---
title: "Set Bucket ACL"
slug: "set-bucket-acl-s3cmd-tg"
tags: ["5.4"]
updated: 2026-10-28T01:54:14Z
published: 2026-10-28T01:54:14Z
canonical: "docs.vastdata.com/set-bucket-acl-s3cmd-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Bucket ACL

Before setting ACL permissions, we recommend you read [Managing S3 Access Control Lists (ACLs)](/docs-5-4/docs/en/managing-s3-access-control-lists-acls-tg).

```plaintext
s3cmd [-c CONFIGFILE] setacl s3://BUCKET[/OBJECT] [--acl-grant=PERMISSION:{USER|GROUP}] [--acl-revoke=PERMISSION:{USER_VAST_ID|GROUP}]
```

| CONFIGFILE | Configuration file. Defaults to $HOME/s3cf |
| --- | --- |
| BUCKET | Name of bucket |
| --acl-grant | Grant stated permission for stated user or group. |
| --acl-revoke | Revoke stated permission for stated user or group |
| PERMISSION | Type of permission to grant: - read - write - read_acp - write_acp - full_control - all |
| USER | A user to which you want to grant the permission. Can be specified as: . - A principal name in the format *user@domain*, where *user* is the user name and *domain* is configured for an external auth provider on the cluster (LDAP, NIS). > [!NOTE] > **Note** > > Users on the VAST provider cannot be specified this way. - A VID, which is a VAST ID used in the cluster's internal user database. |
| GROUP | A group to which you want to grant the permission. The group can be specified as follows: - Set the type to *GroupLoginName* and specify the group in the format *group@domain*, where *group* is the group name and *domain* is configured for an external auth provider on the cluster (such as LDAP). - Specify the group's VID, which is the VAST ID used in the cluster's internal user database. If you want to grant permissions to an S3 predefined group, specify one of the following: - `http://acs.amazonaws.com/groups/global/AllUsers`, or - `http://acs.amazonaws.com/groups/global/AuthenticatedUsers` |

## Examples

Grant read permissions for bucket *mybbucket* to group *mygroup@domain.com*:

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant=read:'groupLoginName=mygroup@domain.com'
```

Grant full control to the predefined group *AuthenticatedUsers* to access the bucket *mybucket*.

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='full_control:http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
```

Grant read permission to the predefined *AllUsers* group to access the bucket *mybucket*.

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='read:http://acs.amazonaws.com/groups/global/AllUsers'
```

Grant user with VAST ID 14 write permission to the bucket *mybucket*:

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='write:14
```