DigitalOcean Spaces: Enforce Private Default ACL Across Account

Question

DigitalOcean Spaces creates new buckets with public-read ACL unless the creation request explicitly sets acl to private. The API v2 and console do not expose an account-level default-deny policy or a mandatory private ACL setting, so administrators must remember to set the ACL on every Space individually.
Goal: Prevent accidental public exposure by ensuring every new Space defaults to private without relying on per-request ACL parameters.
Constraints: No global default deny rule exists at the account level. The console provides only a per-Space public/private toggle, and the API does not return a creation audit entry that records the selected ACL. Behavior may differ across account tiers or change with future platform updates.

Can an account-level policy be configured to reject or override public-read ACLs for new Spaces?
Is there an API endpoint or webhook that audits Space ACL changes at creation time?
What verification method confirms the effective default ACL for a newly created Space when the acl parameter is omitted?

Tasadduq Burney · Answer

How to enforce a private default ACL for new DigitalOcean Spaces
DigitalOcean Spaces does not provide an account‑level default‑deny policy, and the console or API do not record a creation‑time ACL audit. Therefore the only reliable way to guarantee privacy is to enforce the private ACL at the time of creation through automation.
Steps to ensure a private default

Configure your provisioning tool (Terraform, Pulumi, custom script, etc.) to explicitly set acl = "private" on every Space resource. The platform default is public‑read, so the explicit parameter overrides it.
If you are using the S3‑compatible API directly, wrap the creation call in a function that always adds the acl parameter; developers should not be able to omit it.
After a Space is created, verify the effective ACL by calling the S3‑compatible get-bucket-acl operation (or the equivalent DigitalOcean endpoint) and confirm that the ACL object reports private.

Verification method: run aws s3api get-bucket-acl --bucket  --endpoint-url https://.digitaloceanspaces.com immediately after creation. The response includes the Grants list; if Grantee entries show Permission: "private" (or the DigitalOcean equivalent), the default is private.
Assumption: the verification uses the S3‑compatible API endpoint; if you are using the native DigitalOcean API, replace the endpoint with the appropriate region URL and use the API call that returns ACL details.

DigitalOcean Spaces: Enforce Private Default ACL Across Account

1 answer

How to enforce a private default ACL for new DigitalOcean Spaces

Steps to ensure a private default

Your perspective belongs here.

0 question comments