If your general purpose bucket uses the Bucket owner enforced setting for S3 Object Ownership, you must use policies to grant access to your general purpose bucket and the objects in it. With the Bucket owner enforced setting enabled, requests to set access control lists (ACLs) or update ACLs fail and return theAccessControlListNotSupported error code. Requests to read ACLs are still supported.

We highly recommend that you avoid granting write access to theEveryone (public access) orAuthenticated Usersgroup (all AWS authenticated users) groups. For more information aboutthe effects of granting write access to these groups, seeAmazon S3 predefinedgroups.

To set ACL permissions for a bucket

1. Sign in to the AWS Management Console and open the Amazon S3 console athttps://console.aws.amazon.com/s3/.

2. In the left navigation pane, chooseGeneral purpose buckets.

3. In theBuckets list, choose the name of the bucketthat you want to set permissions for.

4. ChoosePermissions.

5. UnderAccess control list, chooseEdit.

   You can edit the following ACL permissions for the bucket:

   Objects

   • List – Allows a grantee to list theobjects in the bucket.

   • Write – Allows grantee to create newobjects in the bucket. For the bucket and object owners of existingobjects, also allows deletions and overwrites of those objects.

     In the S3 console, you can only grant write access to the S3 logdelivery group and the bucket owner (your AWS account). We highlyrecommend that you do not grant write access for other grantees.However, if you need to grant write access, you can use the AWS CLI,AWS SDKs, or the REST API.

   Bucket ACL

   • Read – Allows grantee to read thebucket ACL.

   • Write – Allows grantee to write theACL for the applicable bucket.

6. To change the bucket owner's permissions, besideBucket owner(your AWS account), clear or select from the following ACLpermissions:

   • Objects –List orWrite

   • Bucket ACL –ReadorWrite

   Theowner refers to the AWS account root user, not an AWS Identity and Access ManagementIAM user. For more information about the root user, seeThe AWS account root user in theIAM User Guide.

7. To grant or undo permissions for the general public (everyone on theinternet), besideEveryone (public access), clear orselect from the following ACL permissions:

   • Objects –List

   • Bucket ACL –Read

   Warning

   Use caution when granting theEveryone grouppublic access to your S3 bucket. When you grant access to this group,anyone in the world can access your bucket. We highly recommend that younever grant any kind of public write access to your S3 bucket.

8. To grant or undo permissions for anyone with an AWS account, besideAuthenticated Users group (anyone with anAWS account), clear or select from the following ACLpermissions:

   • Objects –List

   • Bucket ACL –Read

9. To grant or undo permissions for Amazon S3 to write server access logs to thebucket, underS3 log delivery group, clear or selectfrom the following ACL permissions:

   • Objects –List orWrite

   • Bucket ACL –ReadorWrite

     If a bucket is set up as the target bucket to receive access logs,the bucket permissions must allow theLogDelivery group write access to the bucket. When youenable server access logging on a bucket, the Amazon S3 console grantswrite access to theLog Delivery group for thetarget bucket that you choose to receive the logs. For moreinformation about server access logging, seeEnabling Amazon S3 server access logging.

10. To grant access to another AWS account, do the following:

    1. ChooseAdd grantee.

    2. In theGrantee box, enter the canonical ID ofthe other AWS account.

    3. Select from the following ACL permissions:

       • Objects –List orWrite

       • Bucket ACL –Read orWrite

    Warning

    When you grant other AWS accounts access to your resources, be awarethat the AWS accounts can delegate their permissions to users undertheir accounts. This is known ascross-accountaccess. For information about using cross-account access,see Creating aRole to Delegate Permissions to an IAM User in theIAM User Guide.

11. To remove access to another AWS account, underAccess forother AWS accounts, chooseRemove.

12. To save your changes, chooseSave changes.

To set ACL permissions for an object

1. Sign in to the AWS Management Console and open the Amazon S3 console athttps://console.aws.amazon.com/s3/.

2. In theBuckets list, choose the name of the bucketthat contains the object.

3. In theobjects list, choose the name of the objectfor which you want to set permissions.

4. ChoosePermissions.

5. Under Access control list (ACL), chooseEdit.

   You can edit the following ACL permissions for the object:

   Object

   • Read – Allows grantee to read theobject data and its metadata.

   Object ACL

   • Read – Allows grantee to read theobject ACL.

   • Write – Allows grantee to write theACL for the applicable object. In the S3 console, you can only grantwrite access to the bucket owner (your AWS account). We highlyrecommend that you do not grant write access for other grantees.However, if you need to grant write access, you can use the AWS CLI,AWS SDKs, or the REST API.

6. You can manage object access permissions for the following:

   1. Access for object owner

      Theowner refers to the AWS account root user, and notan AWS Identity and Access Management IAM user. For more information about the root user, seeTheAWS account root user in theIAM User Guide.

      To change the owner's object access permissions, underAccess for object owner, chooseYour AWS Account (owner).

      Select the check boxes for the permissions that you want tochange, and then chooseSave.

   2. Access for other AWS accounts

      To grant permissions to an AWS user from a differentAWS account, underAccess for otherAWS accounts, chooseAddaccount. In theEnter an IDfield, enter the canonical ID of the AWS user that you want togrant object permissions to. For information about finding acanonical ID, seeYour AWS account identifiers in theAmazon Web Services General Reference. You can add as many as 99users.

      Select the check boxes for the permissions that you want to grantto the user, and then chooseSave. To displayinformation about the permissions, choose the Help icons.

   3. Public access

      To grant access to your object to the general public (everyone inthe world), underPublic access, chooseEveryone. Granting public accesspermissions means that anyone in the world can access theobject.

      Select the check boxes for the permissions that you want to grant,and then chooseSave.

      Warning

      • Use caution when granting theEveryone group anonymous accessto your Amazon S3 objects. When you grant access to thisgroup, anyone in the world can access your object. Ifyou need to grant access to everyone, we highlyrecommend that you only grant permissions toRead objects.

      • We highly recommend that youdonot grant theEveryone group write objectpermissions. Doing so allows anyone to overwrite the ACLpermissions for the object.

• GetBucketAcl

• PutBucketAcl

• GetObjectAcl

• PutObjectAcl

• PutObject

• CreateBucket

• CopyObject

• CreateMultipartUpload

• Canned ACL (x-amz-acl) —Amazon S3 supports a set of predefined ACLs, known as canned ACLs. Eachcanned ACL has a predefined set of grantees and permissions. For moreinformation, seeCanned ACL.

• Access Permissions — To explicitlygrant access permissions to specific AWS accounts or groups, use thefollowing headers. Each header maps to specific permissions that AmazonS3 supports in an ACL. For more information, seeAccess control list (ACL) overview. In theheader, you specify a list of grantees who get the specific permission.

  • x-amz-grant-read

  • x-amz-grant-write

  • x-amz-grant-read-acp

  • x-amz-grant-write-acp

  • x-amz-grant-full-control