Object permission control
Updated at:2025-11-03
Overview
BOS provides detailed access control at the object level, allowing different objects in a bucket to have specific permissions for different users. Access permissions for a single object can be managed with CannedACL and ACL files. Currently, two permission types are supported: READ and FULL_CONTROL.
Operation types
BOS supports managing object permission using both APIs and SDKs, with the specific methods as follows:
-
Managing object permissions via API
-
Managing object permissions via SDK
Note
- For a newly created object, the default object ACL is empty. In such cases, the bucket's ACL will take precedence when the object is accessed.
- If no specific permissions are set for an object, the object ACL is null and defaults to the bucket's permissions.
- Object ACL overrides bucket ACL. For instance, if an object is set to public-read, it will remain accessible regardless of the bucket's permissions.
- Currently, object ACL authentication applies to four APIs: GetObjectMeta, GetObject, CopyObject, and UploadPartCopy.
- To view, modify, or delete an object ACL, you must have FULL_CONTROL permission for the object. If the Object ACL is empty, you must either have FULL_CONTROL permission for the bucket or be its owner.
