diff --git a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf
new file mode 100644
index 00000000..6212371b
--- /dev/null
+++ b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/files/INF.s3-default-settings.tf
@@ -0,0 +1,8 @@
+# https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_account_public_access_block
+
+resource "aws_s3_account_public_access_block" "defaults" {
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
diff --git a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml
index 5480f530..4a6ef6c8 100644
--- a/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml
+++ b/local-app/aws-account-setup/ansible/roles/inf-infrastructure/vars/main.yml
@@ -14,6 +14,7 @@ region_files:
   - INF.cloudtrail.tf
   - INF.dynamic-route53.tf
   - INF.ecs-default-settings.tf
+  - INF.s3-default-settings.tf
   - INF.preload-kms.tf
   - locals.tf
   - versions.tf