> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Access control (ACL)

Every bucket and file starts private: only you can see or change it. Zata gives you several ways to open things up. This page helps you pick the right one and explains how the two ACL settings work together.

## Pick the right tool

| You want to…                                                           | Use                                                | Where                                       |
| ---------------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------- |
| Let anyone download one file, with a link that never expires           | [Object ACL](/access/object-acl) → **Make public** | The file's **Actions** (⋮) menu             |
| Share one file for a limited time                                      | [Presigned URL](/buckets/share-a-file)             | The file's **Share** option                 |
| Let anyone see the list of file names in a bucket                      | [Bucket ACL](/access/bucket-acl) → **Public read** | **Bucket Settings** → **Access Control**    |
| Let anyone list and download every file in a bucket                    | **Public Access** toggle (writes a bucket policy)  | **Bucket Settings** → **Security & Access** |
| Give a person or app its own key, limited to chosen buckets or folders | [Sub-user](/sub-users/overview)                    | **Subusers**                                |
| Allow or deny single actions, for one folder or the whole bucket       | [Bucket policy](/access/bucket-policies)           | **Policies**                                |

Only the account owner can change ACLs. Sub-users cannot make a bucket or a file public.

## Bucket ACL and object ACL

The two ACL settings do different jobs, and changing one never changes the other:

* The **bucket ACL** decides who can **see the list of files** in a bucket, and who can **upload, overwrite and delete** files.
* The **object ACL** decides who can **download** one particular file.

So a public bucket does not make its files downloadable, and a public file does not show the rest of the bucket. To let visitors browse **and** download, turn on both.

Here is what a visitor **without** a Zata account can do:

| Bucket ACL         | File ACL          | Can they see the file list?        | Can they download the file? |
| ------------------ | ----------------- | ---------------------------------- | --------------------------- |
| Private            | Private           | No                                 | No                          |
| Private            | Public            | No                                 | Yes, with the link          |
| Public read        | Private           | Yes                                | No                          |
| Public read        | Public            | Yes                                | Yes                         |
| Authenticated User | Private or Public | No (only signed-in Zata users can) | Only if the file is public  |

The two write settings (**Public read + write** and **Authenticated User read + write**) behave like their read-only versions, and also let others upload, overwrite and delete. See [Bucket ACL](/access/bucket-acl#let-others-upload).

> **Warning**
>
> **Authenticated User** means *any* signed-in Zata account, including strangers — not only people in your company. To share with your team, use [sub-users](/sub-users/overview).

## ACLs and bucket policies

Zata checks both the ACL and the bucket policy. An explicit **Deny** in a bucket policy always wins over an ACL that allows access. If you make a bucket or file public and it still says access denied, look for a Deny rule on the **Policies** page or under **Bucket Settings** → **Security & Access**.

## Good to know

* A public file list shows your file names to everyone. File names often contain customer or project names, so keep the list private unless you need it public.
* Public downloads and listings count towards your egress. See [Ingress and egress](/account/ingress-and-egress).
* Public links stop working while your account is suspended.
* Making something private again stops further access, but does not undo uploads or deletes that already happened.

## If you use the S3 API

The console options match the standard S3 canned ACLs:

| Console option                      | S3 canned ACL                                                             |
| ----------------------------------- | ------------------------------------------------------------------------- |
| **Private**                         | `private`                                                                 |
| **Public read**                     | `public-read`                                                             |
| **Authenticated User**              | `authenticated-read`                                                      |
| **Public read + write**             | `public-read-write`                                                       |
| **Authenticated User read + write** | No canned name — READ and WRITE granted to the `AuthenticatedUsers` group |

In S3, READ on a bucket means "list the files", while READ on a file means "download it". That is why the bucket and the file each need their own setting. WRITE exists only on a bucket and always covers upload, overwrite and delete together — there is no upload-only ACL.