---
title: S3 bucket ACLs should only grant access to the bucket owner
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > S3 bucket ACLs should only grant access
  to the bucket owner
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# S3 bucket ACLs should only grant access to the bucket owner
 
## Description{% #description %}

Disable access control lists (ACLs) on your Amazon S3 buckets and manage access with bucket policies and IAM policies instead. ACLs are a legacy access control mechanism that predates IAM. This rule passes when Object Ownership is set to bucket owner enforced, which disables ACLs, or when the bucket ACL only grants access to the bucket owner.

## Remediation{% #remediation %}

Follow the [Controlling ownership of objects and disabling ACLs for your bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html) section of the Amazon S3 User Guide to set Object Ownership to bucket owner enforced. Before disabling ACLs, move any access granted through ACLs, such as server access log delivery, to a bucket policy.