GetObjectAcl - Amazon Simple Storage Service
AWS services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with AWS services in China.

GetObjectAcl

Returns the access control list (ACL) of an object. To use this operation, you must have READ_ACP access to the object.

This action is not supported by Amazon S3 on Outposts.

Versioning

By default, GET returns ACL information about the current version of an object. To return ACL information about a different version, use the versionId subresource.

The following operations are related to GetObjectAcl:

Request Syntax

GET /{Key+}?acl&versionId=VersionId HTTP/1.1 Host: Bucket.s3.amazonaws.com x-amz-request-payer: RequestPayer x-amz-expected-bucket-owner: ExpectedBucketOwner

URI Request Parameters

The request uses the following URI parameters.

Bucket

The bucket name that contains the object for which to get the ACL information.

When using this API with an access point, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this operation with an access point through the AWS SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using Access Points in the Amazon Simple Storage Service Developer Guide.

Required: Yes

Key

The key of the object for which to get the ACL information.

Length Constraints: Minimum length of 1.

Required: Yes

versionId

VersionId used to reference a specific version of the object.

x-amz-expected-bucket-owner

The account id of the expected bucket owner. If the bucket is owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.

x-amz-request-payer

Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. For information about downloading objects from requester pays buckets, see Downloading Objects in Requestor Pays Buckets in the Amazon S3 Developer Guide.

Valid Values: requester

Request Body

The request does not have a request body.

Response Syntax

HTTP/1.1 200 x-amz-request-charged: RequestCharged <?xml version="1.0" encoding="UTF-8"?> <AccessControlPolicy> <Owner> <DisplayName>string</DisplayName> <ID>string</ID> </Owner> <AccessControlList> <Grant> <Grantee> <DisplayName>string</DisplayName> <EmailAddress>string</EmailAddress> <ID>string</ID> <xsi:type>string</xsi:type> <URI>string</URI> </Grantee> <Permission>string</Permission> </Grant> </AccessControlList> </AccessControlPolicy>

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The response returns the following HTTP headers.

x-amz-request-charged

If present, indicates that the requester was successfully charged for the request.

Valid Values: requester

The following data is returned in XML format by the service.

AccessControlPolicy

Root level tag for the AccessControlPolicy parameters.

Required: Yes

Grants

A list of grants.

Type: Array of Grant data types

Owner

Container for the bucket owner's display name and ID.

Type: Owner data type

Examples

Sample Request

The following request returns information, including the ACL, of the object my-image.jpg.

GET /my-image.jpg?acl HTTP/1.1 Host: bucket.s3.<Region>.amazonaws.com Date: Wed, 28 Oct 2009 22:32:00 GMT Authorization: authorization string

Sample Response

This example illustrates one usage of GetObjectAcl.

HTTP/1.1 200 OK x-amz-id-2: eftixk72aD6Ap51TnqcoF8eFidJG9Z/2mkiDFu8yU9AS1ed4OpIszj7UDNEHGran x-amz-request-id: 318BC8BC148832E5 x-amz-version-id: 4HL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nrjfkd Date: Wed, 28 Oct 2009 22:32:00 GMT Last-Modified: Sun, 1 Jan 2006 12:00:00 GMT Content-Length: 124 Content-Type: text/plain Connection: close Server: AmazonS3 <AccessControlPolicy> <Owner> <ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID> <DisplayName>mtd@amazon.com</DisplayName> </Owner> <AccessControlList> <Grant> <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"> <ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID> <DisplayName>mtd@amazon.com</DisplayName> </Grantee> <Permission>FULL_CONTROL</Permission> </Grant> </AccessControlList> </AccessControlPolicy>

Sample Request: Getting the ACL of the specific version of an object

The following request returns information, including the ACL, of the specified version of the object, my-image.jpg.

GET /my-image.jpg?versionId=3/L4kqtJlcpXroDVBH40Nr8X8gdRQBpUMLUo&acl HTTP/1.1 Host: bucket.s3.<Region>.amazonaws.com Date: Wed, 28 Oct 2009 22:32:00 GMT Authorization: authorization string

Sample Response: Showing the ACL of the specific version

This example illustrates one usage of GetObjectAcl.

HTTP/1.1 200 OK x-amz-id-2: eftixk72aD6Ap51TnqcoF8eFidJG9Z/2mkiDFu8yU9AS1ed4OpIszj7UDNEHGran x-amz-request-id: 318BC8BC148832E5 Date: Wed, 28 Oct 2009 22:32:00 GMT Last-Modified: Sun, 1 Jan 2006 12:00:00 GMT x-amz-version-id: 3/L4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo Content-Length: 124 Content-Type: text/plain Connection: close Server: AmazonS3 <AccessControlPolicy> <Owner> <ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID> <DisplayName>mdtd@amazon.com</DisplayName> </Owner> <AccessControlList> <Grant> <Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"> <ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID> <DisplayName>mdtd@amazon.com</DisplayName> </Grantee> <Permission>FULL_CONTROL</Permission> </Grant> </AccessControlList> </AccessControlPolicy>

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: