How to Find All Public S3 Buckets in Your AWS Account

Layer 1: Block Public Access (BPA)

Block Public Access is a meta-control that overrides bucket policies and ACLs. It exists at two levels: account-level (applies to all buckets) and bucket-level (applies to individual buckets). Account-level BPA settings take precedence: if account-level BPA is fully enabled, no individual bucket can be made public regardless of its policy or ACLs.

Block Public Access has four settings that can be independently enabled:

• BlockPublicAcls: Ignores ACL grants that make objects public
• IgnorePublicAcls: Makes existing public ACLs ineffective
• BlockPublicPolicy: Prevents bucket policies that grant public access
• RestrictPublicBuckets: Makes public bucket policies ineffective

A bucket with only BlockPublicAcls enabled (but not the other three) can still be made public via a bucket policy.

Layer 2: Bucket Policy

Bucket policies are JSON documents attached to individual buckets. A policy with Principal: "*" and Effect: Allow on any action grants that action to the entire internet, making the bucket publicly accessible regardless of BPA settings (unless BlockPublicPolicy or RestrictPublicBuckets BPA settings are enabled).

Layer 3: Object ACLs

Individual S3 objects can have ACLs that grant public-read or public-read-write permissions, overriding bucket-level settings. A bucket with a private policy can contain individual objects with public ACLs, making those specific objects publicly downloadable.

Run these using the AWS CLI with an IAM user or role that has s3:GetBucketPublicAccessBlock, s3:GetBucketPolicy, and s3:GetBucketAcl permissions across all buckets.

Check account-level Block Public Access:

aws s3control get-public-access-block --account-id $(aws sts get-caller-identity --query Account --output text)

If all four settings show true, no bucket in the account can be public regardless of individual settings. If any setting shows false, proceed to check individual buckets.

List all buckets and check their BPA settings:

# List all buckets
aws s3api list-buckets --query 'Buckets[*].Name' --output text | tr '\t' '\n' > /tmp/buckets.txt

# Check BPA for each bucket
while read bucket; do
  echo -n "$bucket: "
  aws s3api get-public-access-block --bucket "$bucket" 2>/dev/null || echo "NO BPA CONFIG (fully public possible)"
done < /tmp/buckets.txt

Any bucket that returns NoSuchPublicAccessBlockConfiguration has no bucket-level BPA settings: its exposure is controlled only by account-level BPA (if enabled) and its policy/ACLs.

Check bucket policies for public access:

while read bucket; do
  policy=$(aws s3api get-bucket-policy --bucket "$bucket" --query Policy --output text 2>/dev/null)
  if echo "$policy" | grep -q '"Principal".*"\*"'; then
    echo "PUBLIC POLICY: $bucket"
    echo "$policy" | python3 -m json.tool | grep -A2 'Principal'
  fi
done < /tmp/buckets.txt

Find buckets flagged by AWS as public (uses the S3 console metadata):

aws s3api list-buckets --query 'Buckets[*].Name' --output text | tr '\t' '\n' | while read bucket; do
  status=$(aws s3api get-bucket-acl --bucket "$bucket" --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' --output text 2>/dev/null)
  if [ -n "$status" ]; then
    echo "PUBLIC ACL: $bucket"
  fi
done

Manual auditing finds the current state. Automated detection catches future misconfigurations.

Enable S3 Account-Level Block Public Access (highest-impact single action):

aws s3control put-public-access-block \
  --account-id $(aws sts get-caller-identity --query Account --output text) \
  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

This single command prevents any bucket in the account from being made public regardless of individual bucket settings. It does not affect buckets that need to serve public content (CloudFront origins, website hosting): those require using CloudFront with an Origin Access Control rather than direct public bucket access.

AWS Config rules for continuous monitoring:

Enable these two AWS Config rules to get automated alerts when S3 configuration violates your baseline:

# Detects buckets without all four BPA settings enabled
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-account-level-public-access-blocks",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_ACCOUNT_LEVEL_PUBLIC_ACCESS_BLOCKS"}
}'

# Detects buckets with public read access
aws configservice put-config-rule --config-rule '{
  "ConfigRuleName": "s3-bucket-public-read-prohibited",
  "Source": {"Owner": "AWS", "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"}
}'

These rules appear in Security Hub as control findings if Security Hub is enabled and the S3 standard is activated.

GuardDuty S3 protection: Enabling GuardDuty S3 Protection adds monitoring of S3 data event logs: it detects unusual data access patterns like bulk downloads, access from unusual geographic locations, and access by IAM principals that have never accessed the bucket before. Enable via: GuardDuty > Settings > S3 Protection > Enable.

Some use cases require public access to S3 content. The secure pattern for each:

Static website hosting: Use CloudFront with an S3 Origin Access Control (OAC) instead of direct public bucket access. The bucket stays private; CloudFront serves as the public endpoint with HTTPS, DDoS protection, and WAF integration.

Public file downloads: Same pattern: CloudFront OAC with a private bucket. The CloudFront distribution serves files publicly while the bucket policy only grants access to CloudFront's service principal.

Public read for specific prefixes: If you must make specific objects (but not the entire bucket) publicly accessible, use a bucket policy with Resource: arn:aws:s3:::your-bucket/public/* instead of making the entire bucket public. Combine with BlockPublicPolicy: false only for the specific bucket where this is required, while keeping it true at the account level (account level does not override this when per-bucket settings exist).

The rule of thumb: no S3 bucket should have direct public access. CloudFront provides public access with caching, HTTPS, and WAF at lower cost than direct S3 public access for high-traffic content.