S3 bucket has bucket ACLs disabled

Check ID: s3_bucket_acl_prohibited
Provider: AWS
Service: s3
Severity: MEDIUM
Categories: identity-access
Resource type: AwsS3Bucket

What this check verifies

Amazon S3 buckets are evaluated for Object Ownership set to BucketOwnerEnforced, which disables bucket and object ACLs. Buckets using any other ownership setting indicate that ACLs remain enabled.

Risk

With ACLs enabled, access can bypass centralized policy controls, impacting confidentiality and integrity.

Unintended public or cross-account reads/writes
Object-writer ownership blocking bucket-owner governance
Per-object grants hinder auditing, enabling data exfiltration or tampering

Recommendation

Disable ACLs by setting Object Ownership to BucketOwnerEnforced and manage access with IAM and bucket policies under least privilege. Centralize authorization, review policies regularly, and use organizational guardrails to prevent re-enabling ACLs. Migrate ACL-based grants into policies before the change.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls "Rules=[{ObjectOwnership=BucketOwnerEnforced}]"

# Disable ACLs by enforcing bucket owner for all objects
resource "aws_s3_bucket_ownership_controls" "<example_resource_name>" {
  bucket = "<example_resource_id>"
  rule {
    object_ownership = "BucketOwnerEnforced" # Critical: Disables ACLs and enforces bucket owner
  }
}

# CloudFormation: Disable ACLs by enforcing bucket owner for all objects
Resources:
  <example_resource_name>OwnershipControls:
    Type: AWS::S3::BucketOwnershipControls
    Properties:
      Bucket: <example_resource_name>
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced  # Critical: Disables ACLs and makes bucket owner the object owner

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = s3_bucket_acl_prohibited. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

S3 account-level Block Public Access is enabled S3 bucket policy does not allow cross-account access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires