A developer creates a brand-new S3 bucket in 2026 without changing any default settings, then has another AWS account upload an object to it using a custom ACL that attempts to grant a third account read access. What happens, given the bucket's default Object Ownership setting?
- The upload succeeds and the third account gains read access exactly as the ACL specified
- The upload succeeds, but only the bucket owner can read the object because ACLs are silently ignored
- The upload fails, because the default Bucket owner enforced setting disables ACLs and rejects PUT requests that specify one other than bucket-owner-full-control
- The upload succeeds only if the uploading account first disables S3 Block Public Access
Why C? And why not the others?
Correct answer: C. The upload fails, because the default Bucket owner enforced setting disables ACLs and rejects PUT requests that specify one other than bucket-owner-full-control
New S3 buckets are created with the Bucket owner enforced setting for Object Ownership by default, which disables ACLs entirely: the bucket only accepts PUT requests that either specify no ACL or specify the bucket-owner-full-control canned ACL, and any PUT request specifying a different, custom ACL is rejected with an error rather than silently ignored. So the upload in this scenario fails outright, and the bucket owner automatically owns and controls every object regardless of who uploaded it. The idea that the ACL succeeds and grants the third account access is wrong precisely because ACLs no longer affect permissions once this default setting is in place. The idea that the upload succeeds but the ACL is silently dropped is close but incorrect: S3 actively rejects PUT requests carrying an unsupported ACL rather than accepting the upload and discarding the ACL. Block Public Access is a separate setting entirely, governing public access, and has no bearing on whether a same-account-owner ACL upload is accepted.
Source: AWS S3 docs: Controlling ownership of objects and disabling ACLs for your bucket