PutObject with ACL public-read fails with AccessControlListNotSupported on a new S3 bucket

Symptom

AccessControlListNotSupported: The bucket does not allow ACLs400 on uploads that pass ACL: 'public-read' or --acl public-readSame upload code works against an older bucket

Cause

New buckets default to the Bucket owner enforced ownership setting, which disables ACLs. Any request that sets an ACL other than bucket-owner-full-control is rejected.

Fix

Drop the ACL parameter and grant read access with a bucket policy or CloudFront instead. Only switch Object Ownership back to an ACL mode if you truly need per-object ACLs.

ApplyCopy

await s3.send(new PutObjectCommand({ Bucket, Key, Body, ContentType })); // no ACL # public read through a bucket policy (Block Public Access must allow it) aws s3api put-bucket-policy --bucket my-bucket --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}'

Affected

S3 buckets created with default settings since the rollout that began 2023-04-05, which made Bucket owner enforced the default

Sources

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html
• https://aws.amazon.com/about-aws/whats-new/2023/04/amazon-s3-two-security-best-practices-buckets-default/

Last verified 2026-10-15 · Confirmed by 0 builders