I have similar issue with Amazon s3 bucket. https://serverfault.com/questions/693815/how-to-stop-s3-from-listing-some-of-the-content
It is working fine when i remove "List" permission, the bucket contents are not visible. But when I upload an item to that bucket via API, again the "List" permission got ticked and anyone can view all the items with the bucket.
This is the PHP code where I upload item to the bucket
$this->s3->putObjectFile($path, $this->bucketName, $fileName, S3::ACL_PUBLIC_READ);
I wanted to keep un-tick "List" permission even I upload a new item. What should i do ?