Enable S3 Block Public Access for AWS Accounts

01 Sign in to the AWS Management Console.

02 Navigate to Amazon S3 console at https://console.aws.amazon.com/s3/.

03 In the left navigation panel, choose Block Public Access settings for account.

04 On the Block Public Access settings for account page, check the configuration status of each option available under Block all public access. If the configuration status for all the feature options, i.e. Block public access to buckets and objects granted through new access control lists (ACLs), Block public access to buckets and objects granted through any access control lists (ACLs), Block public access to buckets and objects granted through new public bucket or access point policies ,and Block public and cross-account access to buckets and objects through any public bucket or access point policies , is set to Off , the S3 Block Public Access feature is not enabled in your AWS cloud account, therefore the Amazon S3 public access is not disabled for data protection at the AWS account level.

05 Repeat steps no. 1 – 4 to determine the S3 Block Public Access feature configuration for other AWS cloud accounts.

01 Run get-public-access-block command (OSX/Linux/UNIX) using the account ID as the identifier parameter to describe the S3 Block Public Access feature configuration for your AWS account:

aws s3control get-public-access-block
  --region us-east-1
  --account-id 123456789012

02 The command output should return the requested feature configuration information:

An error occurred (NoSuchPublicAccessBlockConfiguration) when calling the GetPublicAccessBlock operation: The public access block configuration was not found.

03 Repeat steps no. 1 and 2 to determine the S3 Block Public Access feature configuration for other AWS cloud accounts.

01 CloudFormation template (JSON):

{
	"AWSTemplateFormatVersion": "2010-09-09",
	"Description": "Enable S3 Block Public Access for AWS Accounts",
	"Resources": {
		"S3BlockPublicAccess": {
			"Type": "AWS::S3::AccountPublicAccessBlock",
			"Properties": {
				"BucketName": "cc-logging-data",
				"PublicAccessBlockConfiguration": {
					"BlockPublicAcls": true,
					"IgnorePublicAcls": true,
					"BlockPublicPolicy": true,
					"RestrictPublicBuckets": true
				}
			}
		}
	}
}

02 CloudFormation template (YAML):

AWSTemplateFormatVersion: '2010-09-09'
	Description: Enable S3 Block Public Access for AWS Accounts
	Resources:
	S3BlockPublicAccess:
		Type: AWS::S3::AccountPublicAccessBlock
		Properties:
		BucketName: cc-logging-data
		PublicAccessBlockConfiguration:
			BlockPublicAcls: true
			IgnorePublicAcls: true
			BlockPublicPolicy: true
			RestrictPublicBuckets: true

01 Terraform configuration file (.tf):

	terraform {
		required_providers {
			aws = {
				source  = "hashicorp/aws"
				version = "~> 4.0"
			}
		}

		required_version = ">= 0.14.9"
	}

	provider "aws" {
		profile = "default"
		region  = "us-east-1"
	}

	# Enable S3 Block Public Access for AWS Accounts
	resource "aws_s3_account_public_access_block" "s3-block-public-access" {
		block_public_acls = true
		block_public_policy = true
		ignore_public_acls = true
		restrict_public_buckets = true
	}

01 Sign in to the AWS Management Console.

02 Navigate to Amazon S3 console at https://console.aws.amazon.com/s3/.

03 In the navigation panel, choose Block Public Access settings for account to access thefeature configuration page.

04 On the Block Public Access settings for account page, choose Edit to modify the feature configuration.

05 To enable the S3 Block Public Access security feature, select the Block all public access checkbox to activate all feature options, and choose Save changes. These access options are applied to all your existing Amazon S3 buckets and also to those that you create in the future.

06 Within Edit Block Public Access settings for account dialog box, type confirm in the required box, then choose Confirm to apply the changes.

07 Repeat steps no. 1 – 6 to restrict Amazon S3 public access for other Amazon Web Services (AWS) accounts.

01 Run put-public-access-block command (OSX/Linux/UNIX) with the AWS account ID as the identifier parameter, to enable and configure the Amazon S3 Block Public Access feature for your AWS cloud account. This access configuration is applied to all your existing Amazon S3 buckets and to those that you create in the future (the command does not produce an output):

aws s3control put-public-access-block
  --region us-east-1
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
  --account-id 123456789012

02 Repeat step no. 1 to restrict Amazon S3 public access for other Amazon Web Services (AWS) accounts.