Example SCP: Deny S3 bucket creation if ACLs are enabled


Service Control Policy example: Deny s3:CreateBucket if S3 bucket ACLs are enabled

S3 Bucket ACLs are a legacy access control mechanism and AWS recommends disabling this when creating new S3 buckets. Since IAM is the defacto standard to secure AWS resources, it’s best practice to use bucket policies to control access to objects in the S3 bucket.

From the AWS console, you’ll receive a notice to disable ACLs when you’re creating a new S3 bucket.

AWS Console: S3 bucket ownership options
AWS Console: S3 bucket ownership options

To enforce object ownership within an AWS Organization for every user that wants to create new S3 buckets, you can apply the following Service Control Policy.

  "Version": "2012-10-17",
  "Statement": [
      "Sid": "EnforceS3BucketOwnerFullControl",
      "Action": "s3:CreateBucket",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-object-ownership": "BucketOwnerEnforced"

How to create the AWS Service Control Policy

Log in to the AWS console and then go to the Service control policies tab under the AWS Organizations service where you can create the new policy.

Note: make sure to have AWS Organizations enabled.

Learn more about AWS Service Control Policies

If you are in a position where you have responsibility for the AWS Cloud infrastructure, then look at the complete guide to AWS Service Control Policies.

Danny Steenman

Is a Principal Cloud Consultant with a background in DevOps Engineering and thorough hands-on experience in architecting and building highly scalable distributed systems on AWS Cloud using Infrastructure as Code.

A prominent leader who is passionate about sharing AWS technical expertise by writing technical articles.