From e7c1d35a2a6d5fd5f78a6ab8dcf8100d65704d67 Mon Sep 17 00:00:00 2001
From: Jake Howard <jake.howard@torchbox.com>
Date: Mon, 7 Sep 2026 12:15:41 +0100
Subject: [PATCH] Enable ACLs when creating buckets which require ACLs

---
 README.rst               |  1 +
 buckup/bucket_creator.py | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/README.rst b/README.rst
index 6f75d70..992cc62 100644
--- a/README.rst
+++ b/README.rst
@@ -101,6 +101,7 @@ Usage
       * ``s3:PutBucketCORS``
       * ``s3:PutBucketVersioning``
       * ``iam:CreateAccessKey``
+      * ``s3:PutBucketOwnershipControls``
 
 2. After you set that up, you can type ``buckup`` and that should open the
    prompt.
diff --git a/buckup/bucket_creator.py b/buckup/bucket_creator.py
index b80e5cc..b78e63d 100644
--- a/buckup/bucket_creator.py
+++ b/buckup/bucket_creator.py
@@ -121,8 +121,21 @@ def set_bucket_policy(
                 "RestrictPublicBuckets": not public_access,
             },
         )
-        if public_access or allow_public_acls:
-            print("Configured public access to bucket.")
+
+        # NB: This API doesn't exist on a `Bucket`
+        self.s3_client.put_bucket_ownership_controls(
+            Bucket=bucket.name,
+            OwnershipControls={
+                # "BucketOwnerPreferred" = ACLs enabled. "BucketOwnerEnforced" = ACLs disabled.
+                "Rules": [
+                    {
+                        "ObjectOwnership": "BucketOwnerPreferred"
+                        if allow_public_acls
+                        else "BucketOwnerEnforced"
+                    }
+                ]
+            },
+        )
 
         policy_statement = list(
             self.get_bucket_policy_statements_for_user_access(bucket, user)