diff --git a/cdk/po_stack.py b/cdk/po_stack.py
index 3e2036e..ee30ecc 100644
--- a/cdk/po_stack.py
+++ b/cdk/po_stack.py
@@ -97,6 +97,7 @@ class PoIngestStack(Stack):
             self,
             "EmailBucket",
             bucket_name=f"po-ingest-emails-{self.account}",
+            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
             removal_policy=RemovalPolicy.RETAIN,
             lifecycle_rules=[
                 s3.LifecycleRule(expiration=Duration.days(90)),
diff --git a/cdk/wo_stack.py b/cdk/wo_stack.py
index 8aa766d..637c0c2 100644
--- a/cdk/wo_stack.py
+++ b/cdk/wo_stack.py
@@ -96,6 +96,7 @@ class WorkorderIngestStack(Stack):
             self,
             "EmailBucket",
             bucket_name=f"workorder-ingest-emails-{self.account}",
+            block_public_access=s3.BlockPublicAccess.BLOCK_ALL,
             removal_policy=RemovalPolicy.RETAIN,
             lifecycle_rules=[
                 s3.LifecycleRule(expiration=Duration.days(90)),