title: “S3 Access Control Lists (ACLs)” created: 2026-07-20 updated: 2026-07-20 type: knowledge tags:

aws
s3
security
acl
certification

S3 Access Control Lists (ACLs)

What It Is

ACLs are a legacy access control mechanism for S3 that grant basic read/write permissions at the object or bucket level to specific AWS accounts or predefined groups.

Why It Matters

While AWS recommends bucket policies over ACLs for most use cases, ACLs still appear on the exam and in legacy architectures. Understanding when they apply (and when they don’t) is important.

Key Concepts

Object Ownership & ACLs

Since April 2023, new buckets default to ACLs disabled (Bucket owner enforced). ACLs only work when explicitly enabled:

Ownership Setting	ACL Behavior
Bucket owner enforced (default)	ACLs disabled — all access via policies only
Bucket owner preferred	ACLs enabled; bucket owner owns objects with `bucket-owner-full-control`
Object writer	ACLs enabled; uploading account retains ownership

Predefined Groups (Grantees)

All Users (http://acs.amazonaws.com/groups/global/AllUsers) — public/anonymous access
Authenticated Users — any authenticated AWS account (rarely useful)
Log Delivery — for S3 access logging

Permissions Available via ACL

READ — list objects (bucket) or read object data (object)
WRITE — create/delete objects in bucket
READ_ACP — read the ACL itself
WRITE_ACP — modify the ACL
FULL_CONTROL — all of the above

“Make Public Using ACL” in Console

This sets the object ACL to grant READ to the All Users group. It only works when:

ACLs are enabled on the bucket (Object Ownership setting)
Block Public Access is disabled (or IgnorePublicAcls is off)

Gotchas

ACLs only grant access at a coarse level — you cannot restrict by IP, time, or condition
Bucket policies are more powerful and flexible; AWS recommends them over ACLs
BPA settings override ACLs entirely when enabled
“Make public” via ACL grants access to ONE object — not the entire bucket

AWS Certification Notes