PutObject with ACL public-read fails with AccessControlListNotSupported on a new S3 bucket

AccessControlListNotSupported: The bucket does not allow ACLs

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

New buckets default to the Bucket owner enforced ownership setting, which disables ACLs. Any request that sets an ACL other than bucket-owner-full-control is rejected.

Fix

Drop the ACL parameter and grant read access with a bucket policy or CloudFront instead. Only switch Object Ownership back to an ACL mode if you truly need per-object ACLs.

Apply

await s3.send(new PutObjectCommand({ Bucket, Key, Body, ContentType }));  // no ACL

# public read through a bucket policy (Block Public Access must allow it)
aws s3api put-bucket-policy --bucket my-bucket --policy '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}'

Affects: S3 buckets created with default settings since the rollout that began 2023-04-05, which made Bucket owner enforced the default

Sources

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp