---
title: S3 buckets should have 'Block Public Access' enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 buckets should have 'Block Public
  Access' enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 buckets should have 'Block Public Access' enabled
 
## Description{% #description %}

AWS S3 buckets should have Block Public Access enabled, either through the bucket settings or the account settings, with all four options (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, and `RestrictPublicBuckets`) set to `true`. A bucket passes when its own Block Public Access configuration or its account's Block Public Access configuration has every setting enabled; account settings apply to all regions globally. Buckets configured to host a static website are skipped because serving the site requires public access.

## Remediation{% #remediation %}

In the [Amazon S3 console](https://console.aws.amazon.com/s3/), select the bucket, open the **Permissions** tab, edit **Block public access (bucket settings)**, and select **Block all public access**, or run `aws s3api put-public-access-block --bucket <bucket-name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"`. Alternatively, enable all four settings for the whole account under **Block Public Access settings for this account**, or run `aws s3control put-public-access-block --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --account-id <account-id>`, as described in [Configuring account-level Block Public Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-account.html).

## References{% #references %}

- [Blocking public access to your Amazon S3 storage](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html)
- [Configuring block public access settings for your account](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-account.html)
- [Configuring block public access settings for your S3 buckets](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-block-public-access-bucket.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)