title: Terraform - Updating S3 Access Control: Question on replacing acl with grant
body: <p>I have an S3 bucket which is used as Access logging bucket.</p>
  <p>Here is my current module and resource TF code for that:</p>
  <pre><code>module &quot;access_logging_bucket&quot; {
      source = &quot;../../resources/s3_bucket&quot;
      environment = &quot;${var.environment}&quot;
      region = &quot;${var.region}&quot;
      acl = &quot;log-delivery-write&quot;
  
      encryption_key_alias = &quot;alias/ab-data-key&quot;
  
      name = &quot;access-logging&quot;
      name_tag = &quot;Access logging bucket&quot;
  }
  
  resource &quot;aws_s3_bucket&quot; &quot;default&quot; {
      bucket = &quot;ab-${var.environment}-${var.name}-${random_id.bucket_suffix.hex}&quot;
      acl = &quot;${var.acl}&quot;
  
      depends_on = [data.template_file.dependencies]
  
      tags = {
          name = &quot;${var.name_tag}&quot;
          . . .
      }
  
      lifecycle {
          ignore_changes = [ &quot;server_side_encryption_configuration&quot; ]
      }
  }
  </code></pre>
  <p>The default value of variable <em>acl</em> is <code>variable &quot;acl&quot; { default = &quot;private&quot; }</code> in my case. And also as stated in <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket#attributes-reference" rel="nofollow noreferrer">Terraform S3 bucket attribute reference doc</a>.</p>
  <p>And for this bucket it is set to <code>log-delivery-write</code>.</p>
  <p>I want to update it to add following <em>grants</em> and remove <em>acl</em> as they conflict with each other:</p>
  <pre><code>grant {
      permissions = [&quot;READ_ACP&quot;, &quot;WRITE&quot;]
      type = &quot;Group&quot;
      uri = &quot;http://acs.amazonaws.com/groups/s3/LogDelivery&quot;
  }
  grant {
      id = data.aws_canonical_user_id.current.id
      permissions = [&quot;FULL_CONTROL&quot;]
      type = &quot;CanonicalUser&quot;
  }
  </code></pre>
  <p><strong>My Questions are:</strong></p>
  <ol>
  <li>Is removing the <code>acl</code> attribute and adding the above mentioned <code>grants</code> still maintain the correct access control for the bucket. i.e. is that grant configuration still good to have this as an Access Logging bucket.</li>
  <li>If I remove the acl from the resource config, it will make it <code>private</code> which is the default value. Is that the correct thing to do or should it be made null or something?</li>
  </ol>
  <p>On checking some documentation for <code>Log Delivery group</code> found this which leads me to think I can go ahead with replacing the <em>acl</em> with the <em>grants</em> I mentioned:</p>
  <blockquote>
  <p>Log Delivery group – Represented by
  <a href="http://acs.amazonaws.com/groups/s3/LogDelivery" rel="nofollow noreferrer">http://acs.amazonaws.com/groups/s3/LogDelivery</a> . WRITE permission on a
  bucket enables this group to write server access logs (see Amazon S3
  server access logging) to the bucket. When using ACLs, a grantee can
  be an AWS account or one of the predefined Amazon S3 groups.</p>
  </blockquote>