# Source: https://docs.datadoghq.com/security/default_rules/def-000-0f1.md

---
title: S3 bucket policy should prevent public write access
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket policy should prevent public
  write access
---

# S3 bucket policy should prevent public write access
 
## Description{% #description %}

Update your bucket policy as your Amazon S3 bucket is writeable by anyone.

## Rationale{% #rationale %}

When misconfigured, an S3 bucket policy can grant anyone the ability to write to the contents of an S3 bucket. This gives an attacker the ability to modify objects in the bucket or create new ones.

## Remediation{% #remediation %}

Remove or modify the existing bucket policy to prevent anyone from being able to write to it.

### From the console{% #from-the-console %}

Follow the [Controlling access to a bucket with user policies](https://docs.aws.amazon.com/AmazonS3/latest/userguide/walkthrough1.html) docs to edit your existing policy and remove the access.

### From the command line{% #from-the-command-line %}

1. Run the [`delete-bucket-policy`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket-policy.html) command to fully remove any public write access to the bucket.
   ```
   aws s3api delete-bucket-policy \
     --bucket insert-bucket-name-here
   ```
1. If you need a bucket policy, create a new non-public bucket policy using the [AWS Policy Generator](http://awspolicygen.s3.amazonaws.com/policygen.html).
1. Apply the bucket policy from Step 2 with the [`put-bucket-policy`](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/put-bucket-policy.html) command.
   ```
   aws s3api put-bucket-policy
     --bucket insert-bucket-name-here
     --policy file://insert-bucket-policy-file-name-here.json
   ```