Migrate ACL-dependent uploads before enforcing S3 bucket ownership

Check upload behavior and policy coverage when removing ACL-based authorization.

Source facts

With S3 Bucket owner enforced, ACLs are disabled and policies govern access to all objects. Uploads must omit ACLs or use bucket-owner-full-control; other ACL requests fail with AccessControlListNotSupported. AWS distinguishes this from Bucket owner preferred, where qualifying new uploads transfer ownership while ACLs remain enabled.

Source: AWS Documentation.

Applicability

This concerns bucket Object Ownership transitions and applications that send ACL headers during uploads.

DSE recommendation

DSE recommends inventorying upload clients and cross-account writers before the transition. Record the ACL headers they send and replace intended ACL grants with reviewed policies. Pilot representative legacy integrations rather than assuming a successful console upload covers every application. Keep the prior ownership setting and policy evidence available for the change review. Assign an owner to each integration that still depends on ACL operations and agree how it will be updated before enabling enforcement across production buckets. For each writer, specify the policy that replaces its former ACL intent and the owner who will confirm the change. Include automated uploads and historical application clients in the acceptance sample, with a separate decision for any integration that cannot yet migrate.

Verification

Proposed verification: use disposable objects to test uploads without an ACL, with bucket-owner-full-control, and with a legacy custom ACL. Confirm expected ownership and authorization, then test an approved cross-account reader. Capture error codes and application behavior as evidence for the migration.

Official reference

AWS Documentation. Reviewed October 20, 2026.