AWS S3 SCP Policy to Prevent Disabling Public Access Block but Allow Re-enabling

Question

I need to create an AWS IAM policy that prevents users from disabling the "Block all public access" configuration on S3 buckets, but still allows them to re-enable it if it was already disabled. I need to provide exemptions, when needed like exempting some accounts and buckets.

I initially tried this policy.

 {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDisablingBPAExceptExemptBucketsAndAccounts",
      "Effect": "Deny",
      "Action": [
        "s3:PutBucketPublicAccessBlock",
        "s3:PutAccountPublicAccessBlock"
      ],
      "NotResource": [
        "arn:aws:s3:::<bucketname>"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalAccount": [
            "account-id-1"
          ]
        },
       "StringEquals": {
          "s3:x-amz-public-access-block-enabled": "false"
        }
      }
    }
  ]
}

The condition key s3:x-amz-public-access-block-enabled is invalid in AWS.

I need to,

Deny users from disabling the public access block settings
If Block Public Access (BPA) is already ON, no one should be able to turn it OFF.
If BPA is OFF, users should be allowed to turn it ON.

The above policy is disabling both the conditions. How can I construct an IAM policy that achieves this?

Intuz Cloud · Accepted Answer · 2025-11-05 09:25:00Z

0

Use the S3 Public Access Block condition keys — not s3:x-amz-public-access-block-enabled (it doesn’t exist). Add an explicit Deny on s3:PutBucketPublicAccessBlock and s3:PutAccountPublicAccessBlock when any of these is false (use BoolIfExists):
s3:PublicAccessBlockConfiguration/BlockPublicAcls, /IgnorePublicAcls, /BlockPublicPolicy, /RestrictPublicBuckets.
Exempt accounts with aws:PrincipalAccount; exempt buckets via NotResource on their ARNs.

If you run into related issues around S3 Block Public Access behavior, this might help you:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

answered Nov 5 at 9:25

Intuz Cloud

1

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

AWS S3 SCP Policy to Prevent Disabling Public Access Block but Allow Re-enabling

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related