Cross-Account S3 Object Ownership Mapper

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 15 mins

TL;DR

• What broke: Account B uploaded objects into Account A's S3 bucket. Account B retained object ownership. Account A's IAM principals hit Access Denied because IAM policies only govern resources the principal's account owns—they cannot override ownership held by a foreign account.
• How to fix it: Enable S3 Object Ownership = BucketOwnerEnforced on the bucket. This disables ACLs entirely and forces all newly written objects to be owned by the bucket owner. Pair this with a bucket policy Deny on s3:PutObject unless s3:x-amz-object-ownership is absent (ACLs are already disabled, so the condition is implicit).
• Use our Client-Side Sandbox above to paste your bucket policy and cross-account IAM role—it will auto-detect the ownership misconfiguration and emit corrected, least-privilege policies without sending your ARNs to any external server.

An error occurred (AccessDenied) when calling the GetObject operation:
  Access Denied

{
  "eventName": "GetObject",
  "errorCode": "AccessDenied",
  "errorMessage": "Access Denied",
  "userIdentity": { "accountId": "111111111111" },
  "requestParameters": { "bucketName": "corp-data-bucket", "key": "uploads/report.csv" }
}

How to Fix It (The Solution)

Root Cause in One Line

S3 access evaluation order: Object Owner ACL → Bucket Policy → IAM Policy. When the object owner is a foreign account, the bucket owner's IAM and bucket policies are evaluated only if the object owner has explicitly granted bucket-owner-full-control via ACL—or ACLs are disabled entirely via BucketOwnerEnforced.

Basic Fix — Require `bucket-owner-full-control` ACL on Upload (Legacy, Not Recommended)

This works only if you control Account B's upload code. Add a bucket policy that denies s3:PutObject unless the request includes the bucket-owner-full-control canned ACL.

# Bucket Policy on Account A's bucket
{
  "Version": "2012-10-17",
  "Statement": [
-   {
-     "Sid": "AllowCrossAccountPut",
-     "Effect": "Allow",
-     "Principal": { "AWS": "arn:aws:iam::222222222222:role/upload-role" },
-     "Action": "s3:PutObject",
-     "Resource": "arn:aws:s3:::corp-data-bucket/*"
-   }
+   {
+     "Sid": "AllowCrossAccountPutWithOwnerControl",
+     "Effect": "Allow",
+     "Principal": { "AWS": "arn:aws:iam::222222222222:role/upload-role" },
+     "Action": "s3:PutObject",
+     "Resource": "arn:aws:s3:::corp-data-bucket/*",
+     "Condition": {
+       "StringEquals": {
+         "s3:x-amz-acl": "bucket-owner-full-control"
+       }
+     }
+   }
  ]
}

Account B's upload code must also be patched:

# Account B — boto3 upload call
- s3_client.put_object(
-     Bucket='corp-data-bucket',
-     Key='uploads/report.csv',
-     Body=data
- )
+ s3_client.put_object(
+     Bucket='corp-data-bucket',
+     Key='uploads/report.csv',
+     Body=data,
+     ACL='bucket-owner-full-control'
+ )

Limitation: This relies on Account B being cooperative and correctly configured. Any upload that omits the ACL header will be denied, which breaks pipelines until Account B fixes their code.

Enterprise Best Practice — S3 Object Ownership: BucketOwnerEnforced (Disable ACLs)

This is the AWS-recommended, permanent fix for all new and existing buckets used in cross-account patterns. It disables ACLs entirely. All objects written to the bucket are automatically owned by the bucket owner regardless of which account uploaded them.

Step 1: Enable BucketOwnerEnforced via Terraform

 resource "aws_s3_bucket_ownership_controls" "corp_data" {
   bucket = aws_s3_bucket.corp_data.id
   rule {
-    object_ownership = "BucketOwnerPreferred"
+    object_ownership = "BucketOwnerEnforced"
   }
 }

Step 2: Remove the ACL condition from the bucket policy (ACLs no longer exist)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrossAccountPut",
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::222222222222:role/upload-role" },
      "Action": [
        "s3:PutObject",
+       "s3:GetObject",
+       "s3:DeleteObject"
      ],
-     "Resource": "arn:aws:s3:::corp-data-bucket/*",
-     "Condition": {
-       "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }
-     }
+     "Resource": "arn:aws:s3:::corp-data-bucket/*"
    }
  ]
}

Step 3: Remove ACL header from Account B's upload code (it will be rejected if sent)

 s3_client.put_object(
     Bucket='corp-data-bucket',
     Key='uploads/report.csv',
     Body=data,
-    ACL='bucket-owner-full-control'
 )

Step 4: Migrate existing orphaned objects (objects uploaded before BucketOwnerEnforced was set still have the old ownership):

# Copy objects in-place to transfer ownership to bucket owner
aws s3 cp s3://corp-data-bucket/ s3://corp-data-bucket/ \
  --recursive \
  --metadata-directive REPLACE \
  --source-region us-east-1 \
  --region us-east-1

⚠️ This in-place copy re-writes objects under Account A's identity, transferring ownership. Test on a non-production prefix first. Large buckets require S3 Batch Operations.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

checks:
  - CKV2_AWS_65  # Ensure S3 bucket ACL is disabled (BucketOwnerEnforced)

checkov -d ./terraform --check CKV2_AWS_65 --hard-fail-on HIGH

# policy/s3_ownership.rego
package terraform.s3

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_s3_bucket_ownership_controls"
  resource.change.after.rule[_].object_ownership != "BucketOwnerEnforced"
  msg := sprintf(
    "S3 bucket '%v' must use BucketOwnerEnforced. Got: %v",
    [resource.name, resource.change.after.rule[_].object_ownership]
  )
}

terraform show -json tfplan.binary | conftest test -p policy/ -

# config-rule.yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  S3AclProhibitedRule:
    Type: AWS::Config::ConfigRule
    Properties:
      ConfigRuleName: s3-bucket-acl-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_ACL_PROHIBITED

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3PutWithACL",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": [
            "public-read",
            "public-read-write",
            "authenticated-read"
          ]
        }
      }
    }
  ]
}