Infraista DocsDocs
Data & storageObject Storage

Control access to a bucket

Decide who can read a bucket. Switch between private and public read, write a bucket policy, and create presigned URLs to share or receive single files.

A bucket's Permissions tab decides who can reach its objects without your access keys.

A bucket's Permissions tab: access level, bucket policy, presigned URL and the keys with accessA bucket's Permissions tab: access level, bucket policy, presigned URL and the keys with access

Access level

LevelWho can read objects
PrivateOnly access keys, the bucket policy and presigned URLs grant access
Public readAnyone with a link can download any object. Writes still need a key

Pick one and select Save access level. The bucket's actions menu (⋯) also has Make private and Allow public read.

Switching to Public read makes every object in the bucket readable by anyone. To share a few files, use a presigned URL or a share link instead.

Bucket policy

For finer rules, write a policy in the S3 policy language. Principals are access key IDs.

  1. Under Bucket policy, select Use sample to start from an example, or paste your own JSON.
  2. The editor shows Valid JSON or Invalid JSON as you type.
  3. Select Save policy. Remove policy deletes it.

With no policy, access keys and the access level decide who gets in.

Presigned URLs

A presigned URL shares one object for a limited time without making the bucket public. Unlike a share link, it can also allow uploads.

  1. Under Presigned URL, enter the Object key (its path in the bucket).
  2. Under Allow, choose Download (GET) or Upload (PUT).
  3. Choose when it Expires after: 15 minutes, 1 hour, 24 hours or 7 days (maximum).
  4. Pick the access key to Sign with. Upload links need a read-write key that can reach this bucket.
  5. Select Generate URL and copy it. Upload links are used with an HTTP PUT.

Anyone with the link can use it until it expires. Revoking the signing key also stops it.

Keys with access

Keys with access to this bucket lists every access key that can reach it. Manage access keys opens the key list.

Browse and share files

Upload, download, preview and delete files in a bucket from the console, restore older versions, and share a file with a temporary link.

Bucket settings

Turn on versioning, set a size limit, add lifecycle rules that delete old objects, allow browser uploads with CORS, tag a bucket, move it to a project or delete it.

On this page

Access levelBucket policyPresigned URLsKeys with accessRelated