An account contains several S3 buckets.
Prevent accidental public ACL or bucket-policy settings with a preventive control above individual configurations.
Which feature is most appropriate?
Apply S3 Block Public Access at the account or bucket level to block public ACLs and policies that could expose data.
Detailed explanation
Anonymous access creates the exposure the preventive control is meant to avoid.
Anonymous access creates the exposure the preventive control is meant to avoid.
An IAM display name does not change S3 bucket public-access behavior.
An IAM display name does not change S3 bucket public-access behavior.
Using a public bucket increases exposure rather than preventing it.
Using a public bucket increases exposure rather than preventing it.
Block Public Access provides a higher-level control that blocks public access paths from ACLs and policies.
Block Public Access provides a higher-level control that blocks public access paths from ACLs and policies.
Check official documentation
Compare the following points with the official documentation.
Amazon S3 Block Public Accessの公式説明を確認する。
What to confirm
S3公開防止のアカウント・バケット設定を選択できる。
Key points
- S3 Block Public Access
- Public ACL
- Bucket policy
Notes
- Environment: AWS公式S3ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Preventive guardrail
A higher-level block reduces the chance that an individual ACL or policy exposes data.
Origin security
A CDN origin should not be made public merely to deliver content.