> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# Bucket ACL

The bucket ACL controls who can **see the file list** of a bucket (names, sizes, dates) and who can **upload, overwrite and delete** files in it. It does not control downloads — each file has its own [object ACL](/access/object-acl). For how the two fit together, see [Access control](/access/access-control).

## Where to find it

Open the bucket, select **Bucket Settings**, and expand **Access Control**.

![Bucket Settings with the Access Control section open, showing the Private, Public read and Authenticated User cards and the collapsed Allow others to upload row](/_fern-img/c456d93dd54379ceab5010ee880164dbdff7e7da61157739bd69c51b7b254238.webp)

## The five settings

A bucket uses one setting at a time. The current one is marked **Active** and its button reads **Current setting**.

| Setting                             | Who can see the file list               | Who can upload, overwrite and delete | Confirmation                                      |
| ----------------------------------- | --------------------------------------- | ------------------------------------ | ------------------------------------------------- |
| **Private** (default)               | Only you                                | Only you                             | None                                              |
| **Public read**                     | Anyone on the internet, no sign-in      | Only you                             | **Allow listing**                                 |
| **Authenticated User**              | Any signed-in Zata user, in any account | Only you                             | **Allow access**                                  |
| **Public read + write**             | Anyone on the internet                  | Anyone on the internet               | Type the bucket name, then **Allow write access** |
| **Authenticated User read + write** | Any signed-in Zata user                 | Any signed-in Zata user              | Type the bucket name, then **Allow write access** |

> **Warning**
>
> **Authenticated User** is not "my team". It includes every Zata account, even people who signed up on their own. To share with specific people, use [sub-users](/sub-users/overview).

## Change the setting

#### Choose a setting

In **Access Control**, select **Apply** on the **Private**, **Public read** or **Authenticated User** card. For the write settings, see [Let others upload](#let-others-upload).

#### Confirm

For **Public read** and **Authenticated User**, a dialog explains what will change. Select **Allow listing** or **Allow access**. **Private** is applied straight away.

#### Check the result

The card is now marked **Active** and a message confirms the change, for example *Bucket access set to "Public read"*.

### Public bucket URL

With **Public read** or **Public read + write**, a **Public bucket URL** row appears with buttons to copy or open the link:

```text
https://bom01.zata.ai/my-bucket/
```

Use `idr01` instead of `bom01` for a bucket in Indore. The URL returns the file list. A single file's URL (`https://bom01.zata.ai/my-bucket/myfile.txt`) works only after you [make that file public](/access/object-acl).

![Public read marked Active, with the Public bucket URL row showing the bucket link and copy and open buttons](/_fern-img/15cfe987ff14ee5bfaf80df2ef07f6f9b326d92bf27397068a1dd81230d36983.webp)

## Let others upload

The two write settings sit inside the collapsed **Allow others to upload** row, below the cards. The **Write access** line shows **Off** (only you can add, replace or delete files) or **On** (and who else can).

![The Allow others to upload row expanded, with Write access Off and Apply buttons for Public read + write and Authenticated User read + write](/_fern-img/2d321ef9a13d1c79aeaca8209ed6be2dab3774bf11681a5349c0ee1c399e245a.webp)

> **Warning**
>
> Upload, overwrite and delete are one S3 permission — there is no upload-only ACL. Anyone you let upload can also replace and permanently delete your files, and you pay for what they store and download. Turn on [versioning](/buckets/bucket-settings) first if you need to recover overwritten files. To allow uploads without deletes, use a [bucket policy](/access/bucket-policies) or a [sub-user](/sub-users/overview) instead.

To turn write access on:

#### Choose a write setting

Expand **Allow others to upload** and select **Apply** on **Public read + write** or **Authenticated User read + write**.

#### Confirm with the bucket name

The dialog lists what others will be able to do. Type the bucket name exactly, then select **Allow write access**.

![The Allow anyone on the internet to write? dialog listing upload, overwrite, delete and billing risks, with a field to type the bucket name](/_fern-img/1a280db0e81ea60636013a9e2f15984f2d9b7d353d19da169440faf7a3d8dc65.webp)

**Write access** now shows **On**, and the row explains who can write.

![Write access On, with Public read + write marked Active and a Make private button](/_fern-img/7f57bd48008c68132e13db894fc5713e8a61fbd757267995bb8261aef3cb269e.webp)

To turn it off, select **Make private** on the **Write access** line. This sets the whole bucket back to **Private** — both listing and writing. Apply **Public read** again afterwards if you still want a public file list.

## Good to know

* Changing the bucket ACL never changes your files' own settings. A file you made public stays public until you make it private.
* New uploads are always private, even in a **Public read** bucket.
* If the bucket has custom grants that none of the five settings describe, the console warns you. Applying a setting replaces those grants.
* A **Deny** rule in a bucket policy overrides the ACL. See [ACLs and bucket policies](/access/access-control#acls-and-bucket-policies).
* Turning a setting off stops further access, but does not undo anything already uploaded or deleted.