S3 Bucket Public Access

What this rule checks

Detects S3 buckets with public access enabled.

How to fix it

1. 1Enable S3 Block Public Access settings
2. 2Review bucket policies for public access
3. 3Use VPC endpoints for private access

import * as s3 from 'aws-cdk-lib/aws-s3';

// Only ACLs are blocked — public bucket policies and public access are
// still permitted (BlockPublicPolicy / RestrictPublicBuckets are false).
new s3.Bucket(this, 'Bucket', {
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ACLS,
});

import * as s3 from 'aws-cdk-lib/aws-s3';

// Fully hardened: all four public-access blocks on, encrypted, versioned,
// and TLS enforced.
new s3.Bucket(this, 'Bucket', {
  blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
  encryption: s3.BucketEncryption.S3_MANAGED,
  versioned: true,
  enforceSSL: true,
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss s3-bucket-public-access and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "s3-bucket-public-access", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::s3-bucket-public-access',
  reason: 'Why this is intentional',
});

Use the rule ID s3-bucket-public-access shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

More S3 rules