---
title: "Set Bucket ACL"
slug: "set-bucket-acl-s3cmd"
tags: ["5.4"]
updated: 2026-10-28T01:54:03Z
published: 2026-10-28T01:54:03Z
canonical: "docs.vastdata.com/set-bucket-acl-s3cmd"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Bucket ACL

Before setting ACL permissions, we recommend you read [Managing S3 Access Control Lists (ACLs)](/docs-5-4/docs/en/managing-s3-access-control-lists-acls).

```plaintext
s3cmd [-c CONFIGFILE] setacl s3://BUCKET[/OBJECT] [--acl-grant=PERMISSION:{USER|GROUP}] [--acl-revoke=PERMISSION:{USER_VAST_ID|GROUP}]
```

| CONFIGFILE | Configuration file. Defaults to $HOME/s3cf |
| --- | --- |
| BUCKET | Name of bucket |
| --acl-grant | Grant stated permission for stated user or group. |
| --acl-revoke | Revoke stated permission for stated user or group |
| PERMISSION | Type of permission to grant: - read - write - read_acp - write_acp - full_control - all |
| USER | A user to which you want to grant the permission. Can be specified as: . - A principal name in the format *user@domain*, where *user* is the user name and *domain* is configured for an external auth provider on the cluster (LDAP, NIS). > [!NOTE] > **Note** > > Users on the VAST provider cannot be specified this way. - A VID, which is a VAST ID used in the cluster's internal user database. A user VID is retrievable by running the `user query` VAST CLI command and specify *udb* as the context of the query. The output includes the user's VID. |
| GROUP | A group to which you want to grant the permission. The group can be specified as follows: - Set the type to *GroupLoginName* and specify the group in the format *group@domain*, where *group* is the group name and *domain* is configured for an external auth provider on the cluster (such as LDAP). - Specify the group's VID, which is the VAST ID used in the cluster's internal user database. A group VID can be retrieved by running the [group query](/docs-5-4/docs/en/group-query) VAST CLI command and specify *udb* as the context of the query. The output includes the group's VID. If you want to grant permissions to an S3 predefined group, specify one of the following: - `http://acs.amazonaws.com/groups/global/AllUsers`, or - `http://acs.amazonaws.com/groups/global/AuthenticatedUsers` |

## Examples

Grant read permissions for bucket *mybbucket* to group *mygroup@domain.com*:

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant=read:'groupLoginName=mygroup@domain.com'
```

Grant full control to the predefined group *AuthenticatedUsers* to access the bucket *mybucket*.

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='full_control:http://acs.amazonaws.com/groups/global/AuthenticatedUsers'
```

Grant read permission to the predefined *AllUsers* group to access the bucket *mybucket*.

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='read:http://acs.amazonaws.com/groups/global/AllUsers'
```

Grant user with VAST ID 14 write permission to the bucket *mybucket*:

```plaintext
$ s3cmd setacl s3://mybucket --acl-grant='write:14
```