S3 Multi-Region Access Points should have block public access settings enabled

How to fix it

• Replaces the resource: A Multi-Region Access Point's Block Public Access settings are fixed at creation: create a new one over the same buckets with them on, repoint clients to its ARN or alias, then delete this one.

In the console

S3 → Access Points → Multi-Region → Create Multi-Region Access Point

Block all public access

Selected (the default)

With Terraform

• Interrupts service: Changing public_access_block in an existing aws_s3control_multi_region_access_point deletes it before the new one exists, so declare the new one as a separate resource instead.

resource "aws_s3control_multi_region_access_point" "this" {
  details {
    name = "example"

    public_access_block {
      block_public_acls       = true
      block_public_policy     = true
      ignore_public_acls      = true
      restrict_public_buckets = true
    }

    region {
      bucket = aws_s3_bucket.this.id
    }
  }
}