Public Access
Data ProtectionPublic Access means a resource is reachable from the internet without authentication. While sometimes intentional (static website hosting on S3), it is frequently accidental and a leading cause of data breaches.
Common Public Access Risks
- S3 buckets: public bucket policies or ACLs exposing sensitive data
- RDS instances: publicly accessible database endpoints
- Security groups: inbound rules allowing
0.0.0.0/0on sensitive ports - EBS snapshots: shared publicly with all AWS accounts
- AMIs: shared publicly
Prevention
- S3 Block Public Access (account-level and bucket-level)
- AWS Config rules to detect public resources
- Security Hub checks (CIS, FSBP)
- SCPs to prevent making resources public
Related Content
Related Terms
A resource-based JSON policy attached to an S3 bucket that controls who can access the bucket and its objects, including cross-account and public access.
A virtual firewall for EC2 instances and other resources that controls inbound and outbound traffic at the instance level using allow rules.
The scope of impact when a security incident occurs - how many resources, accounts, or users are affected. Smaller blast radius means better security posture.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.