S3 general purpose buckets should have block public access settings enabled

How to fix it

• Can break clients: Once this applies, every bucket in the account refuses anonymous reads (such as a static website's), uploads that set a public ACL, and other accounts' access through a public bucket policy.
• Affects another check: This also clears S3.2 and S3.3 for every bucket in the account, but not S3.8, which checks each bucket's own Block Public Access settings.

In the console

S3 → Account and organization settings → Block Public Access settings for this account

Block all public access

Selected

With the AWS CLI

aws s3control put-public-access-block --account-id <account-id> --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --region us-east-1

With Terraform

resource "aws_s3_account_public_access_block" "this" {
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}