# Ensure S3 buckets have ACLs enabled

- Source: https://support.icompaas.com/support/solutions/articles/62000229576-ensure-s3-buckets-have-acls-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**  
This policy ensures that all S3 buckets have Access Control Lists (ACLs) enabled. This helps to control who has access to the objects in your S3 buckets.

**Rationale:**  
ACLs allow you to specify who has read, write, and/or delete permissions to the objects in your S3 buckets. This can help to protect your data from unauthorized access.

**Impact:**  
If you do not enable ACLs on your S3 buckets, anyone who has the bucket's URL will be able to access the objects in the bucket. This could lead to data breaches or unauthorized access to your sensitive data.

**Default Value:**  
By default, S3 buckets are created with ACLs disabled. You must explicitly enable ACLs for each bucket.

**Pre-requisites:**

-   You must have an AWS account and be an IAM user with the appropriate permissions to enable ACLs on S3 buckets.

  

**Remediation Steps:**

1.  Enable ACLs for each S3 bucket.
2.  Verify that the ACLs are enabled by checking the S3 console or the AWS CLI.

  

**Test Plan:**

1.  Identify a subset of S3 buckets that do not have ACLs enabled.
2.  Enable ACLs for the selected S3 buckets.
3.  Verify that the ACLs are enabled by checking the S3 console or the AWS CLI.

**Implementation Plan:**

**AWS CLI:**

`aws s3api put-bucket-acl --bucket <bucket-name> --acl <acl-string>   `

  
  
**AWS GUI:**

1.  Go to the S3 console.
2.  Click the name of the bucket that you want to enable ACLs for.
3.  Click **Permissions**.
4.  Select the **Bucket ACL** tab.
5.  Click **Edit**.
6.  In the **ACL** section, select the **Enable** checkbox.
7.  Click **Save**.  
      
    

**Backout Plan:**

1.  Disable ACLs for each S3 bucket.
2.  Verify that the ACLs are disabled by checking the S3 console or the AWS CLI.  
      
    

**Note:**

-   This policy applies to all regions and accounts.
-   You can use the AWS CLI or the AWS SDKs to automate the process of enabling and disabling ACLs on S3 buckets.

**Reference:**  
[https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.