Check if S3 buckets have ACLs enabled
Risk
S3 ACLs are a legacy access control mechanism that predates IAM. IAM and bucket policies are currently the preferred methods.
Run this check with Prowler CLI
prowler aws --checks s3_bucket_acl_prohibited
ARN template
arn:partition:s3:::bucket_name
Recommendation
Ensure that S3 ACLs are disabled (BucketOwnerEnforced). Use IAM policies and bucket policies to manage access.
Remediation
CLI
aws s3api put-bucket-ownership-controls --bucket <bucket-name> --ownership-controls Rules=[{ObjectOwnership=BucketOwnerEnforced}]
Source Code
Resource Type
AwsS3Bucket