Back to Checks
aws

S3 bucket has bucket ACLs disabled

s3_bucket_acl_prohibited
Service: s3Severity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsS3Bucket

Amazon S3 buckets are evaluated for Object Ownership set to BucketOwnerEnforced, which disables bucket and object ACLs. Buckets using any other ownership setting indicate that ACLs remain enabled.

Prowler logoProwlerprowler-provider-aws

Risk

With ACLs enabled, access can bypass centralized policy controls, impacting confidentiality and integrity.

  • Unintended public or cross-account reads/writes
  • Object-writer ownership blocking bucket-owner governance
  • Per-object grants hinder auditing, enabling data exfiltration or tampering

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks s3_bucket_acl_prohibited

Recommendation

Disable ACLs by setting Object Ownership to BucketOwnerEnforced and manage access with IAM and bucket policies under least privilege. Centralize authorization, review policies regularly, and use organizational guardrails to prevent re-enabling ACLs. Migrate ACL-based grants into policies before the change.

Remediation

CLI

aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls "Rules=[{ObjectOwnership=BucketOwnerEnforced}]"

Terraform

# Disable ACLs by enforcing bucket owner for all objects
resource "aws_s3_bucket_ownership_controls" "<example_resource_name>" {
  bucket = "<example_resource_id>"
  rule {
    object_ownership = "BucketOwnerEnforced" # Critical: Disables ACLs and enforces bucket owner
  }
}

NativeIaC

# CloudFormation: Disable ACLs by enforcing bucket owner for all objects
Resources:
  <example_resource_name>OwnershipControls:
    Type: AWS::S3::BucketOwnershipControls
    Properties:
      Bucket: <example_resource_name>
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerEnforced  # Critical: Disables ACLs and makes bucket owner the object owner

Other

1In the AWS Console, go to S3 > Buckets and select the target bucket
2Open the Permissions tab
3In Object Ownership, click Edit
4Select Bucket owner enforced (ACLs disabled)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.s3.s3_client import s3_client


class s3_bucket_acl_prohibited(Check):
    def execute(self):
        findings = []
        for bucket in s3_client.buckets.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = f"S3 Bucket {bucket.name} has bucket ACLs enabled."
            if bucket.ownership:
                if "BucketOwnerEnforced" in bucket.ownership:
                    report.status = "PASS"
                    report.status_extended = (
                        f"S3 Bucket {bucket.name} has bucket ACLs disabled."
                    )
            findings.append(report)

        return findings

References