ACL Access Control Practice

Last Updated At: 2025-10-21 09:10:00

Overview

An access control list (ACL) is one of the resource-based access policy options that manages access to buckets and objects. An ACL can be used to grant read and write permissions to other root accounts and user groups.

Unlike an access policy, an ACL has the following limits on the management permissions:

  • Permissions can only be granted to accounts of the cloud platform.
  • Only supports five operation groups: Read Objects, Write to Objects, Read ACLs, Write to ACLs, and All Permissions.
  • Additional conditions for the ACL rules to take effect are not supported.
  • Explicit deny is not supported.

Control granularities supported by an ACL:

  • Bucket
  • Object key prefix
  • Object

Control Elements of an ACL

When a bucket or an object is created, the root account to which the resources of the bucket or object belong owns all permissions to these resources, and the permissions cannot be modified or deleted. You can use an ACL to grant other cloud platform accounts the access permissions. The following is an example ACL for a bucket.

<AccessControlPolicy>
  <Owner>
    <ID>qcs::cam::uin/12345:uin/12345</ID>
    <DisplayName>qcs::cam::uin/12345:uin/12345</DisplayName>
  </Owner>
  <AccessControlList>
    <Grant>
      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="RootAccount">
        <ID>qcs::cam::uin/12345:uin/12345</ID>
        <DisplayName>qcs::cam::uin/12345:uin/12345</DisplayName>
      </Grantee>
      <Permission>FULL_CONTROL</Permission>
    </Grant>
    <Grant>
      <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="RootAccount">
        <ID>qcs::cam::uin/54321:uin/54321</ID>
        <DisplayName>qcs::cam::anyone:anyone</DisplayName>
      </Grantee>
      <Permission>READ</Permission>
    </Grant>
  </AccessControlList>
</AccessControlPolicy>

The preceding ACL contains an Owner element that identifies the bucket owner who owns all permissions to the bucket, and the Grant element is used to grant anonymous read permission, which is expressed as READ permission of qcs::cam::anyone:anyone.

Grantees

Root Account

You can grant access permissions to other root accounts based on the definition of the principal in CAM, which is described as follows:

qcs::cam::uin/1238423:uin/1238423

Anonymous User

You can grant access permissions to anonymous users based on the definition of the principal in CAM, which is described as follows:

qcs::cam::anyone:anyone

Permission Operation Group

The following table describes the permission operation groups supported by an ACL.

Operation Group Bucket Prefix Object
READ List and read objects in a bucket. List and read objects in a directory. Read the Object
WRITE Create, overwrite, or delete any object in a bucket. Create, overwrite, or delete any object in the directory. Overwrite and Delete the Object
READ_ACP Read the ACL of a bucket. Read the ACL of a directory. Read an object's ACL.
WRITE_ACP Modify the ACL of a bucket. Modify the ACL under a directory. Modify the ACL of an object.
FULL_CONTROL Any operation on buckets and objects. Perform any operation on the object in the directory. Perform any operation on the object.

Standard ACL Description

COS supports a series of predefined authorizations, which are called standard ACLs. The following table describes the authorization meanings of standard ACLs.

Note:

A root account always has the FULL_CONTROL permission, which is not described in the following table.

Standard ACL Description
(Null) This is the default policy. Others do not have permissions. The permissions for resources are inherited from the upper level.
private Others do not have permissions.
public-read The anonymous user group has the READ permission.
public-read-write The anonymous user group has the READ and WRITE permissions, which are generally not recommended for buckets.

ACL Examples

Setting an ACL for a Bucket

The following example grants another root account the read permission to a bucket.

Setting an ACL for an Object

The following example grants another root account the read permission to an object.