How to disable Internet wide access to the S3 bucket using AWS CLI

Introduction

AWS allows bucket owners to set visibility for a bucket to become accessible over the Internet. Any Internet based user, regardless of their authentication status with AWS can make HTTP requests and access the bucket and the objects via a browser.

This allows for an Internet located attacker to access the bucket using a user agent or using the AWS CLI as well. In case there is some sensitive or critical data within the publicly accessible bucket, it will become available to the attackers as well without any authentication requirement. Based on the quantity and type of data uncovered, it may be possible for Internet located attackers to perform additional attacks within the AWS target environment.

Steps to disable Internet wide access to the S3 bucket in AWS using CLI

1. Run the command to list the S3 buckets

   aws s3 ls

2. Run the below command to enable Public Access Block

   aws s3api put-public-access-block --bucket <bucket_name> --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"

   

3. Run the command below to confirm Public Access Block is enabled. If it is enabled it will show the values as True under PublicAccessBlockConfiguration

   aws s3api get-public-access-block --bucket <bucket_name>