> ## Documentation Index
> Fetch the complete documentation index at: https://gcore-doc-1894.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure access control on S3 storage with AWS CLI and S3cmd

Gcore Object Storage access control uses two mechanisms: ACLs for object and bucket-level permissions, and JSON policies for more granular rules. Both are configured through AWS CLI or S3cmd.

## ACLs

ACLs (Access Control Lists) define who can access objects and what operations they can perform. They protect stored data by controlling read, write, and delete permissions at the object and bucket level.

<Info>
  The storage owner configures ACLs using [AWS CLI](https://docs.aws.amazon.com/cli/latest/reference/s3api/index.html#cli-aws-s3api) or [S3cmd](https://s3tools.org/usage) commands.
</Info>

The following ACL flags are available for AWS CLI (`aws s3api put-object-acl` or `put-bucket-acl`) and S3cmd (`s3cmd setacl`):

| AWS CLI              | S3cmd                    | Description                                              |
| -------------------- | ------------------------ | -------------------------------------------------------- |
| --public-read        | --acl-public             | Making an object publicly accessible                     |
| --private            | --acl-private            | Making an object private                                 |
| --grant-full-control | --acl-grant=full-control | Granting full control over the bucket                    |
| --grant-read         | --acl-grant=read         | Allowing the listing of objects in the bucket            |
| --grant-read-acp     | --acl-grant=read\_acp    | Allowing the reading of ACLs                             |
| --grant-write        | --acl-grant=write        | Allowing recording, overwriting, and deleting of objects |

## Policies

Policies are JSON documents that define access rules at a granular level — specifying which actions a user or all users can perform on objects and buckets. The maximum policy size is 20 KB.

<Note>The storage owner configures policies. The [AWS reference](https://docs.aws.amazon.com/AmazonS3/latest/userguide/list_amazons3.html) lists all supported S3 actions, conditions, and resource types.</Note>

## Configure access via ACLs and policies

All commands use AWS CLI and S3cmd interchangeably — choose whichever is already configured on the system.

In all commands and JSON files, replace the following placeholders:

* `sample.jpg` — the object name.
* `my_bucket` — the bucket name.
* `s-ed1.cloud.gcore.lu` — the storage hostname from the Details dialog; the [service URLs](/storage/manage-object-storage/s3-service-urls-and-default-region-names) reference lists all location endpoints.

### Public object access via ACL

To allow all users to download an object, apply the `public-read` ACL (`--acl public-read` in AWS CLI or `--acl-public` in S3cmd).

AWS CLI:

```sh theme={null}
aws s3api put-object-acl --bucket my_bucket --key sample.jpg --acl public-read --endpoint-url=https://s-ed1.cloud.gcore.lu
```

S3cmd:

```sh theme={null}
s3cmd setacl s3://my_bucket/sample.jpg --acl-public
```

The specified object becomes publicly accessible to all users.

### Bucket listing via ACL

To allow all users to list objects in a bucket, apply the `public-read` ACL to the bucket.

AWS CLI:

```sh theme={null}
aws s3api put-bucket-acl --bucket my_bucket --acl public-read --endpoint-url=https://s-ed1.cloud.gcore.lu
```

S3cmd:

```sh theme={null}
s3cmd setacl s3://my_bucket/ --acl-grant=read
```

Users can list objects in the bucket but cannot read or write individual objects without additional object-level ACLs.

### Public object access via policy

<Steps>
  <Step title="Create the policy file">
    Create a JSON file with the following policy:

    ```json theme={null}
    {
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my_bucket/*"
        }
      ]
    }
    ```
  </Step>

  <Step title="Apply the policy">
    Apply the policy to the bucket.

    AWS CLI:

    ```sh theme={null}
    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket
    ```

    S3cmd:

    ```sh theme={null}
    s3cmd setpolicy policy.json s3://my_bucket/
    ```

    All objects in the bucket become publicly accessible for download.

    <Note>This policy grants direct file access but does not allow listing the files in the bucket.</Note>
  </Step>
</Steps>

### Directory access denial via policy

<Steps>
  <Step title="Create the policy file">
    Create a JSON file that allows public read on the bucket but denies access to the `secret/` directory:

    ```json theme={null}
    {
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my_bucket/*"
        },
        {
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my_bucket/secret/*"
        }
      ]
    }
    ```
  </Step>

  <Step title="Apply the policy">
    Apply the policy to the bucket.

    AWS CLI:

    ```sh theme={null}
    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket
    ```

    S3cmd:

    ```sh theme={null}
    s3cmd setpolicy policy.json s3://my_bucket/
    ```
  </Step>
</Steps>

### IP-based access via policy

A bucket policy can also limit anonymous access by source IP address or CIDR range. Use a positive Allow statement with an `IpAddress` condition, because Deny with `NotIpAddress` does not restrict traffic on Gcore Object Storage.

These conditions apply to anonymous requests, while authenticated owner credentials retain their normal permissions.

<Warning>
  Keep bucket and object ACLs private, and do not combine this policy with another statement that grants broader anonymous access. `s3:*` grants every S3 operation from the permitted source, including writes and deletes.
</Warning>

Replace the example IP addresses with the source IPs that should be allowed. The condition matches the client address seen by Object Storage for virtual-hosted and path-style requests, so a client-supplied `X-Forwarded-For` header cannot bypass the restriction.

<Steps>
  <Step title="Create the policy file">
    Create a JSON file using one of the following patterns.

    Grant every S3 operation from one IPv4 address:

    ```json theme={null}
    {
      "Statement": [
        {
          "Sid": "IPAllow",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::my_bucket",
            "arn:aws:s3:::my_bucket/*"
          ],
          "Condition": {
            "IpAddress": {
              "aws:SourceIp": "203.0.113.10/32"
            }
          }
        }
      ]
    }
    ```

    To allow the same operations from two IPv4 addresses, list both in `aws:SourceIp`:

    ```json theme={null}
    {
      "Statement": [
        {
          "Sid": "IPAllow",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::my_bucket",
            "arn:aws:s3:::my_bucket/*"
          ],
          "Condition": {
            "IpAddress": {
              "aws:SourceIp": [
                "203.0.113.10/32",
                "203.0.113.20/32"
              ]
            }
          }
        }
      ]
    }
    ```

    Grant the same operations from two CIDR networks:

    ```json theme={null}
    {
      "Statement": [
        {
          "Sid": "NetworkAllow",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:*",
          "Resource": [
            "arn:aws:s3:::my_bucket",
            "arn:aws:s3:::my_bucket/*"
          ],
          "Condition": {
            "IpAddress": {
              "aws:SourceIp": [
                "192.0.2.0/24",
                "198.51.100.0/24"
              ]
            }
          }
        }
      ]
    }
    ```

    Allow anonymous object downloads from one IPv4 address, while ListBucket and writes remain denied:

    ```json theme={null}
    {
      "Statement": [
        {
          "Sid": "IPAllowGetObject",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::my_bucket/*",
          "Condition": {
            "IpAddress": {
              "aws:SourceIp": "203.0.113.10/32"
            }
          }
        }
      ]
    }
    ```
  </Step>

  <Step title="Apply the policy">
    Apply the policy to the bucket.

    AWS CLI:

    ```sh theme={null}
    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket
    ```

    S3cmd:

    ```sh theme={null}
    s3cmd setpolicy policy.json s3://my_bucket/
    ```

    Requests from an allowed source return HTTP 200, while requests from any other source return HTTP 403.
  </Step>
</Steps>

### Referrer-based access via policy

<Steps>
  <Step title="Create the policy file">
    Create a JSON file that restricts access to requests originating from specific websites. Replace `http://www.example.com/` and `http://example.com/` with the actual URLs:

    ```json theme={null}
    {
      "Statement": [
        {
          "Sid": "Allow get requests originating from www.example.com and example.com.",
          "Effect": "Allow",
          "Principal": "*",
          "Action": ["s3:GetObject", "s3:GetObjectVersion"],
          "Resource": "arn:aws:s3:::my_bucket/*",
          "Condition": {
            "StringLike": {"aws:Referer": ["http://www.example.com/*", "http://example.com/*"]}
          }
        }
      ]
    }
    ```
  </Step>

  <Step title="Apply the policy">
    Apply the policy to the bucket.

    AWS CLI:

    ```sh theme={null}
    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket
    ```

    S3cmd:

    ```sh theme={null}
    s3cmd setpolicy policy.json s3://my_bucket/
    ```
  </Step>
</Steps>

### User access grant via policy

<Steps>
  <Step title="Create the policy file">
    Create a JSON file that grants a specific user read and list access. Replace `1234-test` with the storage username from the Details dialog:

    ```json theme={null}
    {
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": ["arn:aws:iam:::user/1234-test"]
          },
          "Action": ["s3:GetObject", "s3:ListBucket"],
          "Resource": ["arn:aws:s3:::my_bucket/*", "arn:aws:s3:::my_bucket"]
        }
      ]
    }
    ```
  </Step>

  <Step title="Apply the policy">
    Apply the policy to the bucket.

    AWS CLI:

    ```sh theme={null}
    aws s3api put-bucket-policy --policy file://policy.json --endpoint-url=https://s-ed1.cloud.gcore.lu --bucket my_bucket
    ```

    S3cmd:

    ```sh theme={null}
    s3cmd setpolicy policy.json s3://my_bucket/
    ```
  </Step>
</Steps>