Access Control (ACL)
Decide who can see your file list, who can download your files and who can upload
Access Control decides who can see, download and change the things you store in Zata.ai.
There are two separate settings, and each one does a different job:
Bucket ACL — can people see the list of files in your bucket, and can they upload to it?
Object ACL — can people download a particular file?
You set them in two different places, and changing one never changes the other.
INFO Think of a bucket as a folder. The bucket setting decides whether people can look inside the folder and read the file names, and whether they can put new things in. The object setting decides whether they can actually open a file.
The one rule to remember
Making a bucket public does not make your files downloadable.
Someone can see that a file called invoice-2026.pdf exists and how big it is, but the download is refused until you make that file public too.
Making a file public does not show people the rest of your bucket.
They can open the file you shared, and nothing else.
So if you want visitors to browse your files and download them, you have to turn on both settings.
Where to find each setting
Bucket ACL
Bucket > Bucket Settings > Access Control
Who can see the list of files, and who can upload?
Object ACL
Bucket Details > Actions (⋮) > Make public / Make private
Who can download this one file?
Each one has its own page:
Bucket ACL — set your bucket to Private, Public read, Authenticated User, or one of the two write settings.
Object ACL — make a single file public or private, and copy its link.
Your choices
For a bucket, you pick one of five. The first three are read-only; the last two also let other people upload.
Private
Only you. This is the default.
Only you
Public read
Anyone on the internet, with no sign-in
Only you
Authenticated User
Anyone signed in to any Zata.ai account — not only people in your account
Only you
Public read + write
Anyone on the internet
Anyone on the internet
Authenticated User read + write
Anyone signed in to any Zata.ai account
Anyone signed in to any Zata.ai account
For a file, you pick one of two:
Private
Only you. This is the default for every upload.
Public
Anyone with the link, with no sign-in. The link never expires.
IMPORTANT The two write settings let other people overwrite and permanently delete your files, not just add new ones — upload and delete are a single S3 permission. Read Write access before you turn either one on.
What a visitor can actually do
Here is what someone with no Zata.ai account can do, for each combination of the read-only settings:
Private
Private
No
No
Private
Public
No
Yes, if they have the link
Public read
Private
Yes
No
Public read
Public
Yes
Yes
Authenticated User
Private
No
No
Authenticated User
Public
No
Yes, if they have the link
With Authenticated User, visitors cannot see the list — but anyone signed in to a Zata.ai account can.
The two write settings behave like their read-only versions in this table, and add the ability to upload, overwrite and delete.
When ACL is not the right tool
An ACL is all-or-nothing: it opens your bucket to everyone in a group, and you cannot pick individual people or folders. When you need that kind of control, use one of these instead:
Share one file with someone for a limited time
Presigned URL — it expires on its own
Let a specific person upload, without opening the bucket to everyone
Subuser with a write policy
Share only one folder, not the whole bucket
Good to know
IMPORTANT A public file list shows your file names to everyone. File names often contain customer names, invoice numbers or project names, so treat the list itself as information worth protecting — even when the files stay private.
Both browsing and downloading count towards your egress usage. See Ingress and Egress Policy.
All public access stops working if your account is suspended.
You can switch any of these settings back at any time — but switching off write access does not undo anything that was already uploaded or deleted.
A bucket policy can block public access even when the ACL allows it. If a setting seems to have no effect, see ACL and bucket policies below.
ACL and bucket policies
Zata.ai checks the ACL and your bucket policies. If a policy says no, the answer is no — a policy that blocks access always wins over an ACL that allows it.
The Access Control section repeats this on screen:
NOTE The Public Access toggle above writes a bucket policy — an explicit Deny there overrides this.
So if you set a bucket to Public read and nothing changes, check the Security & Access section of Bucket Settings and the Policies page for a rule that is blocking it.
If you use the S3 API
Zata.ai follows the standard S3 ACL model, so the dashboard options match standard S3 permissions:
Private
private
The owner only
Public read
public-read
READ for the AllUsers group — everyone
Authenticated User
authenticated-read
READ for the AuthenticatedUsers group — every signed-in Zata.ai user
Public read + write
public-read-write
READ and WRITE for the AllUsers group
Authenticated User read + write
no canned name
READ and WRITE granted explicitly to the AuthenticatedUsers group
In S3, "read" means different things depending on what the ACL is attached to:
On a bucket, read means list the objects.
On an object, read means download the contents.
Same permission name, two different results. That is the reason the two settings have to be applied separately.
WRITE has no such split — it exists only on a bucket, and it covers adding, replacing and deleting objects together. That is why Zata.ai cannot offer an upload-only setting.
Last updated