s3 generate a presigned post url using boto3 with a private acl

Question

for boto3 how do we define an s3 object acl that can only be read by a presigned post url

example:

acl: \'public-read\' <-- public acl

acl: \'thing