S3 / Client / get_bucket_acl
get_bucket_acl#
- S3.Client.get_bucket_acl(**kwargs)#
Note
This operation is not supported by directory buckets.
This implementation of the
GET
action uses theacl
subresource to return the access control list (ACL) of a bucket. To useGET
to return the ACL of the bucket, you must have theREAD_ACP
access to the bucket. IfREAD_ACP
permission is granted to the anonymous user, you can return the ACL of the bucket without using an authorization header.When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code
InvalidAccessPointAliasError
is returned. For more information aboutInvalidAccessPointAliasError
, see List of Error Codes.Note
If your bucket uses the bucket owner enforced setting for S3 Object Ownership, requests to read ACLs are still supported and return the
bucket-owner-full-control
ACL with the owner being the account that created the bucket. For more information, see Controlling object ownership and disabling ACLs in the Amazon S3 User Guide.The following operations are related to
GetBucketAcl
:See also: AWS API Documentation
Request Syntax
response = client.get_bucket_acl( Bucket='string', ExpectedBucketOwner='string' )
- Parameters:
Bucket (string) –
[REQUIRED]
Specifies the S3 bucket whose ACL is being requested.
When you use this API operation with an access point, provide the alias of the access point in place of the bucket name.
When you use this API operation with an Object Lambda access point, provide the alias of the Object Lambda access point in place of the bucket name. If the Object Lambda access point alias in a request is not valid, the error code
InvalidAccessPointAliasError
is returned. For more information aboutInvalidAccessPointAliasError
, see List of Error Codes.ExpectedBucketOwner (string) – The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code
403 Forbidden
(access denied).
- Return type:
dict
- Returns:
Response Syntax
{ 'Owner': { 'DisplayName': 'string', 'ID': 'string' }, 'Grants': [ { 'Grantee': { 'DisplayName': 'string', 'EmailAddress': 'string', 'ID': 'string', 'Type': 'CanonicalUser'|'AmazonCustomerByEmail'|'Group', 'URI': 'string' }, 'Permission': 'FULL_CONTROL'|'WRITE'|'WRITE_ACP'|'READ'|'READ_ACP' }, ] }
Response Structure
(dict) –
Owner (dict) –
Container for the bucket owner’s display name and ID.
DisplayName (string) –
Container for the display name of the owner. This value is only supported in the following Amazon Web Services Regions:
US East (N. Virginia)
US West (N. California)
US West (Oregon)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
Note
This functionality is not supported for directory buckets.
ID (string) –
Container for the ID of the owner.
Grants (list) –
A list of grants.
(dict) –
Container for grant information.
Grantee (dict) –
The person being granted permissions.
DisplayName (string) –
Screen name of the grantee.
EmailAddress (string) –
Email address of the grantee.
Note
Using email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:
US East (N. Virginia)
US West (N. California)
US West (Oregon)
Asia Pacific (Singapore)
Asia Pacific (Sydney)
Asia Pacific (Tokyo)
Europe (Ireland)
South America (São Paulo)
For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.
ID (string) –
The canonical user ID of the grantee.
Type (string) –
Type of grantee
URI (string) –
URI of the grantee group.
Permission (string) –
Specifies the permission given to the grantee.