Sample Response
In the following sample response, note that the header values are set to the values specified in the true request.
HTTP/1.1 206 Partial Content
x-amz-id-2: MzRISOwyjmnupCzjI1WC06l5TTAzm7/JypPGXLh0OVFGcJaaO3KW/hRAqKOpIEEp x-amz-request-id: 47622117804B3E11
Sample: Get an object stored using server-side encryption with customer-provided encryption keys
If an object is stored in Amazon S3 using server-side encryption with customer-provided encryption keys, Amazon S3 needs encryption information so that it can decrypt the object before sending it to you in response to a GET request. You provide the encryption information in your GET request using the relevant headers, as shown in the following example request.
GET /example-object HTTP/1.1
Host: example-bucket.s3.<Region>.amazonaws.com Accept: */*
Authorization:authorization string Date: Wed, 28 May 2014 19:24:44 +0000 x-amz-server-side-encryption-customer-key:g0lCfA3Dv40jZz5SQJ1ZukLRFqtI5WorC/8SEKEXAMPLE
x-amz-server-side-encryption-customer-key-MD5:ZjQrne1X/iTcskbY2m3example x-amz-server-side-encryption-customer-algorithm:AES256
Sample Response
The following sample response shows some of the response headers Amazon S3 returns. Note that it includes the encryption information in the response.
HTTP/1.1 200 OK
x-amz-id-2: ka5jRm8X3N12ZiY29Z989zg2tNSJPMcK+to7jNjxImXBbyChqc6tLAv+sau7Vjzh x-amz-request-id: 195157E3E073D3F9
Date: Wed, 28 May 2014 19:24:45 GMT
Last-Modified: Wed, 28 May 2014 19:21:01 GMT ETag: "c12022c9a3c6d3a28d29d90933a2b096"
x-amz-server-side-encryption-customer-algorithm: AES256
x-amz-server-side-encryption-customer-key-MD5: ZjQrne1X/iTcskbY2m3example
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
GetObjectAcl
Service: Amazon S3
Returns the access control list (ACL) of an object. To use this operation, you must have
s3:GetObjectAcl permissions or READ_ACP access to the object. For more information, see Mapping of ACL permissions and access policy permissions in the Amazon S3 User Guide
This action is not supported by Amazon S3 on Outposts.
Versioning
By default, GET returns ACL information about the current version of an object. To return ACL information about a different version, use the versionId subresource.
Note
If your bucket uses the bucket owner enforced setting for S3 Object Ownership, requests to read ACLs are still supported and return the bucket-owner-full-control ACL with the owner being the account that created the bucket. For more information, see Controlling object ownership and disabling ACLs in the Amazon S3 User Guide.
The following operations are related to GetObjectAcl:
• GetObject
• GetObjectAttributes
• DeleteObject
• PutObject
Request Syntax
GET /{Key+}?acl&versionId=VersionId HTTP/1.1 Host: Bucket.s3.amazonaws.com
x-amz-request-payer: RequestPayer
x-amz-expected-bucket-owner: ExpectedBucketOwner
URI Request Parameters
The request uses the following URI parameters.
Bucket (p. 176)
The bucket name that contains the object for which to get the ACL information.
When using this action with an access point, you must direct requests to the access point hostname. The access point hostname takes the form
AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this action with an access point through the AWS SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.
Required: Yes Key (p. 176)
The key of the object for which to get the ACL information.
Length Constraints: Minimum length of 1.
Required: Yes
versionId (p. 176)
VersionId used to reference a specific version of the object.
x-amz-expected-bucket-owner (p. 176)
The account ID of the expected bucket owner. If the bucket is owned by a different account, the request fails with the HTTP status code 403 Forbidden (access denied).
x-amz-request-payer (p. 176)
Confirms that the requester knows that they will be charged for the request. Bucket owners need not specify this parameter in their requests. For information about downloading objects from Requester Pays buckets, see Downloading Objects in Requester Pays Buckets in the Amazon S3 User Guide.
Valid Values: requester
Request Body
The request does not have a request body.
Response Syntax
HTTP/1.1 200
x-amz-request-charged: RequestCharged
<?xml version="1.0" encoding="UTF-8"?>
<AccessControlPolicy>
<Owner>
<DisplayName>string</DisplayName>
<ID>string</ID>
</Owner>
<AccessControlList>
<Grant>
<Grantee>
<DisplayName>string</DisplayName>
<EmailAddress>string</EmailAddress>
<ID>string</ID>
<xsi:type>string</xsi:type>
<URI>string</URI>
</Grantee>
<Permission>string</Permission>
</Grant>
</AccessControlList>
</AccessControlPolicy>
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The response returns the following HTTP headers.
x-amz-request-charged (p. 177)
If present, indicates that the requester was successfully charged for the request.
Valid Values: requester
The following data is returned in XML format by the service.
AccessControlPolicy (p. 177)
Root level tag for the AccessControlPolicy parameters.
Required: Yes Grants (p. 177)
A list of grants.
Type: Array of Grant (p. 676) data types Owner (p. 177)
Container for the bucket owner's display name and ID.
Type: Owner (p. 730) data type
The specified key does not exist.
Examples
Sample Request
The following request returns information, including the ACL, of the object my-image.jpg.
GET /my-image.jpg?acl HTTP/1.1
Host: bucket.s3.<Region>.amazonaws.com Date: Wed, 28 Oct 2009 22:32:00 GMT Authorization: authorization string
Sample Response
This example illustrates one usage of GetObjectAcl.
HTTP/1.1 200 OK
x-amz-id-2: eftixk72aD6Ap51TnqcoF8eFidJG9Z/2mkiDFu8yU9AS1ed4OpIszj7UDNEHGran x-amz-request-id: 318BC8BC148832E5
x-amz-version-id: 4HL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nrjfkd Date: Wed, 28 Oct 2009 22:32:00 GMT
<ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</ID>
<DisplayName>[email protected]</DisplayName>
<ID>75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a</
ID>
<DisplayName>[email protected]</DisplayName>
</Grantee>
<Permission>FULL_CONTROL</Permission>
</Grant>
</AccessControlList>
</AccessControlPolicy>