Control: AWS > PCI v3.2.1 > S3 > 6 S3 Block Public Access setting should be enabled

This control checks whether the following public access block settings are configured at the account level.

ignorePublicAcls: true, blockPublicPolicy: true blockPublicAcls: true restrictPublicBuckets: true

The control passes if all of the public access block settings are set to true.

The control fails if any of the settings are set to false, or if any of the settings are not configured. When the settings do not have a value, the AWS Config rule cannot complete its evaluation.

As an AWS best practice, S3 buckets should block public access. Unless you explicitly require everyone on the internet to be able to access your S3 bucket, you should ensure that your S3 bucket is not publicly accessible.

Remediation

1. Open the Amazon S3 console.
2. In the navigation pane, choose Block public access (account settings).
3. Choose Edit. Then select Block all public access.
4. Choose Save changes

PCI requirement(s): 1.2.1, 1.3.1, 1.3.2, 1.3.4, 1.3.6