如何设置S3存储桶，使新上传对象默认拥有bucket-owner-full-control权限？

Absolutely, you can set up a private S3 bucket so every new object uploaded to it automatically gets the bucket-owner-full-control ACL permission. This is a common need for cross-account workflows or just ensuring the bucket owner retains full control over all objects, even when uploaded by other users or services.

I get why you might have missed this in the docs—it’s tucked away in a section you might not expect. Let me walk you through the steps to set this up:

Using the AWS Management Console #

• Head over to the S3 console and select your target private bucket.
• Click on the Permissions tab at the top of the bucket page.
• Scroll down to the Object ownership section and hit the Edit button.
• First, ensure ACLs enabled is selected (this is required to use ACL-based permissions here).
• Then choose the Bucket owner preferred option. This setting does two critical things:
  • Any new object uploaded to the bucket will automatically grant bucket-owner-full-control to the bucket owner—even if the uploader forgets to set this explicitly.
  • If an uploader does specify an ACL, this setting overrides conflicting rules to guarantee the bucket owner still gets full control rights.
• Save your changes, and all future uploads will inherit this permission by default.

Using the AWS CLI #

If you prefer scripting or command-line setup, run this command (replace YOUR_BUCKET_NAME with your actual bucket name):

aws s3api put-bucket-ownership-controls --bucket YOUR_BUCKET_NAME --ownership-controls Rules=[{ObjectOwnership=BucketOwnerPreferred}]

Quick heads-up: #

This configuration only applies to new objects uploaded after you set it up. Existing objects won’t inherit this ACL automatically. If you need to fix permissions for existing objects, you can run a recursive copy operation (it overwrites the ACL without reuploading the actual data):

aws s3 cp s3://YOUR_BUCKET_NAME/ s3://YOUR_BUCKET_NAME/ --recursive --acl bucket-owner-full-control

For larger datasets, S3 Batch Operations is a more efficient option.

内容的提问来源于stack exchange，提问作者SomeGuyOnAComputer