title: “S3 Block Public Access” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

aws
s3
security
certification

S3 Block Public Access

What It Is

Block Public Access (BPA) is a set of four independent bucket-level settings that act as a safety net to prevent any public access to your S3 bucket, regardless of individual object ACLs or bucket policies.

Why It Matters

BPA is the first line of defense against accidental data exposure. It overrides any permissive ACL or policy at a higher level. This is a heavily tested topic on certification exams — understanding how BPA interacts with ACLs and policies is essential.

Key Concepts

The Four Settings

Setting	What It Blocks
BlockPublicAcls	Rejects PUT requests that include a public ACL
IgnorePublicAcls	Ignores all public ACLs on existing objects
BlockPublicPolicy	Rejects bucket policies that grant public access
RestrictPublicBuckets	Restricts access to accounts/principals only (no anonymous)

Hierarchy

BPA can be set at three levels:

Account level — applies to all buckets in the account
Bucket level — applies to a specific bucket
The most restrictive setting wins

Default Behavior

Since April 2023, new buckets have BPA enabled by default (all four settings ON)
This means “Make public using ACL” will fail until BPA is explicitly disabled

Interaction with ACLs and Policies

BPA ON + public ACL = Access Denied (BPA wins)
BPA ON + permissive bucket policy = policy is rejected or ignored
BPA OFF + public ACL = object is publicly accessible
Best practice: keep BPA ON and use IAM/bucket policies for controlled access

Gotchas

Disabling BPA does not automatically make anything public — it only removes the guard
Changing BPA requires typing “confirm” in the console (intentional friction)
Account-level BPA can block bucket-level permissions even if the bucket BPA is off
In production, use least permissive settings — only disable what you specifically need

AWS Certification Notes