aws_s3_bucket_public_access_block cost estimation

An aws_s3_bucket_public_access_block sets four flags that prevent a bucket and its objects from being made public through ACLs or bucket policies. It is free: AWS does not charge for the setting or for enforcing it. Its entire purpose is safety, and it has no meter of its own.

The cost relevance is indirect and mostly protective. A bucket that accidentally goes public can serve a flood of internet GET requests and egress, both billed, and that is one of the classic ways an S3 bill spikes. By blocking public access, this resource removes an entire category of unplanned request and transfer cost, along with the far larger cost of a data exposure. It does not reduce the cost of legitimate traffic; it just stops the accidental kind.

There is nothing to optimize on the block itself beyond turning it on. The standard practice is to enable all four flags at the account level and per bucket unless a bucket genuinely needs to serve public content, in which case a CloudFront distribution in front of it is usually cheaper and safer than raw public S3 reads. c3x prices the bucket, its storage, requests, and egress, and treats the public access block as the free guardrail it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_s3_bucket_public_access_block" "assets" {
  bucket = aws_s3_bucket.assets.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Pricing dimensions

What you actually pay for when you provision aws_s3_bucket_public_access_block.

Dimension	Unit	What's being charged
Public access block	free	Setting and enforcing the four public-access flags has no charge. $0
Requests it prevents	per 1,000 requests (avoided)	Unplanned public GET traffic that the block stops would otherwise be billed on the bucket. GET: $0.0004/1,000
Egress it prevents	per GB (avoided)	Internet data transfer from an accidentally public bucket that the block stops. First 10 TB: ~$0.09/GB

Optimization tips

Common ways to reduce aws_s3_bucket_public_access_block cost without changing the workload.

Enable all four flags by default

Prevents runaway public-egress bills

Blocking public ACLs and policies removes an entire class of accidental internet request and egress cost, plus the much larger cost of a data exposure. Turn it on everywhere unless a bucket must be public.

Serve public content through CloudFront

Lower egress rate plus cache offload

If a bucket must serve the public, put CloudFront in front and keep the bucket private. CDN egress is cheaper than raw S3 egress and adds caching that cuts origin requests.

Set the block at the account level too

Applying the account-level public access block catches buckets created without their own block, closing gaps that could otherwise leak into billable public traffic.

FAQ

Does an S3 public access block cost money?

No. Setting and enforcing the public access block is free. It has no meter. Its value is preventing accidental public traffic and the request and egress charges that come with it.

How does blocking public access save money?

A bucket that goes public can serve unplanned internet GET requests and egress, both billed. The block stops that entire category of surprise cost, and prevents the far larger cost of a data exposure.

Should I ever leave public access unblocked?

Rarely. If a bucket must serve public content, front it with CloudFront and keep the bucket itself private. That is cheaper on egress and safer than allowing raw public reads.