All checks
Medium
ACLs should not be used to manage user access to S3 general purpose buckets
Checks that the S3 general purpose bucket has ACLs disabled, with Object Ownership set to Bucket owner enforced. An ACL grants access outside the bucket policy; with ACLs disabled the bucket owner owns every object and the policy alone decides who can reach the data.
- service
- S3
- severity
- Medium
- scope
- evaluated once per account
How to fix it
In the console
S3 → the bucket → Permissions
With the AWS CLI
aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls 'Rules=[{ObjectOwnership=BucketOwnerEnforced}]'With Terraform
resource "aws_s3_bucket_ownership_controls" "this" {
bucket = var.bucket_name
rule {
object_ownership = "BucketOwnerEnforced"
}
}See which of your accounts this check is failing on.
Book a demo