---
title: "Set Access Control List (ACL) Permissions on an Object"
slug: "set-access-control-list-acl-permissions-on-an-object-boto3-tg"
updated: 2026-10-27T17:23:14Z
published: 2026-10-27T17:23:14Z
canonical: "docs.vastdata.com/set-access-control-list-acl-permissions-on-an-object-boto3-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Access Control List (ACL) Permissions on an Object

Before setting ACL permissions, we recommend you read [Managing S3 Access Control Lists (ACLs)](/docs-5-3/docs/en/managing-s3-access-control-lists-acls-tg).

The [put_object_acl()](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/s3.html#S3.Client.put_object_acl) method sets the permissions on an object using access control lists (ACL).

## Syntax Notes

To grant permission to a user, specify the grantee with the following parameters:

- For users on external providers only (for example, Active Directory or LDAP) pass:

  - The *EmailAddress* parameter and provide the user's principal name in the format *user@domain*, where *user* is the user name and *domain* is configured for an external auth provider on the cluster (LDAP, NIS).
  - The *Type* parameter and provide *AmazonCustomerByEmail* as its value.
- For any users (including users on the local provider), pass:

  - The ID parameter and provide the user's VID as its value.

> [!TIP]
> **Tip**
> 
> A VID is a VAST ID used in the cluster's internal user database. user query
  - The *Type* parameter and provide *CanonicalUser* as its value.

To grant permission to a group, specify the grantee as follows:

- For groups on external providers only (for example, Active Directory or LDAP), pass:

  - The *EmailAddress* parameter and provide the group in the format *group@domain*, where *group* is the group name and *domain* is configured for an external auth provider on the cluster (LDAP, NIS).
  - The *Type* parameter and provide *GroupLoginName* as its value.

> [!NOTE]
> **Notice**
> 
> Specifying a group by its GroupLoginName is supported starting with VAST Cluster 5.3.3.
- For any groups (including groups on the local provider), pass:

  - The ID parameter and provide the group's VID as its value.

> [!TIP]
> **Tip**
> 
> A VID is a VAST ID used in the cluster's internal user database.
  - The *Type* parameter and provide *CanonicalUser* as its value.

To grant permission to a predefined group, specify *Group* as the 'Type' and pass the group's URI as the 'URI':

- For the All Users group: 'http://acs.amazonaws.com/groups/global/AllUsers'
- For the Authenticated Users group: 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'

## Examples

In this example, a user with VID 3 is granted full control permission to the object *my_object* in the bucket *my_bucket* owned by *JDoe* whose VID is 2.

```plaintext
response = client.put_object_acl(
      AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'ID': '3',
                    'Type': 'CanonicalUser',
                },
                'Permission': 'FULL_CONTROL'
            },
        ],
        'Owner': {
            'DisplayName': 'JDoe',
            'ID': '2'
        }
    },
    Bucket='my_bucket',
    Key='my_object',
)
```

In this example, a group identified with an email address of `mygroup@domain.com` is granted READ permission to the object *my_object* in the bucket *my_bucket* owned by *JDoe* whose VID is 2.

```plaintext
response = client.put_object_acl(
    AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'Type': 'GroupLoginName',
                    'EmailAddress': 'mygroup@domain.com'
                },
                'Permission': 'READ'
            },
        ],
        'Owner': {
            'DisplayName': 'JDoe',
            'ID': '2'
        }
    },
    Bucket='my_bucket',
    Key='my_object',
)
```

In this example, the predefined AUTHENTICATED_USERS group is granted WRITE permission to the object *my_object* in the bucket *my_bucket* owned by *JDoe* whose VID is 2.

```plaintext
response = client.put_object_acl(
    AccessControlPolicy={
        'Grants': [
            {
                'Grantee': {
                    'Type': 'Group',
                    'URI': 'http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
                },
                'Permission': 'WRITE'
            },
        ],
        'Owner': {
            'DisplayName': 'JDoe',
            'ID': '2'
        }
    },
    Bucket='my_bucket',
    Key='my_object',
)
```