Currently, the code doesn't check if the user creating a bucket with locking feature has bucket locking and versioning permissions enabled, adding it in accordance with S3 spec. https://docs.aws.amazon.com/AmazonS3/latest/API/API_CreateBucket.html Object Lock - If ObjectLockEnabledForBucket is set to true in your CreateBucket request, s3:PutBucketObjectLockConfiguration and s3:PutBucketVersioning permissions are required.