Blocking Public S3 Buckets: Aider and ACL public-read

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

You ask Aider to set up a public static assets bucket. The agent creates an S3 bucket and sets its ACL to public-read in a single command:

aws s3api create-bucket --bucket my-assets --acl public-read

Public S3 buckets expose every object inside them to the entire internet. Misconfigured public buckets are behind some of the largest data breaches of the past decade. Even if your intent is to host public assets, the ACL approach is deprecated in favor of CloudFront distributions with explicit policies. SSG blocks this immediately.

# illustrative sample output
[BLOCK] bash › aws s3api create-bucket ... --acl public-read — rule: no-public-s3

Give SSG context

SSG evaluates Aider's shell commands via the SSG MCP Server integration for Aider sessions.

Required context

rule no-public-s3 {
  enabled true
  priority 95
  severity error
  DENY execution
  IF command CONTAINS "s3api"
  AND command CONTAINS "public-read"
  MESSAGE "Public S3 ACL is blocked. Use a CloudFront distribution with explicit bucket policies instead."
}

Optional context

Also intercept bucket policy writes that grant public access:

rule no-public-s3-policy {
  enabled true
  priority 90
  severity error
  DENY execution
  IF command CONTAINS "put-bucket-policy"
  AND command CONTAINS "AllUsers"
  MESSAGE "Bucket policy granting AllUsers access is blocked."
}

What SSG does

SSG intercepts the aws s3api call before any network request reaches the AWS API. No bucket is created or modified.

Ask the agent to use the right architecture

public-read ACL was blocked. For public static assets, use this pattern instead:
1. Create a private S3 bucket (no ACL)  
2. Create a CloudFront distribution pointing to the bucket
3. Use an Origin Access Control (OAC) policy to grant CloudFront access
4. Serve assets via the CloudFront URL

This gives you HTTPS, CDN caching, and granular access control.

Block Terraform configurations too

rule no-public-s3-terraform {
  enabled true
  priority 90
  severity error
  DENY write
  IF path ENDS_WITH ".tf"
  AND content CONTAINS "aws_s3_bucket_acl"
  AND content CONTAINS "public-read"
  MESSAGE "public-read ACL in Terraform S3 config is blocked."
}

Audit all S3 configuration commands

SSG logs s3api calls on a best-effort basis. Review the audit log to confirm no public buckets were created across all agent sessions.

How your rule handles S3 sync and cp commands

This rule targets bucket creation and ACL commands. For s3 sync or s3 cp commands that include --acl public-read, add a parallel rule targeting those subcommands.

Check the rule against your CDN pipeline

Some legacy pipelines sync static files to S3 with --acl public-read as part of a CloudFront-backed deliver setup. In those cases, switch to ASK mode so you can review the specific bucket before approving.