AWS AmazonS3 documentation change
Summary
Added documentation about organization-level Block Public Access policy enforcement hierarchy, error messages, and API behavior restrictions when organization policies are active.
Security assessment
The changes clarify how organization-level policies override account-level configurations for S3 Block Public Access, which is a security feature. While this improves documentation about security controls and policy enforcement hierarchy, there is no evidence of addressing a specific security vulnerability or incident. The additions focus on explaining existing security feature behavior and error handling.
Diff
diff --git a/AmazonS3/latest/userguide/configuring-block-public-access-account.md b/AmazonS3/latest/userguide/configuring-block-public-access-account.md index ebbc59b63..c486665ce 100644 --- a//AmazonS3/latest/userguide/configuring-block-public-access-account.md +++ b//AmazonS3/latest/userguide/configuring-block-public-access-account.md @@ -7 +7,3 @@ -Amazon S3 Block Public Access provides settings for access points, buckets, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects do not allow public access. +###### Important + +If your account is managed by an organization-level Block Public Access policy, you cannot modify these account-level settings. Organization-level policies override account-level configurations. For more information on centralized management options, see [S3 policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_s3.html) in the _AWS Organizations user guide_. @@ -9 +11 @@ Amazon S3 Block Public Access provides settings for access points, buckets, and -For more information, see [Blocking public access to your Amazon S3 storage](./access-control-block-public-access.html). +Amazon S3 Block Public Access provides settings for access points, buckets, organizations, and accounts to help you manage public access to Amazon S3 resources. By default, new buckets, access points, and objects do not allow public access. For more information, see [Blocking public access to your Amazon S3 storage](./access-control-block-public-access.html). @@ -13 +15 @@ For more information, see [Blocking public access to your Amazon S3 storage](./a -Account level settings override settings on individual objects. Configuring your account to block public access will override any public access settings made to individual objects within your account. +Account level settings override settings on individual objects. Configuring your account to block public access will override any public access settings made to individual objects within your account. When organization-level policies are active, account-level settings automatically inherit from the organization policy and cannot be modified directly. @@ -15 +17 @@ Account level settings override settings on individual objects. Configuring your -You can use the S3 console, AWS CLI, AWS SDKs, and REST API to configure block public access settings for all the buckets in your account. For more information, see the sections below. +You can use the S3 console, AWS CLI, AWS SDKs, and REST API to configure block public access settings for all the buckets in your account when not managed by organization policies. For more information, see the sections below. @@ -35,0 +38,2 @@ Amazon S3 block public access prevents the application of any settings that allo +If you receive an error message that says, "This account does not allow changes to its account-level S3 Block Public Access settings due to an organizational S3 Block Public Access policy in effect," your account is managed by organization-level policies. Contact your organization administrator to modify these settings. + @@ -50,0 +55,4 @@ You can use Amazon S3 Block Public Access through the AWS CLI. For more informat +###### Note + +`PutPublicAccessBlock` and `DeletePublicAccessBlock` operations will return an "Access Denied" error when the account is managed by organization-level policies. Account-level `GetPublicAccessBlock` operations will return the enforced organization-level policy if present. + @@ -57,0 +66,4 @@ The following examples show you how to use Amazon S3 Block Public Access with th +###### Note + +`PutPublicAccessBlock` and `DeletePublicAccessBlock` operations will fail with an "Access Denied" error if the account is managed by organization-level policies. + @@ -86 +98,3 @@ For information about using Amazon S3 Block Public Access through the REST APIs, - * [PutPublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html) + * [PutPublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html) \- Fails when account is managed by organization policies + + * [GetPublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html) \- Returns effective configuration including organization policies. @@ -88 +102 @@ For information about using Amazon S3 Block Public Access through the REST APIs, - * [GetPublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html) + * [DeletePublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html) \- Fails when account is managed by organization policies. @@ -90 +103,0 @@ For information about using Amazon S3 Block Public Access through the REST APIs, - * [DeletePublicAccessBlock](https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html) @@ -93,0 +107 @@ For information about using Amazon S3 Block Public Access through the REST APIs, +You'll see following error message for restricted operations: "This account does not allow changes to its account-level S3 Block Public Access settings due to an organizational S3 Block Public Access policy in effect."