[question] private is not real private access

[ozbillwang]

Apply the s3 bucket change with this module with option

    acl    = "private"

But the real bucket's access status is Objects can be public, which I want to set the bucket with private as Bucket and objects not public

What option should I go with?

reference:

https://docs.aws.amazon.com/AmazonS3/latest/user-guide/block-public-access.html

Viewing Access Status

The list buckets view shows whether your bucket is publicly accessible. Amazon S3 labels the permissions for a bucket as follows:

Public – Everyone has access to one or more of the following: List objects, Write objects, Read and write permissions.

Objects can be public – The bucket is not public, but anyone with the appropriate permissions can grant public access to objects.

Buckets and objects not public – The bucket and objects do not have any public access.

Only authorized users of this account – Access is isolated to IAM users and roles in this account and AWS service principals because there is a policy that grants public access.

go through this url, seems no one is suitable

https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl

[ozbillwang]

https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/

https://www.terraform.io/docs/providers/aws/r/s3_bucket_public_access_block.html

All four options need be set to true

[antonbabenko]

Hi, Bill!

Yes, you are right. This module has to implement aws_s3_bucket_public_access_block resource as well.

I will reopen this issue as a reminder for myself when I work on this.

[antonbabenko]

Hi all,

v1.6.0 has been just released. It has support for blocking public access, see an example:

terraform-aws-s3-bucket/examples/complete/main.tf

Lines 178 to 182 in 0b4680a

	// S3 bucket-level Public Access Block configuration
	block_public_acls = true
	block_public_policy = true
	ignore_public_acls = true
	restrict_public_buckets = true

[hanswesterbeek]

Ok so one must add:

resource "aws_s3_bucket_public_access_block" "all_private" {
  bucket = aws_s3_bucket.nicebucket.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.