Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

An AWS IAM Principal defines access to a resource for a user, service, or other entity. In an IAM Statement, there is a definition of an IAM Principal that allows everyone to access an S3 action.

Public access of an S3 bucket due to misconfigurations is a leading cause of data breaches.
Although S3 buckets block public access by default, any authorized user can update bucket policies or access control lists (ACLs) to allow public access. Forbid this type of update by enabling the setting of BlockPublicPolicy and BlockPublicAcls respectively under an S3 property of PublicAccessBlockConfiguration.
To also guard against any pre-existing overly-permissive bucket policies and ACLs respectively, enable the settings of RestrictPublicBuckets and IgnorePublicAcls.

Uncontrolled access to critical or sensitive resources can significantly impact an organization in various ways, including disclosure of or tampering with critical data.

Loose access configurations can expose systems and broaden an organization's attack surface. Services open to interaction with the public are typically subjected to near-continuous scanning and probing by malicious entities.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published, such as Heartbleed. Attackers can actively pursue and search for unpatched and exposed systems to exploit.

Loose access configurations can expose systems and broaden an organization's attack surface. Services open to interaction with the public are typically subjected to near-continuous scanning and probing by malicious entities.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published, such as Heartbleed. Attackers can actively pursue and search for unpatched and exposed systems to exploit.

Loose access configurations can expose systems and broaden an organization's attack surface. Services open to interaction with the public are typically subjected to near-continuous scanning and probing by malicious entities.

This is especially problematic when a zero-day exploit for an exposed service is discovered and published, such as Heartbleed. Attackers can actively pursue and search for unpatched and exposed systems to exploit.