Visibility and ACLs

S3 Manager lets you view and edit the Access Control List (ACL) for individual objects through a Permissions dialog. You can add or remove grants for predefined groups and canonical users, and change the permission level on each grant.

Caution

ACL changes only take effect when the bucket has ACLs enabled. Buckets configured with the bucket-owner-enforced Object Ownership setting disable ACLs entirely — the Permissions dialog will return an error if you try to use it on such a bucket.

Additionally, bucket-level “Block Public Access” settings on your account or bucket may silently override ACLs even after you save them. Granting public read in the ACL does not guarantee public access if Block Public Access is active.

Opening the Permissions dialog

Open the file detail panel by clicking a file in the file browser, then click the Permissions action. The dialog loads the current ACL for the object, showing the owner and the list of existing grants.

Grantees

Each row in the grant table represents one grantee. S3 Manager supports two grantee types when adding a new grant:

Grantee type	What it identifies
Group	A predefined Amazon S3 group URI
Canonical User	A specific AWS account identified by its canonical user ID

Predefined groups

When you choose Group, you can select from three predefined groups:

Group label	Who it represents
Everyone (public)	All users, including unauthenticated (anonymous) internet traffic (AllUsers)
Authenticated users	Any AWS-authenticated user worldwide (AuthenticatedUsers)
Log delivery	The S3 log delivery group (LogDelivery), used for server access logging

Granting READ to Everyone (public) makes the object publicly downloadable by anyone with the URL. This is equivalent to a public-read canned ACL.

Canonical users

When you choose Canonical User, enter the canonical user ID (required) and an optional display name. This grants access to the specific AWS account that owns that canonical ID.

Permissions

Each grant has one of the following permission levels:

Permission	What it allows
READ	Download the object
READ_ACP	Read the object’s ACL
WRITE	Write (upload) objects (meaningful on a bucket; rarely used on individual objects)
WRITE_ACP	Write (update) the object’s ACL
FULL_CONTROL	All of the above

Adding and removing grants

• To add a grant, select the grantee type and target, choose a permission, and click Add. The new row appears in the table immediately.
• To change the permission on an existing grant, use the dropdown in that row.
• To remove a grant, click the trash icon on the right of the row.

Click Save permissions to write the updated ACL to S3. Click Cancel or the close button to discard changes.

Making an object public

To make an object publicly readable:

1. Open the Permissions dialog for the object.
2. Set the grantee type to Group and select Everyone (public).
3. Set the permission to READ.
4. Click Add, then Save permissions.

To revert to private, remove the Everyone (public) row and save again.