Managing ACLs Using the AWS SDK for Java

This section provides examples of how to configure access control list (ACL) grants on buckets and objects. The first example creates a bucket with a canned ACL (see Canned ACL), creates a list of custom permission grants, and then replaces the canned ACL with an ACL containing the custom grants. The second example shows how to modify an ACL using the AccessControlList.grantPermission() method.

Setting ACL Grants

Example
This example creates a bucket. In the request, the example specifies a canned ACL that grants the Log Delivery group permission to write logs to the bucket.

import com.amazonaws.AmazonServiceException;

import com.amazonaws.SdkClientException;

import com.amazonaws.regions.Regions;

import com.amazonaws.services.s3.AmazonS3;

import com.amazonaws.services.s3.AmazonS3ClientBuilder;

import com.amazonaws.services.s3.model.*;

import java.io.IOException;

import java.util.ArrayList;

public class CreateBucketWithACL {

public static void main(String[] args) throws IOException {

Regions clientRegion = Regions.DEFAULT_REGION;

String bucketName = "*** Bucket name ***";

String userEmailForReadPermission = "*** user@example.com ***";

try {

AmazonS3 s3Client = AmazonS3ClientBuilder.standard()

.withRegion(clientRegion)

.build();

// Create a bucket with a canned ACL. This ACL will be replaced by the setBucketAcl()

// calls below. It is included here for demonstration purposes.

CreateBucketRequest createBucketRequest = new CreateBucketRequest(bucketName, clientRegion.getName())

.withCannedAcl(CannedAccessControlList.LogDeliveryWrite);

s3Client.createBucket(createBucketRequest);

// Create a collection of grants to add to the bucket.

ArrayList<Grant> grantCollection = new ArrayList<Grant>();

// Grant the account owner full control.

Grant grant1 = new Grant(new CanonicalGrantee(s3Client.getS3AccountOwner().getId()), Permission.FullControl);

grantCollection.add(grant1);

// Grant the LogDelivery group permission to write to the bucket.

Grant grant2 = new Grant(GroupGrantee.LogDelivery, Permission.Write);

grantCollection.add(grant2);

// Save grants by replacing all current ACL grants with the two we just created.

AccessControlList bucketAcl = new AccessControlList();

bucketAcl.grantAllPermissions(grantCollection.toArray(new Grant[0]));

s3Client.setBucketAcl(bucketName, bucketAcl);

// Retrieve the bucket's ACL, add another grant, and then save the new ACL.

AccessControlList newBucketAcl = s3Client.getBucketAcl(bucketName);

Grant grant3 = new Grant(new EmailAddressGrantee(userEmailForReadPermission), Permission.Read);

newBucketAcl.grantAllPermissions(grant3);

s3Client.setBucketAcl(bucketName, newBucketAcl);

} catch (AmazonServiceException e) {

// The call was transmitted successfully, but Amazon S3 couldn't process

// it and returned an error response.

e.printStackTrace();

} catch (SdkClientException e) {

// Amazon S3 couldn't be contacted for a response, or the client

// couldn't parse the response from Amazon S3.

e.printStackTrace();

}

}

}

Configuring ACL Grants on an Existing Object

Example
This example updates the ACL on an object. The example performs the following tasks:

• Retrieves an object's ACL
• Clears the ACL by removing all existing permissions
• Adds two permissions: full access to the owner, and WRITE_ACP (see What Permissions Can I Grant?) to a user identified by an email address
• Saves the ACL to the object

import com.amazonaws.AmazonServiceException;

import com.amazonaws.SdkClientException;

import com.amazonaws.auth.profile.ProfileCredentialsProvider;

import com.amazonaws.regions.Regions;

import com.amazonaws.services.s3.AmazonS3;

import com.amazonaws.services.s3.AmazonS3ClientBuilder;

import com.amazonaws.services.s3.model.AccessControlList;

import com.amazonaws.services.s3.model.CanonicalGrantee;

import com.amazonaws.services.s3.model.EmailAddressGrantee;

import com.amazonaws.services.s3.model.Permission;

import java.io.IOException;

public class ModifyACLExistingObject {

public static void main(String[] args) throws IOException {

Regions clientRegion = Regions.DEFAULT_REGION;

String bucketName = "*** Bucket name ***";

String keyName = "*** Key name ***";

String emailGrantee = "*** user@example.com ***";

try {

AmazonS3 s3Client = AmazonS3ClientBuilder.standard()

.withCredentials(new ProfileCredentialsProvider())

.withRegion(clientRegion)

.build();

// Get the existing object ACL that we want to modify.

AccessControlList acl = s3Client.getObjectAcl(bucketName, keyName);

// Clear the existing list of grants.

acl.getGrantsAsList().clear();

// Grant a sample set of permissions, using the existing ACL owner for Full Control permissions.

acl.grantPermission(new CanonicalGrantee(acl.getOwner().getId()), Permission.FullControl);

acl.grantPermission(new EmailAddressGrantee(emailGrantee), Permission.WriteAcp);

// Save the modified ACL back to the object.

s3Client.setObjectAcl(bucketName, keyName, acl);

} catch (AmazonServiceException e) {

// The call was transmitted successfully, but Amazon S3 couldn't process

// it, so it returned an error response.

e.printStackTrace();

} catch (SdkClientException e) {

// Amazon S3 couldn't be contacted for a response, or the client

// couldn't parse the response from Amazon S3.

e.printStackTrace();

}

}

}