diff --git a/src/services/s3/format.ts b/src/services/s3/format.ts
index e3e4997e..022ad4f4 100644
--- a/src/services/s3/format.ts
+++ b/src/services/s3/format.ts
@@ -243,6 +243,12 @@ export default ({
       : `${total}`,
     transferAcceleration: accelerationStatus,
     notificationConfiguration: notificationConfigurationData,
+    aclGrants: grants?.map(g => ({
+      id: cuid(),
+      granteeType: g.Grantee?.Type,
+      granteeUri: g.Grantee?.URI,
+      permission: g.Permission,
+    })) || [],
   }
   return s3
 }
diff --git a/src/services/s3/schema.graphql b/src/services/s3/schema.graphql
index bb6c07d8..6e71c1a5 100644
--- a/src/services/s3/schema.graphql
+++ b/src/services/s3/schema.graphql
@@ -53,6 +53,18 @@ type awsS3NotificationConfiguration
   lambdaFunctionConfigurations: [awsS3LambdaFunctionConfiguration]
 }
 
+type awsS3AclGrant
+  @generate(
+    query: { get: false, query: true, aggregate: false }
+    mutation: { add: false, delete: false }
+    subscription: false
+  ) {
+  id: String! @id
+  granteeType: String @search(by: [hash])
+  granteeUri: String @search(by: [hash])
+  permission: String @search(by: [hash])
+}
+
 type awsS3 implements awsBaseService @key(fields: "arn") {
   access: String @search(by: [hash, regexp])
   bucketOwnerName: String @search(by: [hash, regexp])
@@ -75,6 +87,7 @@ type awsS3 implements awsBaseService @key(fields: "arn") {
   notificationConfiguration: awsS3NotificationConfiguration
   policy: awsIamJSONPolicy
   rawPolicy: String @search(by: [hash, regexp])
+  aclGrants: [awsS3AclGrant]
   kinesisFirehose: [awsKinesisFirehose] @hasInverse(field: s3)
   tags: [awsRawTag]
   cloudfrontDistributions: [awsCloudfront] @hasInverse(field: s3)
diff --git a/src/types/generated.ts b/src/types/generated.ts
index 696371d0..d5b25003 100644
--- a/src/types/generated.ts
+++ b/src/types/generated.ts
@@ -3760,6 +3760,7 @@ export type AwsRouteTable = AwsBaseService & {
 
 export type AwsS3 = AwsBaseService & {
   access?: Maybe<Scalars['String']>;
+  aclGrants?: Maybe<Array<Maybe<AwsS3AclGrant>>>;
   blockPublicAcls?: Maybe<Scalars['String']>;
   blockPublicPolicy?: Maybe<Scalars['String']>;
   bucketOwnerName?: Maybe<Scalars['String']>;
@@ -3792,6 +3793,13 @@ export type AwsS3 = AwsBaseService & {
   versioning?: Maybe<Scalars['String']>;
 };
 
+export type AwsS3AclGrant = {
+  granteeType?: Maybe<Scalars['String']>;
+  granteeUri?: Maybe<Scalars['String']>;
+  id: Scalars['String'];
+  permission?: Maybe<Scalars['String']>;
+};
+
 export type AwsS3ConfigurationBase = {
   events?: Maybe<Array<Maybe<Scalars['String']>>>;
   filterRules?: Maybe<Array<Maybe<AwsS3FilterRule>>>;