title: How can I assign bucket-owner-full-control when creating an S3 object with boto3?
body: <p>I'm using the Amazon boto3 library in Python to upload a file into another users bucket. The bucket policy applied to the other users bucket is configured like this</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "DelegateS3BucketList",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::uuu"
              },
              "Action": "s3:ListBucket",
              "Resource": "arn:aws:s3:::bbb"
          },
          {
              "Sid": "DelegateS3ObjectUpload",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::uuu"
              },
              "Action": [
                  "s3:PutObject",
                  "s3:PutObjectAcl"
              ],
              "Resource": [
                  "arn:aws:s3:::bbb",
                  "arn:aws:s3:::bbb/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>where <code>uuu</code> is my user id and <code>bbb</code> is the bucket name belonging to the other user. <strong>My user and the other user are IAM accounts belonging to different organisations</strong>. (I know this policy can be written more simply, but the intention is to add a check on the upload to block objects without appropriate permissions being created).</p>
  
  <p>I can then use the following code to list all objects in the bucket and also to upload new objects to the bucket. This works, however the owner of the bucket has no access to the object due to Amazons default of making objects private to the creator of the object</p>
  
  <pre class="lang-py prettyprint-override"><code>import base64
  import hashlib
  from boto3.session import Session
  
  
  access_key = "value generated by Amazon"
  secret_key = "value generated by Amazon"
  bucketname = "bbb"
  
  content_bytes = b"hello world!"
  content_md5 = base64.b64encode(hashlib.md5(content_bytes).digest()).decode("utf-8")
  filename = "foo.txt"
  
  sess = Session(aws_access_key_id=access_key, aws_secret_access_key=secret_key)
  
  bucket = sess.resource("s3").Bucket(bucketname)
  for o in bucket.objects.all():
      print(o)
  
  s3 = sess.client("s3")
  s3.put_object(
      Bucket=bucketname,
      Key=filename,
      Body=content_bytes,
      ContentMD5=content_md5,
      # ACL="bucket-owner-full-control"  # Uncomment this line to generate error
  )
  </code></pre>
  
  <p>As soon as I uncomment the ACL option, the code generates an Access Denied error message. If I redirect this to point to a bucket inside my own organisation, the ACL option succeeds and the owner of the bucket is given full permission to the object.</p>
  
  <p>I'm now at a loss to figure this out, especially as Amazons own advice appears to be to do it the way I have shown.</p>
  
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-owner-access/" rel="noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-owner-access/</a></p>
  
  <p><a href="https://aws.amazon.com/premiumsupport/knowledge-center/s3-require-object-ownership/" rel="noreferrer">https://aws.amazon.com/premiumsupport/knowledge-center/s3-require-object-ownership/</a></p>