What does it mean when owner is None on an AWS S3 object

Question

When viewing an object through the AWS S3 console, under owner I see no value. Viewing the object owner attribute on a query of objects indicates the value of owner for these objects is None.

An example query that would return this information:

[o.owner for o in s3.Bucket(bkt_name).objects.filter(Prefix=filter_pattern)]

In the above case, I would see a list returning w/ None values, eg:

[None, None, ...]

These objects were uploaded with ACL set to bucket owner controlled:

{"ACL": "bucket-owner-full-control"}

My expectation would be that the bucket owner would show up here, not a None. What I'd like to understand is what would cause a None to appear. Is this a permissions issue in that I am not allowed to see the owner name? I presume all objects must have an owner and thus None is not an "actual" option but merely rendered if I am in fact no allowed to see the actual string.

Answer 1

S3 Object Ownership is an Amazon S3 bucket-level configuration that allows you to eliminate access control lists (ACLs) and take ownership of all objects in your bucket, making data access management in Amazon S3 much easier. When an object is uploaded to your S3 bucket by another AWS account, that account (the object writer) owns the object, has access to it, and can grant other users access through ACLs. This default behaviour can be overridden with Object Ownership. ACLs are eliminated when you use Object Ownership, and you, as the bucket owner, own every object in your bucket automatically. As a result, policies like IAM policies, S3 bucket policies, and virtual private cloud (VPC) endpoint policies are used to control access to your data.

Disabled ACLs

Bucket owner is enforced (preferred) — ACLs are disabled, and the bucket owner owns and controls all objects in the bucket automatically. Data permissions in the S3 bucket are no longer affected by ACLs. Policy-based access control is used in the bucket.

ACLs are now functional.

Bucket owner preferred – Using the bucket-owner-full-control canned ACL, the bucket owner owns and has complete control over new objects written to the bucket by other accounts.

The AWS account that uploads an item owns it, has full control over it, and can grant other users access to it using ACLs.