Blocking Public S3 Buckets: VS Code Copilot and ACL public-read

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

VS Code Copilot is setting up a static site host. It creates an S3 bucket with a public ACL to allow direct browser access:

aws s3api create-bucket --bucket my-assets --acl public-read

SSG blocks the call before the bucket is configured — public-read S3 buckets expose all contents to the internet.

# illustrative sample output
[BLOCK] bash › aws s3api create-bucket ... --acl public-read — rule: no-s3-public-acl

Give SSG context

SSG evaluates VS Code Copilot's AWS CLI commands via the SSG MCP Server integration.

Required context

rule no-s3-public-acl {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "s3api"
  AND command CONTAINS "public-read"
  MESSAGE "Public-read S3 ACL is blocked. Use CloudFront with OAC or signed URLs instead."
}

Optional context

Also block public-read-write:

rule no-s3-public-write {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "s3"
  AND command CONTAINS "public-read-write"
  MESSAGE "Public-read-write S3 ACL is blocked. This allows anyone on the internet to upload files."
}

What SSG does

SSG intercepts the AWS CLI call before it reaches the AWS API. The bucket is never created — no public data exposure risk is opened.

Ask the agent to use CloudFront instead

public-read ACL was blocked. Use CloudFront with Origin Access Control (OAC):
  1. Create a private S3 bucket (no ACL)
  2. Create a CloudFront distribution pointing to the bucket
  3. Set OAC as the bucket policy — only CloudFront can read
  4. Use CloudFront URLs for all public access
This gives you CDN, HTTPS, and no public bucket exposure.

Block public bucket policies too

The same exposure can occur via bucket policy rather than ACL:

rule no-s3-public-policy {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH "bucket-policy.json"
  AND content CONTAINS "\"Principal\": \"*\""
  MESSAGE "S3 bucket policy with wildcard Principal exposes bucket publicly."
}

Audit AWS operations in CI

SSG logs aws s3 and aws s3api commands on a best-effort basis with full arguments. Use ssg dashboard to verify CI pipelines aren't creating public resources.