> For the complete documentation index, see [llms.txt](https://docs.ionos.com/cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/managed-services/s3-object-storage/settings/access-control-list/access-control-list-objects.md).
# Manage ACL for Objects
You can manage ACL permission for objects through the web console, IONOS S3 Object Storage API, or the command-line tool.
## ACL permission for objects
The following table shows the ACL permissions that you can configure for objects in a bucket in the IONOS S3 Object Storage.
| **User** | **Console permission** | **ACL permission** | **Access granted** |
| :-----------------: | :--------------------: | :----------------: | :--------------------------------------------------------------------------------------------------------------------------------: |
| Bucket Owner | Objects - Read | READ | Allows grantee to read the object data and its metadata. |
| Bucket Owner | Object ACL - Read | READ\_ACP | Grants the ability to read the object ACL. |
| Bucket Owner | Object ACL - Write | WRITE\_ACP | Allows the grantee to write the ACL of the applicable object. |
| Public access | Objects - Read | READ | Grants public read access for the objects in the bucket. Anyone can access the objects in the bucket. |
| Public access | Object ACL - Read | READ\_ACP | Grants public read access for the object ACL. Anyone can access the object ACL. |
| Authenticated users | Objects - Read | READ | Grants read access to objects in the bucket to anyone with an IONOS account using which they can access the objects in the bucket. |
| Authenticated users | Object ACL - Read | Read\_ACP | Grants read access to object ACL to anyone with an IONOS account. |
These permissions are applied at individual object levels within a bucket, offering a high level of granularity in access control.
{% hint style="info" %}
**Note:** For security, granting some of the access permissions such as **Public access** `WRITE_ACP` and **Authenticated users** `WRITE_ACP` is possible only through an API Call.
{% endhint %}
## web console
To manage ACL for objects using the web console, follow these steps:
1\. In the **DCD**, go to **Menu** > **Storage** > **IONOS S3 Object Storage**.
2\. From the **Buckets** list, choose the bucket under which the object ACL to be modified exists.
3\. From the **Objects** list, choose the object for which ACL permissions are to be modified.
4\. From the **Object Settings**, click **Access Control List (ACL)**.
5\. Select the checkboxes against the access permissions to grant at each user level such as bucket owner, public access, and authenticated users. For more information, see [ACL permission for objects](#acl-permission-for-objects).
6\. Add grantees to provide additional users with access permission to the object. For more information, see [Add grantees for objects](#add-grantees-for-objects).
7\. Click **Save** to apply the ACL settings to the object.
{% hint style="success" %}
**Result:** The object ACL permissions are successfully applied to the object.
{% endhint %}
### Add grantees for objects
{% hint style="info" %}
**Prerequisites:**
* Make sure the canonical user ID of the grantee is known. To retrieve the ID, see [Object Lock](/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/managed-services/s3-object-storage/settings/object-lock.md).
* The grantee should already exist. If not, create a user and retrieve the Canonical user ID by following the steps in [Retrieve the Canonical User ID of a new user](/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/managed-services/s3-object-storage/how-tos/retrieve-user-ids.md#retrieve-the-canonical-user-id-of-a-new-user).
{% endhint %}
1\. In the **DCD**, go to **Menu** > **Storage** > **IONOS S3 Object Storage**.
2\. From the **Buckets** list, choose the bucket under which the object ACL to be modified exists.
3\. From the **Objects** list, choose the object for which you want to add the grantee.
4\. In the **Additional Grantees** section, enter the retrieved Canonical user ID of the grantee, select the checkboxes on the ACL permissions to grant, and click **Add**. For ACL permissions, see [ACL permission for objects](#acl-permission-for-objects).
5\. Add any number of grantees to the object by following step 4.
6\. Click **Save** to add the additional grantees with corresponding ACL permissions to the object.
{% hint style="success" %}
**Result:** The grantees are successfully added to the object.
{% endhint %}
## IONOS S3 Object Storage API
Use the [PutObjectAcl](https://api.ionos.com/docs/s3/v2/#tag/ACL/operation/PutObjectAcl) Object Storage API to manage object ACL permissions.
## Command-line tool
Use [CLI](/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/managed-services/s3-object-storage/s3-tools/awscli/awscli-acl-objects.md) to manage ACL permission for objects.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ionos.com/cloud/~/revisions/bM7yG7XCmGE9IxWqMpBu/managed-services/s3-object-storage/settings/access-control-list/access-control-list-objects.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.