{"record":{"id":"0e2ec0c6aa578db8","repo":"remotion-dev/remotion","slug":"could-not-add-an-acl-to-the-bucket-this-might-hav","errorCode":null,"errorMessage":"Could not add an ACL to the bucket. This might have happened because the bucket was already successfully created before but then failed to configure correctly. We recommend to delete the bucket (${bucketName}) if it is empty and start over to fix the problem.","messagePattern":"Could not add an ACL to the bucket\\. This might have happened because the bucket was already successfully created before but then failed to configure correctly\\. We recommend to delete the bucket \\((.+?)\\) if it is empty and start over to fix the problem\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/lambda-client/src/create-bucket.ts","lineNumber":114,"sourceCode":"\t\t\t\t'Could not apply a bucket policy to restrict public access to s3:GetObject only. Falling back to public-read ACL which also allows listing objects. To fix this, add the s3:PutBucketPolicy permission to your IAM user. See https://remotion.dev/docs/lambda/bucket-security',\n\t\t\t);\n\t\t}\n\n\t\ttry {\n\t\t\tawait getS3Client({\n\t\t\t\tregion,\n\t\t\t\tcustomCredentials: null,\n\t\t\t\tforcePathStyle,\n\t\t\t\trequestHandler,\n\t\t\t}).send(\n\t\t\t\tnew PutBucketAclCommand({\n\t\t\t\t\tBucket: bucketName,\n\t\t\t\t\tACL: usedBucketPolicy ? 'private' : 'public-read',\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (err) {\n\t\t\tif ((err as Error).message.includes('The bucket does not allow ACLs')) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`Could not add an ACL to the bucket. This might have happened because the bucket was already successfully created before but then failed to configure correctly. We recommend to delete the bucket (${bucketName}) if it is empty and start over to fix the problem.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tthrow err;\n\t\t}\n\t};\n","sourceCodeStart":96,"sourceCodeEnd":122,"githubUrl":"https://github.com/remotion-dev/remotion/blob/78fe4bb3fdb5a2cd68724393d63cb223db333fa7/packages/lambda-client/src/create-bucket.ts#L96-L122","documentation":"Thrown when the final PutBucketAcl fails with 'The bucket does not allow ACLs'. This happens when the bucket's ownership controls are BucketOwnerEnforced (ACLs disabled) — typically because a previous create attempt partially configured the bucket before failing. Since the ACL step cannot succeed on this bucket, the recommendation is to delete the empty bucket and start over.","triggerScenarios":"createBucket reaches PutBucketAcl on a bucket whose ownership is already set to BucketOwnerEnforced, so ACLs are rejected.","commonSituations":"A prior failed create left the bucket in a half-configured state; the bucket pre-existed with ACLs disabled; retrying getOrCreateBucket against a polluted bucket.","solutions":["Delete the named bucket (if empty) via the S3 console or aws s3 rb, then retry getOrCreateBucket","If the bucket must be kept, manually set ownership to ObjectWriter/AclPreferred and re-run","Avoid reusing a Remotion sites bucket with non-default ownership controls"],"exampleFix":"# bucket is half-configured; remove and recreate\naws s3 rb s3://<bucketName> --force   # only if empty/abandonable","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await getOrCreateBucket({...});\n} catch (err) {\n  if ((err as Error).message.includes('Could not add an ACL to the bucket')) {\n    // delete the empty bucket and retry from scratch\n  }\n  throw err;\n}","preventionTips":["Use a fresh bucket name when a previous create failed partway","Do not pre-configure ownership controls on a Remotion sites bucket","Clean up half-created buckets before re-running deploy"],"tags":["aws","s3","acl","permissions","state"],"backgroundTag":null,"analyzedSha":"78fe4bb3fdb5a2cd68724393d63cb223db333fa7","analyzedAt":"2026-08-12T17:18:50.444Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}