Use PublicAccessBlockConfiguration for extra defense in depth against accidental public access about s3-credentials HOT 5 CLOSED

The linked documentation says "By default, new buckets, access points, and objects do not allow public access" - which would explain why my testing has shown that buckets created by this tool do not enable public access.

Maybe there's an issue where buckets created before a certain date were public by default? Or AWS accounts created before a specific date have their buckets created public by default?

My goal with this tool is that buckets should be created to NOT be public by default, which seems to be how it is working in my testing - but are there other AWS accounts out there for which this tool would accidentally create public buckets?

Here's my bucket creation code:

There's a StackOverflow answer here which suggests the following code: https://stackoverflow.com/a/62769484/6083

s3_bucket = s3_client.create_bucket(
    Bucket=bucket_name,
    CreateBucketConfiguration={"LocationConstraint": "eu-west-1"}
)
response_public = s3_client.put_public_access_block(
    Bucket=bucket_name,
    PublicAccessBlockConfiguration={
        "BlockPublicAcls": True,
        "IgnorePublicAcls": True,
        "BlockPublicPolicy": True,
        "RestrictPublicBuckets": True,
    },
)

from s3-credentials.

This page helped me understand what these options do: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

The Amazon S3 Block Public Access feature provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects don't allow public access. However, users can modify bucket policies, access point policies, or object permissions to allow public access. S3 Block Public Access settings override these policies and permissions so that you can limit public access to these resources.

With S3 Block Public Access, account administrators and bucket owners can easily set up centralized controls to limit public access to their Amazon S3 resources that are enforced regardless of how the resources are created.

So if I set PublicAccessBlockConfiguration against an S3 bucket that is created with the tool it provides defense in depth against some other configuration change making objects in that bucket public in some way.

from s3-credentials.

I'm going to apply those blocks by default unless the user passes a --enable-public-access option.

from s3-credentials.

It looks like things have changed in S3 world, and creating a bucket that has public access is actually really difficult these days. The buckets created by this tool are absolutely not public.

I still want to add PublicAccessBlockConfiguration though, as further defense in depth.

from s3-credentials.

This is obsoleted by:

• #88

from s3-credentials.