# Control access to a bucket
Source: https://docs.infraista.com/en/data-storage/object-storage/control-access



A bucket's **Permissions** tab decides who can reach its objects without your access keys.

<Shot name="data-storage/object-storage/permissions" alt="A bucket's Permissions tab: access level, bucket policy, presigned URL and the keys with access" />

## Access level [#access-level]

| Level           | Who can read objects                                                |
| --------------- | ------------------------------------------------------------------- |
| **Private**     | Only access keys, the bucket policy and presigned URLs grant access |
| **Public read** | Anyone with a link can download any object. Writes still need a key |

Pick one and select **Save access level*&#x2A;. The bucket's actions menu (&#x2A;*⋯**) also has **Make private** and
**Allow public read**.

<Callout type="warn">
  Switching to 

  **Public read**

   makes every object in the bucket readable by anyone.
  To share a few files, use a presigned URL or a share link instead.
</Callout>

## Bucket policy [#bucket-policy]

For finer rules, write a policy in the S3 policy language. Principals are access key IDs.

1. Under **Bucket policy**, select **Use sample** to start from an example, or paste your own JSON.
2. The editor shows **Valid JSON** or **Invalid JSON** as you type.
3. Select **Save policy**. **Remove policy** deletes it.

With no policy, access keys and the access level decide who gets in.

## Presigned URLs [#presigned-urls]

A presigned URL shares one object for a limited time without making the bucket public. Unlike a
[share link](/en/data-storage/object-storage/browse-and-share-files#share-a-file-with-a-temporary-link),
it can also allow uploads.

1. Under **Presigned URL**, enter the **Object key** (its path in the bucket).
2. Under **Allow**, choose &#x2A;*Download (GET)** or &#x2A;*Upload (PUT)**.
3. Choose when it **Expires after**: **15 minutes**, **1 hour**, **24 hours** or &#x2A;*7 days (maximum)**.
4. Pick the access key to **Sign with**. Upload links need a read-write key that can reach this bucket.
5. Select **Generate URL** and copy it. Upload links are used with an HTTP `PUT`.

Anyone with the link can use it until it expires. Revoking the signing key also stops it.

## Keys with access [#keys-with-access]

**Keys with access to this bucket** lists every access key that can reach it. **Manage access keys**
opens the key list.

## Related [#related]

* [Create access keys](/en/data-storage/object-storage/create-access-keys)