Setting access policy with SOAP - Amazon Simple Storage Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Setting access policy with SOAP


SOAP support over HTTP is deprecated, but SOAP is still available over HTTPS. New Amazon S3 features are not supported for SOAP. Instead of using SOAP, we recommend that you use either the REST API or the Amazon SDKs.

Access control can be set at the time a bucket or object is written by including the "AccessControlList" element with the request to CreateBucket, PutObjectInline, or PutObject. The AccessControlList element is described in Identity and Access Management for Amazon S3. If no access control list is specified with these operations, the resource is created with a default access policy that gives the requester FULL_CONTROL access (this is the case even if the request is a PutObjectInline or PutObject request for an object that already exists).

Following is a request that writes data to an object, makes the object readable by anonymous principals, and gives the specified user FULL_CONTROL rights to the bucket (Most developers will want to give themselves FULL_CONTROL access to their own bucket).


Following is a request that writes data to an object and makes the object readable by anonymous principals.

Sample Request

<PutObjectInline xmlns=""> <Bucket>quotes</Bucket> <Key>Nelson</Key> <Metadata> <Name>Content-Type</Name> <Value>text/plain</Value> </Metadata> <Data>aGEtaGE=</Data> <ContentLength>5</ContentLength> <AccessControlList> <Grant> <Grantee xsi:type="CanonicalUser"> <ID>75cc57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID> <DisplayName>chriscustomer</DisplayName> </Grantee> <Permission>FULL_CONTROL</Permission> </Grant> <Grant> <Grantee xsi:type="Group"> <URI><URI> </Grantee> <Permission>READ</Permission> </Grant> </AccessControlList> <AWSAccessKeyId>AKIAIOSFODNN7EXAMPLE</AWSAccessKeyId> <Timestamp>2009-03-01T12:00:00.183Z</Timestamp> <Signature>Iuyz3d3P0aTou39dzbqaEXAMPLE=</Signature> </PutObjectInline>

Sample Response

<PutObjectInlineResponse xmlns=""> <PutObjectInlineResponse> <ETag>&quot828ef3fdfa96f00ad9f27c383fc9ac7f&quot</ETag> <LastModified>2009-01-01T12:00:00.000Z</LastModified> </PutObjectInlineResponse> </PutObjectInlineResponse>

The access control policy can be read or set for an existing bucket or object using the GetBucketAccessControlPolicy, GetObjectAccessControlPolicy, SetBucketAccessControlPolicy, and SetObjectAccessControlPolicy methods. For more information, see the detailed explanation of these methods.