S3.2: Public S3 buckets expose data to anyone on the internet

What does AWS Security Hub S3.2 check?

S3.2 fails any bucket whose ACL or policy allows public read access, i.e. anyone on the internet can list or download objects.

Why does S3.2 matter?

Public-read buckets are behind a large share of cloud data leaks: customer PII, backups, and credentials sitting one anonymous GET away. Attackers actively scan for them, and discovery is often automated within minutes of exposure. There is rarely a good reason for a data bucket to be world-readable.

How do I fix S3.2?

1. Enable Block Public Access on the bucket to immediately cut public read.
2. Remove the offending Principal "*" grants from the bucket policy and any public-read ACLs.
3. For content that must be public, front it with CloudFront + OAC rather than exposing the bucket directly.

# Close the highest-impact public exposure first: databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?PubliclyAccessible==`true`].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --no-publicly-accessible --apply-immediately
  echo "$db: public access removed"
done

# Ratchet S3 shut at the account level so no bucket can be made public again.
aws s3control put-public-access-block --account-id 123456789012 \
  --public-access-block-configuration \
    'BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true'