AccessControl AuthenticatedRead Not Working in S3 Bucket CloudFormation

Question

I am trying to create an S3 bucket with CloudFormation with the following property setting. However, I keep getting "API: s3:CreateBucket Access Denied " error on S3 Bucket creation.

AccessControl: AuthenticatedRead

I tried with and without setting Bucket policy and Ownership Controls, but still the same error. Below is the template I tried (with and without commented code).

```
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: SAM Template for testing S3 Bucket

Parameters:
  testBucketName:
    Type: String
    Default: 111-mybucket

Resources:
  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${testBucketName}
      OwnershipControls:
        Rules:
          - ObjectOwnership: BucketOwnerPreferred
      #AccessControl: AuthenticatedRead
      BucketEncryption:
          ServerSideEncryptionConfiguration: 
            - ServerSideEncryptionByDefault:
                SSEAlgorithm: AES256
              BucketKeyEnabled: true      
      LifecycleConfiguration:
        Rules:
          - Id: STANDARD_IA_Rule
            Prefix: SourcesBucket
            Status: Enabled
            ExpirationInDays: 365
            Transitions:
              - TransitionInDays: 30
                StorageClass: STANDARD_IA
              - TransitionInDays: 180
                StorageClass: GLACIER
          
  TestBucketPolicy:
    Type: 'AWS::S3::BucketPolicy'
    Properties:
      Bucket: !Ref TestBucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: Allow
            Principal: 
              AWS:
                - !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Resource:
              - !Sub 'arn:${AWS::Partition}:s3:::${TestBucket}/*'
            Sid: AllowRead
          # - Action:
          #     - 's3:CreateBucket'
          #     - 's3:PutBucketAcl'
          #   Effect: Allow
          #   Principal: '*'
          #     # AWS:
          #     #   - !Sub "arn:aws:iam::${AWS::AccountId}:root"
          #   Resource:
          #     - !Sub 'arn:${AWS::Partition}:s3:::${TestBucket}
          #   Sid: AllowPermissions
```

Please help.

Answer

If you are seeing this "API: s3:CreateBucket Access Denied " error with and without setting Bucket policy and Ownership Controls, that means role/user is missing permissions to create bucket.

IAM role/User should have following permissions:

**s3:CreateBucket**

**s3:PutBucketAcl**

Make sure, **Resource** part of role policy allows the pattern/name which you are trying to create as.

Try adding following in your template(specially, when you are trying to put ACL options as well in the template):

OwnershipControls:
                 Rules:
                     - ObjectOwnership: BucketOwnerPreferred

Additionally, make sure that createbucket action is not denied in Service Control Policy or being limited through Permissions Boundary.

AccessControl AuthenticatedRead Not Working in S3 Bucket CloudFormation

Relevant content