Find S3 Buckets That Still Use ACLs and Disable Them

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBuckets",
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    },
    {
      "Sid": "ReadOwnershipAndAcl",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketOwnershipControls",
        "s3:GetBucketAcl"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Sid": "DisableAclsWithApply",
      "Effect": "Allow",
      "Action": "s3:PutBucketOwnershipControls",
      "Resource": "arn:aws:s3:::*"
    }
  ]
}

// find-s3-buckets-with-acls-enabled.ts
// Reports each S3 general purpose bucket's Object Ownership setting (BucketOwnerEnforced, BucketOwnerPreferred,
// ObjectWriter, or none set) and the bucket ACL grants that go to anyone other than the bucket owner, including
// the S3 log delivery group and CloudFront's legacy log delivery account. Report-only by default.
// --apply sets BucketOwnerEnforced (ACLs disabled) on buckets whose bucket ACL grants only the owner.
// Usage: npx tsx find-s3-buckets-with-acls-enabled.ts [--buckets=a,b] [--apply]
import {
  S3Client,
  GetBucketAclCommand,
  GetBucketOwnershipControlsCommand,
  PutBucketOwnershipControlsCommand,
  paginateListBuckets,
  type Grant,
} from "@aws-sdk/client-s3";

const args = process.argv.slice(2);
const apply = args.includes("--apply");
const onlyBuckets = args.find((a) => a.startsWith("--buckets="))?.split("=")[1]?.split(",").map((s) => s.trim()).filter(Boolean);

// Canonical user ID of the awslogsdelivery account that writes CloudFront standard logs (legacy).
const CLOUDFRONT_LOGS = "c4c1ede66af53448b93c283ce9448c4ba468c9432aa01d700d3878632f77d2d0";
const GROUPS: Record<string, string> = {
  "http://acs.amazonaws.com/groups/global/AllUsers": "AllUsers (public)",
  "http://acs.amazonaws.com/groups/global/AuthenticatedUsers": "AuthenticatedUsers (any AWS account)",
  "http://acs.amazonaws.com/groups/s3/LogDelivery": "S3 LogDelivery group",
};

interface Row { Bucket: string; Region: string; Ownership: string; ExtraGrants: string; Verdict: string }

const errName = (err: unknown): string => (err instanceof Error ? err.name : String(err));

function describeGrant(g: Grant): string {
  const who = g.Grantee;
  let name = "unknown grantee";
  if (who?.Type === "Group") name = GROUPS[who.URI ?? ""] ?? who.URI ?? "group";
  else if (who?.ID === CLOUDFRONT_LOGS) name = "CloudFront log delivery";
  else if (who?.Type === "CanonicalUser") name = `account ${(who.ID ?? "").slice(0, 8)}…`;
  else if (who?.Type === "AmazonCustomerByEmail") name = "account by email";
  return `${name}:${g.Permission ?? "?"}`;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  const home = new S3Client({ region: "us-east-1" });

  for await (const page of paginateListBuckets({ client: home }, {})) {
    for (const b of page.Buckets ?? []) {
      const bucket = b.Name ?? "";
      if (!bucket || (onlyBuckets && !onlyBuckets.includes(bucket))) continue;
      const region = b.BucketRegion ?? "us-east-1";
      const s3 = new S3Client({ region });

      let ownership: string;
      try {
        const out = await s3.send(new GetBucketOwnershipControlsCommand({ Bucket: bucket }));
        ownership = out.OwnershipControls?.Rules?.[0]?.ObjectOwnership ?? "?";
      } catch (err) {
        // No setting at all: an older bucket (or one whose setting was deleted). ACLs are enabled.
        ownership = errName(err) === "OwnershipControlsNotFoundError" ? "none (ACLs on)" : `error: ${errName(err)}`;
      }

      let extra: string[] = [];
      try {
        const acl = await s3.send(new GetBucketAclCommand({ Bucket: bucket }));
        const ownerId = acl.Owner?.ID;
        extra = (acl.Grants ?? []).filter((g) => g.Grantee?.ID !== ownerId).map(describeGrant);
      } catch (err) {
        extra = [`error: ${errName(err)}`];
      }

      let verdict: string;
      if (ownership === "BucketOwnerEnforced") verdict = "ok: ACLs disabled";
      else if (ownership.startsWith("error")) verdict = "check permissions";
      else if (extra.length) verdict = "MIGRATE: move ACL grants to a bucket policy first";
      else verdict = "READY: ACLs on, bucket ACL grants only the owner";
      rows.push({ Bucket: bucket, Region: region, Ownership: ownership, ExtraGrants: extra.join("; ") || "-", Verdict: verdict });
    }
  }

  console.table(rows);
  const ready = rows.filter((r) => r.Verdict.startsWith("READY"));
  const migrate = rows.filter((r) => r.Verdict.startsWith("MIGRATE"));
  console.log(`${rows.length} bucket(s) checked; ${ready.length} ready to disable ACLs, ${migrate.length} need their ACL grants migrated first.`);
  if (!apply) {
    console.log("Report only: nothing changed. --apply would set BucketOwnerEnforced on the READY buckets.");
    if (ready.length || migrate.length) process.exitCode = 2;
    return;
  }

  // Only READY buckets: S3 rejects BucketOwnerEnforced while the bucket ACL grants anyone but the owner
  // (InvalidBucketAclWithObjectOwnership), and those grants usually mean something depends on them.
  for (const r of ready) {
    try {
      await new S3Client({ region: r.Region }).send(
        new PutBucketOwnershipControlsCommand({
          Bucket: r.Bucket,
          OwnershipControls: { Rules: [{ ObjectOwnership: "BucketOwnerEnforced" }] },
        }),
      );
      console.log(`${r.Bucket}: BucketOwnerEnforced set (was ${r.Ownership})`);
    } catch (err) {
      console.log(`${r.Bucket}: failed (${err instanceof Error ? err.message : String(err)})`);
    }
  }
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-s3
npm install --save-dev tsx typescript

# Report every bucket
AWS_PROFILE=security-audit npx tsx find-s3-buckets-with-acls-enabled.ts

# Disable ACLs on two READY buckets
AWS_PROFILE=storage-admin npx tsx find-s3-buckets-with-acls-enabled.ts --buckets=acme-terraform-state,acme-partner-drop --apply

┌─────────┬────────────────────────┬─────────────┬────────────────────────┬─────────────────────────────────────────────────────────────┬─────────────────────────────────────────────────────┐
│ (index) │ Bucket                 │ Region      │ Ownership              │ ExtraGrants                                                 │ Verdict                                             │
├─────────┼────────────────────────┼─────────────┼────────────────────────┼─────────────────────────────────────────────────────────────┼─────────────────────────────────────────────────────┤
│ 0       │ 'acme-app-uploads'     │ 'us-east-1' │ 'BucketOwnerEnforced'  │ '-'                                                         │ 'ok: ACLs disabled'                                 │
│ 1       │ 'acme-cdn-logs'        │ 'us-east-1' │ 'ObjectWriter'         │ 'CloudFront log delivery:FULL_CONTROL'                      │ 'MIGRATE: move ACL grants to a bucket policy first' │
│ 2       │ 'acme-legacy-assets'   │ 'eu-west-1' │ 'none (ACLs on)'       │ 'AllUsers (public):READ'                                    │ 'MIGRATE: move ACL grants to a bucket policy first' │
│ 3       │ 'acme-partner-drop'    │ 'eu-west-1' │ 'BucketOwnerPreferred' │ '-'                                                         │ 'READY: ACLs on, bucket ACL grants only the owner'  │
│ 4       │ 'acme-s3-access-logs'  │ 'us-east-1' │ 'none (ACLs on)'       │ 'S3 LogDelivery group:WRITE; S3 LogDelivery group:READ_ACP' │ 'MIGRATE: move ACL grants to a bucket policy first' │
│ 5       │ 'acme-terraform-state' │ 'us-east-1' │ 'none (ACLs on)'       │ '-'                                                         │ 'READY: ACLs on, bucket ACL grants only the owner'  │
└─────────┴────────────────────────┴─────────────┴────────────────────────┴─────────────────────────────────────────────────────────────┴─────────────────────────────────────────────────────┘
6 bucket(s) checked; 2 ready to disable ACLs, 3 need their ACL grants migrated first.
Report only: nothing changed. --apply would set BucketOwnerEnforced on the READY buckets.