S3 serverlessdeploymentbucket default setting best practices

[aran112000]

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Use case description

We recently spotted that the S3 deployment buckets created by Serverless Framework that holds the deployed code & CloudFormation templates are failing some of the AWS Security Hub S3 checks. Namely, public access isn't explicitly enabled, although this is achieved via the policy template anyway.

Has this intentionally been left out of the default S3 template? If not, happy to submit a PR to resolve this.

AWS recommendation:
https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-s3-1

Relevant template
https://github.com/serverless/serverless/blob/bf79934e9b43a0b2e8613ee29f9430fa22c41481/lib/plugins/aws/package/lib/core-cloudformation-template.json