ACLs should not be used to manage user access to S3 general purpose buckets

How to fix it

• Can break clients: ACL grants stop applying and uploads setting any ACL but bucket-owner-full-control fail, so first move that access to the bucket policy (aclRequired in server access logs or CloudTrail finds it).

In the console

S3 → the bucket → Permissions

Access control list (ACL)

Private, reset first if it grants access outside the account; S3 refuses to disable ACLs until then

Object Ownership

ACLs disabled (recommended), which is Bucket owner enforced

With the AWS CLI

aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls 'Rules=[{ObjectOwnership=BucketOwnerEnforced}]'

With Terraform

resource "aws_s3_bucket_ownership_controls" "this" {
  bucket = var.bucket_name

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}