6WAF

S3 bucket Public Access Block missing or incomplete

HIGH

What's the problem

The bucket does not have all four Public Access Block settings enabled, or has no configuration at all — risk of public data exposure

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Data protection (S3, EBS, KMS)

Get the 39-point AWS waste checklist by email (free, self-serve)

Used only for the checklist + max 1 useful email/week. No spam.

Scan this check (and the other 68) automatically in ~10 minutes

Start free

Related checks

S3 account-level Public Access Block not fully enabledS3 bucket uses SSE-S3 instead of SSE-KMSS3 bucket has no explicit encryption configurationEBS volume not encrypted