如何追溯修改Amazon S3存量对象的CannedACL权限为私有？

It’s a common scenario—you lock down your S3 bucket to private, but forget that existing objects still carry public-read ACLs attached. Here are the most reliable ways to fix this across all your objects:

Method 1: AWS CLI (Great for Small to Medium Buckets) #

If you have a bucket with a manageable number of objects (thousands, not millions), the CLI is quick and straightforward.

Step 1: List all object keys #

First, export all object keys in your bucket to a text file:

aws s3api list-objects-v2 --bucket YOUR_BUCKET_NAME --query 'Contents[].Key' --output text > objects.txt

Replace YOUR_BUCKET_NAME with your actual bucket name. This creates a file with each object’s key on a separate line.

Step 2: Update ACL for each object #

Run a loop to apply the private ACL to every object:

For Linux/macOS:

while read -r key; do
  aws s3api put-object-acl --bucket YOUR_BUCKET_NAME --key "$key" --acl private
done < objects.txt

For Windows (PowerShell):

Get-Content objects.txt | ForEach-Object {
  aws s3api put-object-acl --bucket YOUR_BUCKET_NAME --key $_ --acl private
}

Method 2: S3 Batch Operations (Best for Large Buckets) #

If you have millions of objects, running a local script might hit rate limits or take too long. S3 Batch Operations is built for this kind of large-scale metadata update:

1. Open the AWS S3 Console and navigate to your bucket.
2. From the left sidebar, select Batch Operations.
3. Click Create job.
4. Under Job target, choose your bucket (or upload a manifest file if you only want to update specific objects).
5. For Operation type, select Set object ACL.
6. In the ACL settings, pick the Private canned ACL option.
7. Configure the required IAM role (the role needs permissions to modify object ACLs in your bucket) and any notification settings you want.
8. Review and submit the job. AWS will handle the rest, even for huge datasets.

Important Notes #

• Versioning: If your bucket has versioning enabled, the above methods only update the latest version of each object. To update all versions, add the --version-id parameter to the CLI command (you’ll need to list all versions first), or enable "Include versions" in the S3 Batch Operations job settings.
• Verification: After updating, spot-check a few objects to confirm the ACL is private. Use this command to check an object’s ACL:

aws s3api get-object-acl --bucket YOUR_BUCKET_NAME --key YOUR_OBJECT_KEY

You should see only the bucket owner listed with full permissions, no public access entries.

• Permissions: Make sure your IAM user/role has the necessary permissions: s3:ListBucket, s3:PutObjectAcl, and (if versioning is enabled) s3:ListBucketVersions.

内容的提问来源于stack exchange，提问作者Menucha Kaniel