Use Amazon GuardDuty to monitor S3 bucket policies. Create an automatic remediation action rule that uses an AWS Lambda function to remediate any change that makes the objects public.

Use AWS Trusted Advisor to find publicly accessible S3 buckets. Configure email notifications in Trusted Advisor when a change to S3 bucket policies is detected. Use the AWS CLI to change any S3 bucket policy that Trusted Advisor flags.

Use AWS Resource Access Manager AWS RAM to find publicly accessible S3 buckets. Use Amazon SNS to invoke an AWS Lambda function when AWS RAM detects a change in S3 bucket policies. Configure the Lambda function to programmatically remediate each detected change.

Use the S3 Block Public Access feature at the account level. Deploy the AWS Config s3-account-level-public-access-blocks rule and an AWS Systems Manager document to take automatic remediation actions when the rule is in the non-compliant state.