There is object whoes ACL is public-read-write, which i used awscli setting.
Then i used s3cmd setacl s3://object --acl-private to set object acl to private. However, the object'acls still have ACL: *anon*: WRITE item.
I can understand s3cmd only provides "acl-public", not "acl-public-read-write" for safety reasons. But i think "acl-private" should be consistent with awscli.
So, i think s3cmd setacl s3://objetct --acl-private should revoke ACL: *anon*: WRITE item.