Block S3 public access at account level

Question

Is there a way to block public access to s3 at the account level using cloud formation? I tried adding this block to my CF template but it fails saying resource could not be created. Does it expect this to be done ONLY at the bucket level? When navigating the AWS UI there is a way to block it at the account level and I'm trying to replicate that using CF.

  # Block S3 public access
  BlockS3PublicAccess:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True

user_248823 · Answer

Its not supported. You would have to create a custom resource and a lambda function. If you were to use Python for the function, then you would set the public access using boto3's put_public_access_block. An example of how to do it is here.

Block S3 public access at account level

1 Answers