Manage permissions

Permissions control who can list, read, and change the data in your buckets. FPT Object Storage gives you three layers: Bucket ACL, Object ACL, and Bucket Policy.

Layer	Applies to	Use it to
Bucket ACL	The bucket	Let anyone list the objects in a bucket, or keep the bucket private.
Object ACL	One object	Make a single object public or private.
Bucket Policy	The bucket and its objects	Define detailed rules, such as making all objects public or granting a SubUser access to one bucket. Takes precedence over Object ACL.

Set the Bucket ACL

Bucket ACL has two modes:

• Private: only authenticated and authorized users can access or manage the bucket.
• Public: anyone, including anonymous users on the Internet, can read the bucket and see the full list of its objects.

note

Bucket ACL does not apply to the objects themselves. To let anonymous users open objects, use Object ACL or Bucket Policy.

1. In the Action column of the bucket, click Config.
2. Select Public or Private.

Set the Object ACL

Object ACL has two modes:

• Private: anonymous users cannot access the object. Only authenticated and authorized users can view it.
• Public: anyone, including anonymous users, can read the object through its URL.

1. In Object Storage Management, open the bucket that contains the file.
2. Go to the file location. In the Action column, click Edit Permission.
3. In Read permission, select Public or Private, then click Update.

warning

Bucket Policy takes precedence over Object ACL. If a Bucket Policy makes all objects public, every object is publicly readable, whatever its Object ACL says.

Configure a Bucket Policy

A Bucket Policy is an S3-compatible JSON document that defines who can perform which actions on a bucket and its objects. Rules can allow or deny access based on factors such as IP address, time, or action type (GET, PUT, DELETE). Use it to share a bucket with other organizations, grant SubUsers access to specific buckets, or restrict access.

You can create a policy with the AWS Policy Generator and apply it to FPT Object Storage.

The following policy lets everyone ("Principal": "*") read (s3:GetObject) all objects in the bucket example-bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowPublicRead",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

A Bucket Policy applies only to the bucket where it is declared. For example, the policy of bucket-1 cannot contain rules for bucket-2.

1. In the Action column of the bucket, click Config.
2. Select an editor mode: JSON Editor if you already have a policy in JSON, or Visual Editor to build one step by step.
3. Enter the policy, then click Create for a new policy or Update for an existing one.

warning

Review every policy before you save it. A wrong Principal or Resource can expose your data to people who should not see it.