Configuring an Object ACL

You can set the permissions for other users to access and manage your objects by using an Access Control List (ACL).

The users to whom you share your objects can also download them. For more information, see Access Control List (ACL) Reference.

You can set the ACL for the current version of an object, or one or more of its versions. This enables you to hide or to share a former version with other users.

You need to specify the ACL individually for each object contained in your bucket.

Configuring an Object ACL Using AWS CLI

Before you begin: Install and configure AWS CLI. For more information, see Installing and Configuring AWS CLI.

To set the ACL for an object, use the put-object-acl command following this syntax:

Request sample

$ aws s3api put-object-acl \
    --bucket BUCKET \
    --key OBJECT \
    --acl private \
    --grant-full-control "id=USER_ID, id=USER_ID" \
    --grant-read "id=USER_ID, id=USER_ID" \
    --grant-read-acp "id=USER_ID, id=USER_ID" \
    --grant-write "id=USER_ID, id=USER_ID" \
    --grant-write-acp "id=USER_ID, id=USER_ID" \
    --version-id qAfAAsAAuA00kclkg0A0AAuAAjaAtA. \
    --endpoint https://oos.eu-west-2.outscale.com

This command contains the following attributes that you need to specify:

(optional) profile: The named profile you want to use, created when configuring AWS CLI. For more information, see Installing and Configuring AWS CLI.
bucket: The name of the bucket in which the object is stored.
key: The name of the object in the bucket.

(optional) acl: The permissions you grant for your bucket (private | public-read | public-read-write | authenticated-read).

If you do not specify a permission for your bucket upon creation, it will automatically be set to private.
When specifying new permissions, all the previous permissions are replaced. Therefore, you need to specify both the existing permissions that you want to keep and the new permissions that you want to give in a single command.

For more information about existing permissions, see Getting Information About a Bucket ACL and Getting Information About an Object ACL.

(optional) grant-full-control: One or more IDs of users to whom you grant the full-control permission.
(optional) grant-read: One or more IDs of users to whom you grant the read permission.
(optional) grant-read-acp: One or more IDs of users to whom you grant the read-acp permission.
(optional) grant-write: One or more IDs of users to whom you grant the write permission.

(optional) grant-write-acp: One or more IDs of users to whom you grant the write-acp permission.

You need to specify S3 user IDs. You can retrieve S3 user IDs via the Listing Your Buckets and Listing the Objects of a Bucket methods.
You can also specify user email addresses using the emailaddress=name@domain.com format.

(optional) version-id: The version ID of a previous or of the current version of the object.
If the version-id starts with a hyphen (-), you need to specify the attribute following this syntax:

--version-id=-qAfAAsAAuA00kclkg0A0AAuAAjaAtA.
endpoint: The endpoint corresponding to the Region you want to send the request to. For more information, see Installing and Configuring AWS CLI.

The ACL is set for the object.

Related Pages

AWS™ and Amazon Web Services™ are trademarks of Amazon Technologies, Inc or its affiliates in the United States and/or other countries.