Skip to main content
selectawscclast verified 2026-07-29
Servicess3
CredentialsAWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
Permissionscloudformation:GetResource s3:GetBucketPublicAccessBlock s3:GetEncryptionConfiguration s3:GetBucketVersioning s3:GetBucketOwnershipControls s3:GetBucketLogging
Expensive at scale. One request per bucket when iterated over an inventory

S3 bucket security detail

Returns the full security configuration of a single S3 bucket: block public access, default encryption, versioning, object ownership and logging. Use it to answer "is this bucket configured safely" for one bucket, or iterate it over aws/s3/buckets-list for an account-wide audit.

Query​

SELECT
bucket_name,
public_access_block_configuration,
bucket_encryption,
versioning_configuration,
ownership_controls,
logging_configuration,
object_lock_enabled,
tags
FROM awscc.s3.buckets
WHERE region = '{{region}}'
AND Identifier = '{{bucket_name}}';

Variation: flatten the JSON attributes​

Extract the individual settings rather than returning whole documents:

SELECT
bucket_name,
json_extract(public_access_block_configuration, '$.BlockPublicAcls') as block_public_acls,
json_extract(public_access_block_configuration, '$.BlockPublicPolicy') as block_public_policy,
json_extract(bucket_encryption, '$.ServerSideEncryptionConfiguration[0].ServerSideEncryptionByDefault.SSEAlgorithm') as encryption_algorithm,
json_extract(ownership_controls, '$.Rules[0].ObjectOwnership') as object_ownership
FROM awscc.s3.buckets
WHERE region = '{{region}}'
AND Identifier = '{{bucket_name}}';

Notes​

This is a keyed Cloud Control read - one request per bucket - and the region must be the bucket's own region, which aws/s3/buckets-list returns as bucket_region. The equivalent native per-aspect resources (aws.s3.public_access_blocks and friends) currently return empty rather than the configuration, so the Cloud Control resource is the reliable path. Boolean values inside the JSON documents come back as 1 and 0 through json_extract, not true and false. A null versioning_configuration means versioning was never enabled, which is materially different from Suspended. ownership_controls of BucketOwnerEnforced disables ACLs entirely, making ACL based public exposure impossible regardless of the block settings. Computed CASE expressions cannot be aliased in a projection over awscc resources - the query fails with a cannot find col error - so return the raw values and interpret them client-side.

Related queries

  • S3 buckets cheap enumeration - Enumerates every S3 bucket in the account with its ARN, home region and creation date in one account-global call.
  • S3 bucket public access block audit - Reports the four block-public-access settings plus object ownership for a bucket; any flag returning 0 leaves a public exposure path open.