S3 access points should have block public access settings enabled

How to fix it

• Replaces the resource: An access point's Block Public Access settings are fixed at creation: create a new one on the same bucket with them on, repoint clients to its ARN or alias, then delete this one.

In the console

S3 → Access Points → Create access point

Block all public access

Selected (the default)

With the AWS CLI

aws s3control create-access-point --account-id <account-id> --name <access-point> --bucket <bucket> --public-access-block-configuration BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=true

With Terraform

resource "aws_s3_access_point" "this" {
  bucket = aws_s3_bucket.this.id
  name   = "example"

  public_access_block_configuration {
    block_public_acls       = true
    block_public_policy     = true
    ignore_public_acls      = true
    restrict_public_buckets = true
  }
}