Amazon S3 ACL for read-only and write-once access

Question

I\'m developing a web application and I currently have the following ACL assigned to the AWS account it uses to access its data:

Answer 1

If this is accidental overwrite you are trying to avoid, and your business requirements allow a short time window of inconsistency, you can do the rollback in the Lambda function:

1. Make it a policy that "no new objects with the same name". Most of the time it will not happen. To enforce it:
2. Listen for S3:PutObject events in an AWS Lambda function.
3. When the event is fired, check whether more than one version is present.
4. If there is more than one version present, delete all but the newest one.
5. Notify the uploader what happened (it's useful to have the original uploader in x-amz-meta-* of the object. More info here).