aws s3 sync --acl does not update the ACL of existing files on S3

[nchammas]

If you sync some files from local storage to S3 and then re-run the same sync command with a new --acl setting, you'd expect the ACLs of the existing objects on S3 to be updated. However, they are not.

So, for example, after running these commands:

aws s3 rm --recursive s3://my-bucket/test/
aws s3 sync --acl public-read local-dir/ s3://my-bucket/test/
aws s3 sync --acl private local-dir/ s3://my-bucket/test/

The objects in s3://my-bucket/test/ will all have an ACL of public-read, when they should have an ACL of private.

What I'm running:

aws-cli/1.14.60 Python/3.6.4 Darwin/17.4.0 botocore/1.9.13

Related: #901, #1060 (comment)

[jamesls]

Hi thanks for reporting. It seems like this issue is a dupe of the those related issues you linked. Was there something different in this issue you wanted to call out?

I think the underlying problem is that the --acl option only applies to files it transfers during a sync. It doesn't check to make sure the acls of all the destination objects match the source objects' acl.

[nchammas]

I think they are closely related but separate issues. They may well have the same root cause, but to the end-user the problem is slightly different.

To highlight the differences between this issue and the others:

• s3 sync does not preserve permissions across buckets #901 is about ACLs not being synced by default. This issue here is about ACLs not being updated even with the explicit --acl flag.
• --acl option does not work with sync #1060 is about --acl not working at all. This issue is about --acl specifically not updating existing files. A later comment on --acl option does not work with sync #1060 by a different poster made that distinction, but by then the issue had already been closed.

I think the bug report here stands well on its own since it is clear, focused, and comes with a minimal reproducer.

[tim-kos]

Any update on this issue?

[jtomaszon]

Any update on this issue?

[kyleknap]

Marking as enhancement. It's slightly different than the linked issues but if we update to preserve ACL's, we will update to support updating ACL's based on the explicitly provided ACL.

[tmillner]

Bump

[rodrigomurta]

It would be nice to have this upgrade.

[mllanes]

Bumpy bumpy

[peabnuts123]

Please try not to bump threads - just vote 👍 on the OP. Bumping threads sends notifications, it doesn't help teams prioritise.

[homerjam]

Just in case this is useful in the meantime...

Credit

# Recursively apply ACL to all objects in a bucket
$ aws s3 cp --recursive --acl public-read --metadata-directive REPLACE s3://bucket s3://bucket