Access control (ACL)

Every bucket and file starts private: only you can see or change it. Zata gives you several ways to open things up. This page helps you pick the right one and explains how the two ACL settings work together.

Pick the right tool

You want to…	Use	Where
Let anyone download one file, with a link that never expires	Object ACL → Make public	The file’s Actions (⋮) menu
Share one file for a limited time	Presigned URL	The file’s Share option
Let anyone see the list of file names in a bucket	Bucket ACL → Public read	Bucket Settings → Access Control
Let anyone list and download every file in a bucket	Public Access toggle (writes a bucket policy)	Bucket Settings → Security & Access
Give a person or app its own key, limited to chosen buckets or folders	Sub-user	Subusers
Allow or deny single actions, for one folder or the whole bucket	Bucket policy	Policies

Only the account owner can change ACLs. Sub-users cannot make a bucket or a file public.

Bucket ACL and object ACL

The two ACL settings do different jobs, and changing one never changes the other:

The bucket ACL decides who can see the list of files in a bucket, and who can upload, overwrite and delete files.
The object ACL decides who can download one particular file.

So a public bucket does not make its files downloadable, and a public file does not show the rest of the bucket. To let visitors browse and download, turn on both.

Here is what a visitor without a Zata account can do:

Bucket ACL	File ACL	Can they see the file list?	Can they download the file?
Private	Private	No	No
Private	Public	No	Yes, with the link
Public read	Private	Yes	No
Public read	Public	Yes	Yes
Authenticated User	Private or Public	No (only signed-in Zata users can)	Only if the file is public

The two write settings (Public read + write and Authenticated User read + write) behave like their read-only versions, and also let others upload, overwrite and delete. See Bucket ACL.

Authenticated User means any signed-in Zata account, including strangers — not only people in your company. To share with your team, use sub-users.

ACLs and bucket policies

Zata checks both the ACL and the bucket policy. An explicit Deny in a bucket policy always wins over an ACL that allows access. If you make a bucket or file public and it still says access denied, look for a Deny rule on the Policies page or under Bucket Settings → Security & Access.

Good to know

A public file list shows your file names to everyone. File names often contain customer or project names, so keep the list private unless you need it public.
Public downloads and listings count towards your egress. See Ingress and egress.
Public links stop working while your account is suspended.
Making something private again stops further access, but does not undo uploads or deletes that already happened.

If you use the S3 API

The console options match the standard S3 canned ACLs:

Console option	S3 canned ACL
Private	`private`
Public read	`public-read`
Authenticated User	`authenticated-read`
Public read + write	`public-read-write`
Authenticated User read + write	No canned name — READ and WRITE granted to the `AuthenticatedUsers` group

In S3, READ on a bucket means “list the files”, while READ on a file means “download it”. That is why the bucket and the file each need their own setting. WRITE exists only on a bucket and always covers upload, overwrite and delete together — there is no upload-only ACL.