Sign In to the Console
AWS Config
Developer Guide

AWS Documentation » AWS Config » Developer Guide » Evaluating Resources with Rules » AWS Config Managed Rules » List of AWS Config Managed Rules » s3-bucket-public-write-prohibited

s3-bucket-public-write-prohibited

Checks that your Amazon S3 buckets do not allow public write access. The rule checks the Block Public Access settings, the bucket policy, and the bucket access control list (ACL).

The rule is compliant when both of the following are true:

  • The Block Public Access setting restricts public policies or the bucket policy does not allow public write access.

  • The Block Public Access setting restricts public ACLs or the bucket ACL does not allow public write access.

The rule is noncompliant when:

  • If the Block Public Access setting does not restrict public policies, AWS Config evaluates whether the policy allows public write access. If the policy allows public write access, the rule is noncompliant.

  • If the Block Public Access setting does not restrict public bucket ACLs, AWS Config evaluates whether the bucket ACL allows public write access. If the bucket ACL allows public write access, the rule is noncompliant.

Identifier: S3_BUCKET_PUBLIC_WRITE_PROHIBITED

Trigger type: Configuration changes

Parameters:

None

AWS CloudFormation template

To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.