# Ensure S3 bucket has bucket ACLs disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292246874456-ensure-s3-bucket-has-bucket-acls-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every Amazon S3 bucket has its Object Ownership setting set to **Bucket owner enforced**. With this setting, access control lists (ACLs) on the bucket and its objects are disabled, the bucket owner automatically owns every object in the bucket, and access is controlled only through IAM and bucket policies.

**Rationale**

When ACLs are enabled, access can be granted outside of the central bucket and IAM policies, which can lead to unintended public or cross-account reads and writes. Objects uploaded by other accounts may also remain owned by the uploader, which blocks the bucket owner from managing them, and per-object grants make access hard to audit. Disabling ACLs and managing access with IAM and bucket policies under least privilege centralizes authorization. Any access granted through ACLs should be moved into policies before the change.

**Impact**

-   Centralizes access control in IAM and bucket policies and makes access easier to audit
    
-   The bucket owner becomes the owner of all objects, including objects uploaded by other accounts
    
-   Requests that set ACLs other than bucket-owner full control (for example, public-read) will fail, so applications that rely on ACLs must be updated first
    

**Default Value**

Since April 2023, new S3 buckets are created with Object Ownership set to **Bucket owner enforced**, so ACLs are disabled by default. Older buckets may still have ACLs enabled.

**Pre-Requisites**

-   IAM permissions: s3:ListAllMyBuckets, s3:GetBucketOwnershipControls, s3:PutBucketOwnershipControls and s3:GetBucketAcl
    
-   A review of the bucket ACL and object ACLs, with any required access moved into the bucket policy. The change is rejected if the bucket ACL grants access to anyone other than the bucket owner
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select a bucket.
    
3.  Open the **Permissions** tab and find the **Object Ownership** section.
    
4.  Check that the setting is **Bucket owner enforced** (ACLs disabled).
    
5.  Repeat for each bucket.
    
6.  If any bucket shows **Bucket owner preferred** or **Object writer**, follow the implementation steps.
    

**CLI:**

Show the Object Ownership setting of a bucket:

aws s3api get-bucket-ownership-controls --bucket <BUCKET\_NAME>

A bucket fails if ObjectOwnership is not BucketOwnerEnforced, or if the command returns an OwnershipControlsNotFoundError error.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select the bucket.
    
3.  Open the **Permissions** tab and, in **Object Ownership**, choose **Edit**.
    
4.  Select **ACLs disabled (recommended)**, which sets **Bucket owner enforced**.
    
5.  Choose **Save changes**.
    
6.  Repeat for each affected bucket.
    

**CLI:**

Disable ACLs on a bucket:

aws s3api put-bucket-ownership-controls --bucket <BUCKET\_NAME> --ownership-controls "Rules=\[{ObjectOwnership=BucketOwnerEnforced}\]"

**Backout Plan**

Before making changes, save the current settings:

aws s3api get-bucket-ownership-controls --bucket <BUCKET\_NAME> > ownership-controls-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon S3 console and select the bucket.
    
3.  Open the **Permissions** tab and, in **Object Ownership**, choose **Edit**.
    
4.  Select **ACLs enabled** and choose the previous setting (**Bucket owner preferred** or **Object writer**).
    
5.  Choose **Save changes**.
    

**CLI:**

aws s3api put-bucket-ownership-controls --bucket <BUCKET\_NAME> --ownership-controls "Rules=\[{ObjectOwnership=ObjectWriter}\]"

Note: rolling back re-enables ACLs, so access may again be granted outside the bucket policy. Object ownership that changed to the bucket owner is not reverted.

**Reference**

-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html)
    
-   [https://docs.aws.amazon.com/AmazonS3/latest/userguide/ensure-object-ownership.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ensure-object-ownership.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-ownership-controls.html](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-ownership-controls.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.