Policies are the alternative to ACLs. You craft your IAM user/role policies or your bucket's resource policy to allow and deny the appropriate access. ACLs are a totally separate subsystem of S3 that should be been deprecated long ago.