S3 buckets should not use ACLs for user access control

S3 ACLs predate IAM and bucket policies. They grant coarse permissions (READ, WRITE, FULL_CONTROL) that cannot express conditions, require MFA, or restrict by source IP. When ACLs coexist with bucket policies, the effective permission set becomes harder to reason about, raising the chance of accidental public exposure or over-privileged access.

AWS's recommended path is disabling ACLs entirely with the BucketOwnerEnforced object ownership setting. That collapses permission audits to a single plane: IAM and resource policies.

Implementation

Choose the approach that matches how you manage Terraform.

module "s3_bucket" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "nistcsfv11.compliance.tf/terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"
}

module "s3_bucket" {
  source  = "terraform-aws-modules/s3-bucket/aws"
  version = ">=5.0.0"

  bucket = "abc123"

  object_ownership = "BucketOwnerEnforced"
}

resource "aws_s3_bucket" "this" {
  bucket        = "pofix-abc123"
  force_destroy = true
}

resource "aws_s3_bucket_ownership_controls" "this" {
  bucket = "example-bucket-abc123"
  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

What this control checks

To pass, each S3 bucket needs an aws_s3_bucket_ownership_controls resource with object_ownership set to "BucketOwnerEnforced". This setting rejects any request that includes an ACL and removes all existing grants except those held by the bucket owner.

In Terraform, declare aws_s3_bucket_ownership_controls referencing the bucket's ID and set object_ownership to "BucketOwnerEnforced" in the rule block. Omit the aws_s3_bucket_acl resource entirely. If one exists with any acl value other than "private", or with explicit access_control_policy grants to non-owner accounts or groups, the control fails.

"BucketOwnerPreferred" and "ObjectWriter" both still allow ACLs and will fail this control.

Common pitfalls

Audit evidence

Config rule s3-bucket-acl-prohibited evaluation results showing all in-scope buckets as COMPLIANT are the primary evidence artifact. Supplement with console screenshots of each bucket's Permissions tab showing "ACLs disabled" under Object Ownership, and programmatic output from aws s3api get-bucket-ownership-controls confirming BucketOwnerEnforced on every bucket in scope.

CloudTrail logs for PutBucketOwnershipControls and PutBucketAcl calls establish when the migration occurred and confirm no ACL modifications have been made since.

Related controls

• CodeBuild projects should have S3 logs encrypted

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf Control: s3_bucket_acls_should_prohibit_user_access

• AWS Config Managed Rule: S3_BUCKET_ACL_PROHIBITED

• Checkov Check: CKV2_AWS_65

• Powerpipe Control: aws_compliance.control.s3_bucket_acls_should_prohibit_user_access

• Prowler Check: s3_bucket_acl_prohibited

• AWS Security Hub Control: S3.12

Last reviewed: 2026-03-09