---
title: "Set Object ACL"
slug: "set-object-acl-s3cmd"
updated: 2026-10-27T17:23:57Z
published: 2026-10-27T17:23:57Z
canonical: "docs.vastdata.com/set-object-acl-s3cmd"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Object ACL

Before setting ACL permissions, we recommend you read [Managing S3 Access Control Lists (ACLs)](/docs-5-3/docs/en/managing-s3-access-control-lists-acls).

```plaintext
s3cmd [-c CONFIGFILE] setacl s3://BUCKET/OBJECT [--acl-grant=PERMISSION:{USER_VAST_ID|GROUP}] [--acl-revoke=PERMISSION:{USER_VAST_ID|GROUP}]
```

| CONFIGFILE | Configuration file. Defaults to $HOME/.s3cfg |
| --- | --- |
| BUCKET | Name of bucket |
| OBJECT | Name of object |
| --acl-grant | Grant stated permission for stated user or group. |
| --acl-revoke | Revoke stated permission for stated user or group |
| PERMISSION | Type of permission to grant: - read - write - read_acp - write_acp - full_control - all |
| USER | A user to which you want to grant the permission. Can be specified as: . - A principal name in the format *user@domain*, where *user* is the user name and *domain* is configured for an external auth provider on the cluster (LDAP, NIS). > [!NOTE] > **Note** > > Users on the local provider cannot be specified this way. - A VID, which is a VAST ID used in the cluster's internal user database. A user VID is retrievable by running the [user query](/docs-5-3/docs/user-query) VAST CLI command and specify *udb* as the context of the query. The output includes the user's VID.user query |
| GROUP | A group to which you want to grant the permission. The group can be specified as follows: - Set the type to *GroupLoginName* and specify the group in the format *group@domain*, where *group* is the group name and *domain* is configured for an external auth provider on the cluster (such as LDAP). > [!NOTE] > **Notice** > > Specifying a group by GroupLoginName is supported starting with VAST Cluster 5.3.3. - Specify the group's VID, which is the VAST ID used in the cluster's internal user database. A group VID can be retrieved by running the [group query](/docs-5-3/docs/en/group-query) VAST CLI command and specify *udb* as the context of the query. The output includes the group's VID. If you want to grant permissions to an S3 predefined group, specify one of the following: - `http://acs.amazonaws.com/groups/global/AllUsers`, or - `http://acs.amazonaws.com/groups/global/AuthenticatedUsers` |

## Example

Grant write permission to object *myfile.asp* in bucket *mybucket* to the user whose VID is 6:

```plaintext
$ s3cmd -c vast.s3cfg setacl s3://mybucket/myfile.asp --acl-grant=write:6
```

Grant read permission to object *myfile.asp* in bucket *mybucket* to group *mygroup@domain.com*:

```plaintext
$ s3cmd -c vast.s3cfg setacl s3://mybucket/myfile.asp --acl-grant=read:'groupLoginName=mygroup@domain.com'
```