For data protection, access control, and auditing
Keep all four settings enabled at both the account and bucket levels unless public access is explicitly required. New buckets have Block Public Access enabled by default.
Centrally enforce settings across accounts with AWS Organizations.
Docs
Identity-based policies define which S3 actions IAM users, groups, and roles can perform. Grant only the required actions and resource ARNs.
An explicit deny overrides an allow.
Docs Resource-based policies control access to one bucket and its objects, including cross-account access. Combine principals, actions, resources, and conditions.
Use conditions to restrict organization, network, TLS, and encryption requirements.
Docs
AWS Organizations resource control policies constrain permissions available to S3 resources; service control policies constrain principals in member accounts.
They set maximum permissions. They never grant access.
Docs Create named endpoints with their own policies for shared datasets or applications. An access point policy and the underlying bucket policy work together.
Access points can be restricted to requests originating from a VPC.
Docs Grant scoped access by bucket, prefix, or object to IAM identities and users or groups from a corporate directory.
Integrate corporate directory identities through IAM Identity Center.
Docs Legacy grants can provide basic bucket or object permissions to other AWS accounts. New buckets use Bucket owner enforced Object Ownership, which disables ACLs.
Keep ACLs disabled unless a legacy integration specifically requires them.
Docs Provide time-limited access to a specific operation using the permissions of the identity that created the URL.
Treat them as bearer tokens, keep lifetimes short, and restrict signature age when appropriate.
Docs Controls which browser origins, methods, and headers may make cross-origin requests to a bucket.
CORS does not authorize a request. IAM, bucket policies, and other access controls still apply.
Docs Requires MFA to change a bucketβs versioning state or permanently delete an object version.
Only the bucket ownerβs root account can enable it, using the API or CLI. Incompatible with lifecycle configurations.
Docs Route S3 traffic privately from a VPC without an internet gateway or NAT device. Gateway endpoints have no additional charge.
Use endpoint and bucket policies to limit accessible buckets and actions.
Docs Use AWS PrivateLink for private S3 access from on premises over VPN or Direct Connect, or from connected VPCs in other Regions.
Interface endpoint pricing applies.
Docs Deny requests that do not use secure transport with the aws:SecureTransport condition in a bucket policy.
Account for AWS service principals when denying on network conditions; service-to-service context can be redacted.
Docs Keeps multiple object versions so you can recover from accidental overwrites, deletions, or malicious changes.
Monitor storage costs and use lifecycle rules for noncurrent versions.
Docs Protects individual object versions with write-once-read-many retention or legal holds. Requires versioning; supports new and existing general purpose buckets.
Governance retention can be bypassed with permission; compliance retention cannot be shortened, even by root.
Docs
Use replication or AWS Backup to maintain tested recovery copies in another account or protected backup vault.
Separate administrative access and encryption keys from the source data.
Docs Amazon S3 automatically encrypts every new upload with S3-managed keys (SSE-S3) as the base level of encryption.
No extra charge for SSE-S3. Changing default encryption does not re-encrypt existing objects.
Docs
Use AWS KMS keys for key-policy control and auditability. DSSE-KMS applies two independent layers of server-side encryption.
S3 Bucket Keys reduce SSE-KMS request costs; they do not support DSSE-KMS.
Docs S3 performs encryption using a key you supply with each read or write request. Keep this option disabled unless required.
Disabled by default for new general purpose buckets since April 2026, and for existing buckets in accounts without SSE-C objects.
Docs Encrypt data before upload and decrypt it after download. Your application owns the encryption workflow and key management.
Protect the client-side keys separately from the stored data.
Docs Records detailed requests made to a bucket and delivers logs to a destination S3 bucket or CloudWatch Logs.
Delivery is best-effort: records can be delayed, missing, or duplicated.
Docs
Records object-level API activity such as GetObject, PutObject, and DeleteObject.
Opt in through a trail or event data store; charges apply. Data events do not appear in Event history.
Docs Audit bucket-level operations, including changes to bucket policies, versioning, and replication configuration.
Event history includes 90 days of management events per Region. Use a trail or event data store for longer retention.
Docs Identify S3 buckets shared publicly or with accounts outside your configured zone of trust.
Review the policy or ACL behind each finding and confirm that the access is intended.
Docs
Record bucket configuration changes and evaluate rules for public access, HTTPS enforcement, versioning, and logging.
Use configuration history and compliance findings to detect drift from your required settings.
Docs
Discovers, classifies, and reports sensitive data in S3 using automated discovery or targeted discovery jobs.
Use findings to prioritize exposure and data-protection work.
Docs
Analyzes S3 data events to identify suspicious or malicious access patterns, including possible data exfiltration or destruction.
Uses an independent event stream; you do not need to enable CloudTrail data-event logging for GuardDuty.
Docs Use Storage Lens for organization-wide usage and protection metrics; use S3 Inventory to audit object encryption and replication status.
Review trends and exceptions on a recurring schedule.
DocsCopy a ready-to-use prompt into your preferred AI assistant.
