Description

Ensure that Amazon S3 buckets have S3 Object Ownership set to Bucket owner enforced, which disables the use of Access Control Lists (ACLs) entirely for the bucket and its objects, so that access is governed solely by IAM and bucket policies.

Rationale

ACLs are a legacy access control mechanism that operate independently of, and can be difficult to reconcile with, IAM and bucket policies, making it harder to reason about and audit who actually has access to a bucket's objects; ACLs have also historically been a common source of accidental public exposure (for example, an object ACL mistakenly granting access to the AllUsers or AuthenticatedUsers group). Disabling ACLs by enforcing Bucket owner enforced ensures all access is governed by a single, more auditable and consistent policy mechanism (IAM and bucket policies).

Impact

  • Simplifies access control to a single, consistent mechanism (IAM and bucket policies)

  • Eliminates a historically common source of accidental public object exposure via misconfigured ACLs

  • Requires that any cross-account access previously granted via ACLs be re-implemented using bucket policies before ACLs are disabled

Default Value

Since April 2023, S3 Object Ownership defaults to Bucket owner enforced (ACLs disabled) for newly created buckets, but older buckets may still have ACLs enabled and should be verified.

Pre-Requisites

  • A review of any existing ACL-based grants (cross-account access, public access via ACL) that must be reimplemented via bucket policy before disabling ACLs

  • IAM permissions to update bucket ownership controls (s3:PutBucketOwnershipControls)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the bucket to review.

  3. Open the Permissions tab.

  4. Review the Object Ownership setting.

  5. Verify that it shows as ACLs disabled (Bucket owner enforced).

  6. If ACLs are enabled (Object writer or Bucket owner preferred), follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the bucket to update.

  3. Open the Permissions tab and review any existing ACL grants (bucket ACL and, if feasible, a sample of object ACLs) to identify access that must be reimplemented.

  4. Update the bucket policy to explicitly grant any cross-account or other access previously provided via ACLs.

  5. Select Edit next to Object Ownership, choose ACLs disabled (Bucket owner enforced), and save the change.

  6. Verify that applications and cross-account users can still access the bucket as expected via the updated bucket policy.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to Amazon S3 > Buckets and select the affected bucket.

  3. Open the Permissions tab, select Edit next to Object Ownership, and choose Bucket owner preferred or Object writer to re-enable ACLs, if reverting is required.

Reference