Tools · Cloud security · 24 / 26
S3: the block you read is that level
Block Public Access can be set on the account and on a bucket. The setting you queried is the level in that response. Write the level. Do not describe the other level from a response that did not include it.
Account and bucket are different reads
An account-level Block Public Access response describes the account. A bucket-level response describes that bucket. They can differ. A sentence that says “public access is blocked” has to say which level you read.
If you only called one API, write “other level not queried.” Do not copy the four flags from the account onto a bucket you did not read, or the reverse.
A policy text is a third record
A bucket policy is the policy document. It is not the block flags. A policy that names a principal is not proof objects are reachable, and a block flag is not the policy text. Quote the document only if you saved it.
This note does not change the settings. It only stops one response from standing in for the others.
What to write down
File the account or the bucket name, which API you called, and the flags that response returned. Label account-level or bucket-level. Leave the other side blank until you have its response.
Lab: an account block read as every bucket
The account 111122223333 account-level Block Public Access response shows all four blocks on. Bucket lab-logs was not queried. A draft says lab-logs is blocked because the account is blocked.
The note quotes the four flags as the account-level response. Bucket lab-logs: not queried. The draft does not claim the bucket’s own flags. Those wait for a bucket-level read.
account: 111122223333 read: account-level Block Public Access flags: all four on bucket lab-logs: not queried write: account level only not: lab-logs flags
Diagram
Which block response you actually have
Name the level before you say access is blocked.
- Account-level response
The account’s flags. Not a substitute for one bucket you skipped.
- Bucket-level response
That bucket’s flags. Not the account’s flags.
- Bucket policy text
A document, only if you saved it. Not the block flags.
- A level you did not call
Write that it was not queried.
Check yourself
1. You read account-level Block Public Access and did not read bucket lab-logs. What do you know about lab-logs?
2. A bucket policy is saved and the block flags are not. What can you quote as the block?
3. Both levels were read and they differ. What do you file?