S3 bucket allows public access
What it means
The bucket does not block all four forms of public access. Blocking ACLs alone is not enough — a bucket policy can still open it, and vice versa.
Why it matters
This is the single most common way data leaks from AWS, and it rarely looks like a mistake in the code. Someone sets publicReadAccess to serve a static site, the same bucket later gets used for uploads, and the exposure is invisible because nothing errors. Every object in the bucket is readable by anyone who knows the URL.
How to fix it
Set `blockPublicAccess: BlockPublicAccess.BLOCK_ALL`. If the bucket really is a public website, put CloudFront in front of it with an origin access control and keep the bucket itself private.
See it fail
This stack trips AwsSolutions-S2 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.
Open “Public S3 bucket” in the playground →A graded checkpoint on exactly this decision — you write the CDK, the same engine marks it.
Start the checkpoint · 12 min →