For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/cloudformation-aws-s3-bucket-acl-allows-read-or-write-to-all-users.md.
A documentation index is available at /llms.txt.
S3 buckets must not use a public read-write ACL because it allows anyone on the internet to read, upload, modify, or delete objects. This risks data exposure, integrity loss, and service abuse. Check AWS::S3::Bucket resources and ensure the AccessControl property is not set to PublicReadWrite. Resources with AccessControl: PublicReadWrite will be flagged. Set AccessControl to Private or omit the ACL and enforce least-privilege access using bucket policies and a PublicAccessBlockConfiguration (enable BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, and RestrictPublicBuckets) to prevent accidental public access.
