Docs

Torch Object Storage

ACLs

Configuring object ACLs

You can use the TOS console to set ACL permissions for an object.

Background information

You can set ACL permissions either when uploading an object or after the object has been uploaded. The following object access permissions are available:

Inherit bucket: An object inherits the permissions from its bucket, meaning the object's ACL will mirror the bucket's. For details on the relationship between object ACL and bucket ACL, see Managing object permissions using bucket ACLs.

Private (Default): Only the object owner and authorized accounts have read and write permissions. This is the recommended setting.

Public read: All users, including those making anonymous requests, can read the object. However, only the owner and authorized accounts can modify it.

Public read/write: All users, including those making anonymous requests, can have full read and write access to the object.

warning

Objects with Public read permissions are exposed on the public network. Anyone can read these objects, which incurs data transfer costs and may result in property loss or data leakage. Therefore, we recommend setting the access permission policy to Private.

Object ACLs take precedence over bucket ACLs. For example, if the ACL for an object is set to "private," then even if the bucket ACL is set to "public read," only the object owner and authorized accounts will have read and write access.

Modifying an object's ACL

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

On the Objects page, select ··· > Modify Access Permission in the Actions column of the object you want to manage.

In the box that appears, select the desired Access permission. Then, click Save.

Enabling objects to automatically apply bucket ACL

Enabling objects to automatically apply bucket ACL means that newly uploaded objects will automatically inherit the bucket's ACL. This change will not affect the ACLs of objects that were uploaded prior to this update.

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket ACLs.

At the bottom of the Bucket ACLs page, toggle on the Upload Object ACL Default Policy switch.

tip

You can disable this feature on the Bucket ACLs page. After disabling it, the default ACLs for newly uploaded objects will be private.

You also can enable this feature when creating a bucket. For instructions, see Creating buckets.

Last updated: 2026.08.18 18:07:12