Enforce S3 Block Public Access at Organization Level
Specification & Description
Enforce S3 Block Public Access across all Landing Zone accounts using a multi-layered governance strategy: the primary control utilizes the native AWS Organizations S3 Policy type applied globally from the Management account, backed by an SCP to prevent local tampering of bucket/account settings, and continuous AWS Config tracking.
Technical Specifications
S3 Block Public Access operates across three distinct governance layers that must be aligned:
1. Organizations-level S3 Policy Type (Primary Control)
AWS Organizations supports a dedicated "S3 Policy" resource type. When enabled and configured on the Organization Root via the Management account, it globally overrides and enforces S3 Block Public Access across all underlying member accounts, buckets, and objects natively.
The four settings and what each prevents:
| Setting | Effect |
|---|---|
BlockPublicAcls | Rejects PUT requests that include a public ACL; ignores public ACLs on existing objects |
IgnorePublicAcls | Ignores all public ACLs on buckets and objects, even if already set |
BlockPublicPolicy | Rejects bucket policies that grant public access |
RestrictPublicBuckets | Restricts access to buckets with public policies to only AWS services and authorized users |
All four must be enabled. Enabling only a subset leaves exploitable gaps -
for example, enabling BlockPublicPolicy without IgnorePublicAcls still allows
public access via legacy ACLs.
2. SCP Guardrail - Prevent Local Bypass (Defense in Depth)
While the Organizations S3 Policy type acts as an absolute override, an SCP is applied to member accounts to block unauthorized local attempts to drop account-level or bucket-level configurations, preventing intentional or accidental local drift.
3. AWS Config - Continuous Drift Detection
The s3-account-level-public-access-blocks-periodic managed Config rule evaluates member accounts on a periodic schedule,
ensuring local resource structures remain aligned and visible to compliance frameworks.
Security Rationale
Publicly exposed S3 storage is a primary vehicle for enterprise data breaches. Relying on individual account administrators to maintain local S3 blocks creates scaling risks. Utilizing the native AWS Organizations S3 Policy type provides an absolute central override that cannot be altered or bypassed at the individual member account or bucket level, while an SCP prevents local state changes.