3 or the S3 console to list buckets with public access, confirm all four settings at account and bucket level, and check Security Hub S3.8 findings monthly. Record each approved public-content exception with an owner and review date.

Official reference

Amazon S3 User Guide — Blocking public access to your Amazon S3 storage. Reviewed October 18, 2026.