S3 Block Public Access has four independent settings: BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy and RestrictPublicBuckets. Together they stop public access granted through ACLs or bucket policies. AWS recommends turning all four on for the account, then adding exceptions only where you truly host public content.
Why four settings
Public access to S3 can come from access control lists, bucket policies, or access point policies. The four settings cover those routes in different ways, and each one is useful on its own.
- BlockPublicAcls: Makes calls fail if they try to set a public ACL. Existing ACLs are left alone.
- IgnorePublicAcls: Tells S3 to ignore public ACLs that already exist. Calls that include a public ACL still succeed.
- BlockPublicPolicy: Rejects bucket and access point policies that allow public access.
- RestrictPublicBuckets: If a bucket has a public policy, limits access to AWS service principals and authorized users in the owner's account.
The first two are about ACLs, the last two about policies. One stops new problems, the other neutralises old ones.
Prevent versus ignore
BlockPublicAcls is preventive. It will not touch an ACL already in place. IgnorePublicAcls is corrective. It makes S3 behave as if public ACLs were not there, which is a safe way to close exposure while you audit what is out there.
The same split exists for policies. BlockPublicPolicy rejects new public policies, while RestrictPublicBuckets cuts off access from an already public policy. Note that RestrictPublicBuckets also blocks cross-account access when the policy is public, even to specific accounts named in the same policy.
Why account level matters
AWS says BlockPublicPolicy works best at the account level. A bucket policy can change a bucket's own block public access settings, so anyone allowed to edit a bucket policy could switch the protection off for that bucket. At the account level that loophole is closed.
Settings are evaluated at several levels, and S3 applies the most restrictive combination of organization, account, bucket and access point settings. You can also manage them across an organization with an AWS Organizations policy, which then overrides account settings.
What counts as public
AWS says an ACL is public if it grants anything to the AllUsers or AuthenticatedUsers groups. For a bucket policy, S3 starts by assuming public, then checks whether access is limited to fixed values such as specific principals, source VPCs or IP ranges without wildcards. A policy with Principal set to a star and no limiting condition is public.
Limits to remember
- The settings do not change existing policies or ACLs. Remove the setting and the old public grant works again.
- They guard resource policies and ACLs on S3 itself. AWS also tells you to inspect identity-based policies and KMS key policies, which Block Public Access does not rewrite.
- Hosting a public static website needs some of these settings relaxed. Prefer a dedicated bucket in its own account for that.
Quick check
Are new buckets public by default?
No. AWS states that new buckets, access points and objects do not allow public access by default. Block Public Access is protection against someone later granting it.
Which one setting should I turn on first?
Turn on all four at the account level. If you must stage it, AWS notes BlockPublicPolicy is the one that works best at account level, since it cannot be undone by editing a bucket policy.
Sources
Last reviewed: 19 October 2026.
