On this page

Object ACLs (Access Control Lists) are used to control access to individual objects in a bucket.

By default, all objects inherit the access control settings of the bucket they are in. If a bucket is `private`, all objects in it are also `private` and vice versa.

However, you can also make individual objects `public-read` (or `private`) by setting the object ACL.

## Available ACLs

- `private`: Only those with access to the bucket can read or write the object.
- `public-read`: The object is publicly readable and can be accessed without authentication. However, only the owner of the object can write to it.

## Enabling Object ACLs

By default, object ACLs are disabled. Object ACLs can be enabled at the bucket level through the [Tigris Dashboard](https://console.storage.dev/) from the bucket settings.

For the object ACLs migration rules see the [Copying object ACLs](/content/docs/migration/#copying-object-acls/index.html).

## Applying ACLs to objects

### Publicly readable objects in a private bucket

If you have a private bucket and you want to make an object in it publicly readable, you can do so by setting the object ACL to `public-read`.

```bash
aws s3api --endpoint-url https://t3.storage.dev put-object --bucket foo-bucket --key bar-public.txt --body bar.txt --acl public-read
```

`--acl public-read` makes the object publicly viewable at `https://foo-bucket.t3.tigrisbucket.io/bar-public.txt` (or another [public bucket domain](/content/docs/buckets/public-bucket/#public-bucket-domains/index.html)). Do not use `t3.storage.dev` for serving public content.

### Private objects in a public bucket

If you have a public bucket and you want to make an object in it private, you can do so by setting the object ACL to `private`.

```bash
aws s3api --endpoint-url https://t3.storage.dev put-object --bucket foo-public-bucket --key bar-private.txt --body bar.txt --acl private
```

`--acl private` makes the object private.