How to disable Internet wide access to the S3 bucket using AWS CLI

Riyaz Walikar
Feature image


AWS allows bucket owners to set visibility for a bucket to become accessible over the Internet. Any Internet based user, regardless of their authentication status with AWS can make HTTP requests and access the bucket and the objects via a browser.

This allows for an Internet located attacker to access the bucket using a user agent or using the AWS CLI as well. In case there is some sensitive or critical data within the publicly accessible bucket, it will become available to the attackers as well without any authentication requirement. Based on the quantity and type of data uncovered, it may be possible for Internet located attackers to perform additional attacks within the AWS target environment.

Steps to disable Internet wide access to the S3 bucket in AWS using CLI

  1. Run the command to list the S3 buckets

    aws s3 ls
  2. Run the below command to enable Public Access Block

    aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

    enable Public Access Block

  3. Run the command below to confirm Public Access Block is enabled. If it is enabled it will show the values as True under PublicAccessBlockConfiguration

    aws s3api get-public-access-block --bucket <bucket_name>

    get Public Access Block

← Back to Academy