Access control list (ACL)

Object Storage incorporates multiple mechanisms for managing access to resources. To learn how these mechanisms interact, see Access management methods in Object Storage: Overview.

An Object Storage ACL is a list of permissions for each object and bucket. It is stored directly in Object Storage.

Permissions granted to a bucket apply to all objects it contains. With ACLs, you can also extend access permissions to individual objects.

For example, if a user has the viewer role in IAM for the folder containing the bucket, they can view its content, even though such permissions are not provided in the bucket ACL.

By default, Object Storage creates an empty ACL for each new object or bucket. Users with the appropriate access permissions can edit and upload ACLs for Object Storage buckets and objects.

You can use ACLs to grant permissions to a Yandex Cloud user, service account, user group, or public group (the group of all internet users, the group of all authenticated Yandex Cloud users). To do this, you need to know the permission grantee's ID. When granting permissions, you can use predefined ACLs, which contain common permission sets.

In the management console, you can only grant permissions to service accounts created in the same directory as the bucket. You can grant permissions to service accounts belonging to other directories using the YC CLI (only for the ACL bucket), AWS CLI, Terraform, or API.

To view the ACL structure description, see ACL XML schema. You can set up to 100 rules per ACL.

Permission recipient IDPermission recipient ID

• Yandex Cloud user

  You can get the ID in the following ways:

  • In the IAM section of the management console.
  • Using the IAM CLI or API.

• Service account

  To get the ID, in the management console, select Identity and Access Management from the list of services. In the left-hand panel, select Service accounts and select the service account.

• Public group

  Use the public group URI to grant permissions.

• User group

  To get the ID, navigate to the Groups tab in the Cloud Center interface.

  You can specify a user group using the Yandex Cloud CLI, AWS CLI, Terraform, and the API. For more information, see Editing a bucket ACL and Editing an object ACL.

ACL operationsACL operations

• In the management console, you can edit ACLs for buckets and objects.

• Using an Amazon S3-compatible API, you can upload or download ACLs for buckets or objects.

  You cannot delete ACLs. To remove all access permissions, upload an empty ACL.

Permission typesPermission types

Permissions correspond to user roles in IAM.

Predefined ACLsPredefined ACLs

Predefined ACLs can be applied to both objects and buckets. When applied to an object, the public-read-write ACL is the same as public-read.

You can upload a predefined ACL using only an Amazon S3-compatible HTTP API. When uploading an ACL, use the X-Amz-Acl HTTP header.

Public groupsPublic groups

AllUsersAllUsers

This system group includes all internet users.

A permission for AllUsers looks as follows:

<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
    <URI>http://acs.amazonaws.com/groups/global/AllUsers</URI>
</Grantee>

AuthenticatedUsersAuthenticatedUsers

This group includes all authenticated Yandex Cloud users: both from your clouds and other users' clouds.

A permission for AuthenticatedUsers looks as follows:

<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="Group">
    <URI>http://acs.amazonaws.com/groups/global/AuthenticatedUsers</URI>
</Grantee>

Inheritance of bucket access permissions by Yandex Cloud public groupsInheritance of bucket access permissions by Yandex Cloud public groups

A bucket inherits the same access permissions in IAM as those of the folder and cloud where it is located. If a user has permissions to access the folder or cloud the bucket belongs to, they will also have permissions to access the bucket itself.

Viewing bucket access permissions inherited from a folderViewing bucket access permissions inherited from a folder

A bucket inherits access permissions from the folder. If you want to know exactly which access permissions your bucket has inherited, get a list of roles for the folder. You can also revoke these roles at any time.

• To get a list of folder roles, run this command:

  yc resource-manager folder list-access-bindings \
    --id b1g7gvsi89m3********
  

  Result:

  +---------+--------------+-----------------------+
  | ROLE ID | SUBJECT TYPE |      SUBJECT ID       |
  +---------+--------------+-----------------------+
  | viewer  | system       | allAuthenticatedUsers |
  | viewer  | system       | allUsers              |
  +---------+--------------+-----------------------+
  

  The output contains allAuthenticatedUsers and allUsers. This means the users of these groups have permissions for this folder and all resources it contains, including buckets.

• To revoke a role from the All authenticated users public group, run the following command:

  yc resource-manager folder remove-access-binding \
    --id b1g7gvsi89m3******** \
    --role viewer \
    --allAuthenticatedUsers
  

• To revoke a role from the All users public group, run the following command:

  yc resource-manager folder remove-access-binding \
    --id b1g7gvsi89m3******** \
    --role viewer \
    --allUsers
  

See alsoSee also

• Editing a bucket's ACL
• Editing an object's ACL