Question

A SysOps administrator discovers that several S3 buckets across an account have overly permissive bucket policies and ACLs that grant public read access to objects. The compliance team requires that no bucket in the account can be made public, regardless of individual bucket policies or ACLs that developers might apply in the future. What is the MOST effective way to enforce this requirement?

Accepted Answer

Enable S3 Block Public Access settings at the account level to override any bucket-level policies or ACLs that grant public access

Answer

Attach a bucket policy to each bucket that explicitly denies s3:GetObject when the request comes from an anonymous principal

Answer

Enable default encryption on all buckets and rotate the KMS key to prevent anonymous access to objects

Answer

Configure an S3 Lifecycle rule on each bucket to transition public objects to S3 Glacier where they cannot be accessed publicly