code: private static String mapXmlAclsToCannedPolicy(
              AccessControlPolicy policy) throws S3Exception {
          if (!policy.owner.id.equals(FAKE_OWNER_ID)) {
              throw new S3Exception(S3ErrorCode.NOT_IMPLEMENTED);
          }
  
          boolean ownerFullControl = false;
          boolean allUsersRead = false;
          if (policy.aclList != null) {
              for (AccessControlPolicy.AccessControlList.Grant grant :
                      policy.aclList.grants) {
                  if (grant.grantee.type.equals("CanonicalUser") &&
                          grant.grantee.id.equals(FAKE_OWNER_ID) &&
                          grant.permission.equals("FULL_CONTROL")) {
                      ownerFullControl = true;
                  } else if (grant.grantee.type.equals("Group") &&
                          grant.grantee.uri.equals("http://acs.amazonaws.com/" +
                                  "groups/global/AllUsers") &&
                          grant.permission.equals("READ")) {
                      allUsersRead = true;
                  } else {
                      throw new S3Exception(S3ErrorCode.NOT_IMPLEMENTED);
                  }
              }
          }
  
          if (ownerFullControl) {
              if (allUsersRead) {
                  return "public-read";
              }
              return "private";
          } else {
              throw new S3Exception(S3ErrorCode.NOT_IMPLEMENTED);
          }
      }
docs: Map XML ACLs to a canned policy if an exact tranformation exists.