S3 bucket public access block audit

Reports the four block-public-access settings for a bucket alongside its object ownership rule. All four flags returning 1 means the bucket cannot be made public by ACL or policy. Any flag returning 0 leaves a corresponding exposure path open and is the finding to report. Enumerate buckets with aws/s3/buckets-list and iterate this query over them for an account sweep.

Query

SELECT
bucket_name,
json_extract(public_access_block_configuration, '$.BlockPublicAcls') as block_public_acls,
json_extract(public_access_block_configuration, '$.IgnorePublicAcls') as ignore_public_acls,
json_extract(public_access_block_configuration, '$.BlockPublicPolicy') as block_public_policy,
json_extract(public_access_block_configuration, '$.RestrictPublicBuckets') as restrict_public_buckets,
json_extract(ownership_controls, '$.Rules[0].ObjectOwnership') as object_ownership
FROM awscc.s3.buckets
WHERE region = '{{region}}'
AND Identifier = '{{bucket_name}}';

Reading the result

A bucket returning 1 for all four flags is compliant. The flags map to distinct exposure paths, so a 0 in any one of them is actionable: BlockPublicAcls 0 allows new public ACLs to be set, IgnorePublicAcls 0 means existing public ACLs still grant access, BlockPublicPolicy 0 allows a public bucket policy to be attached, and RestrictPublicBuckets 0 means an existing public policy grants access to anyone rather than only authorised principals. An object_ownership of BucketOwnerEnforced removes ACLs from the picture entirely, so ACL-related findings on such a bucket are theoretical rather than exploitable.

Notes

Values arrive as 1 and 0 rather than true and false because json_extract maps JSON booleans to integers. A null public_access_block_configuration means no block configuration exists at all, which is the worst case - every path is open - and is distinct from a configuration with all flags set to 0. The native aws.s3.public_access_blocks resource returns empty rather than the configuration, so this Cloud Control read is the reliable source. The region must be the bucket's own region, available as bucket_region from aws/s3/buckets-list. This checks the account-level and bucket-level block configuration, not whether a public policy or ACL is actually attached: a bucket with blocks disabled is not necessarily public, only capable of becoming so, so confirm with the bucket policy before reporting a bucket as publicly readable. Computed CASE expressions cannot be aliased in a projection over awscc resources, so verdict logic belongs client-side.