Description

Ensure that every Amazon S3 bucket has its Object Ownership setting set to Bucket owner enforced. With this setting, access control lists (ACLs) on the bucket and its objects are disabled, the bucket owner automatically owns every object in the bucket, and access is controlled only through IAM and bucket policies.

Rationale

When ACLs are enabled, access can be granted outside of the central bucket and IAM policies, which can lead to unintended public or cross-account reads and writes. Objects uploaded by other accounts may also remain owned by the uploader, which blocks the bucket owner from managing them, and per-object grants make access hard to audit. Disabling ACLs and managing access with IAM and bucket policies under least privilege centralizes authorization. Any access granted through ACLs should be moved into policies before the change.

Impact

  • Centralizes access control in IAM and bucket policies and makes access easier to audit

  • The bucket owner becomes the owner of all objects, including objects uploaded by other accounts

  • Requests that set ACLs other than bucket-owner full control (for example, public-read) will fail, so applications that rely on ACLs must be updated first

Default Value

Since April 2023, new S3 buckets are created with Object Ownership set to Bucket owner enforced, so ACLs are disabled by default. Older buckets may still have ACLs enabled.

Pre-Requisites

  • IAM permissions: s3:ListAllMyBuckets, s3:GetBucketOwnershipControls, s3:PutBucketOwnershipControls and s3:GetBucketAcl

  • A review of the bucket ACL and object ACLs, with any required access moved into the bucket policy. The change is rejected if the bucket ACL grants access to anyone other than the bucket owner

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select a bucket.

  3. Open the Permissions tab and find the Object Ownership section.

  4. Check that the setting is Bucket owner enforced (ACLs disabled).

  5. Repeat for each bucket.

  6. If any bucket shows Bucket owner preferred or Object writer, follow the implementation steps.

CLI:

Show the Object Ownership setting of a bucket:

aws s3api get-bucket-ownership-controls --bucket <BUCKET_NAME>

A bucket fails if ObjectOwnership is not BucketOwnerEnforced, or if the command returns an OwnershipControlsNotFoundError error.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket.

  3. Open the Permissions tab and, in Object Ownership, choose Edit.

  4. Select ACLs disabled (recommended), which sets Bucket owner enforced.

  5. Choose Save changes.

  6. Repeat for each affected bucket.

CLI:

Disable ACLs on a bucket:

aws s3api put-bucket-ownership-controls --bucket <BUCKET_NAME> --ownership-controls "Rules=[{ObjectOwnership=BucketOwnerEnforced}]"

Backout Plan

Before making changes, save the current settings:

aws s3api get-bucket-ownership-controls --bucket <BUCKET_NAME> > ownership-controls-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon S3 console and select the bucket.

  3. Open the Permissions tab and, in Object Ownership, choose Edit.

  4. Select ACLs enabled and choose the previous setting (Bucket owner preferred or Object writer).

  5. Choose Save changes.

CLI:

aws s3api put-bucket-ownership-controls --bucket <BUCKET_NAME> --ownership-controls "Rules=[{ObjectOwnership=ObjectWriter}]"

Note: rolling back re-enables ACLs, so access may again be granted outside the bucket policy. Object ownership that changed to the bucket owner is not reverted.

Reference