Module acl (1.21.0)

Manipulate access control lists that Cloud Storage provides.

Bucket has a getting method that createsan ACL object under the hood, and you can interact with that usingacl:

.. literalinclude:: snippets.py :start-after: [START client_bucket_acl] :end-before: [END client_bucket_acl]

Adding and removing permissions can be done with the following methods(in increasing order of granularity):

  • ACL.allcorresponds to access for all users.
  • ACL.all_authenticated correspondsto access for all users that are signed into a Google account.
  • ACL.domain corresponds to access on aper Google Apps domain (ie,example.com).
  • ACL.group corresponds to access on aper group basis (either by ID or e-mail address).
  • ACL.user corresponds to access on aper user basis (either by ID or e-mail address).

And you are able togrant andrevoke the following roles:

  • Reading:_ACLEntity.grant_read and_ACLEntity.revoke_read
  • Writing:_ACLEntity.grant_write and_ACLEntity.revoke_write
  • Owning:_ACLEntity.grant_owner and_ACLEntity.revoke_owner

You can use any of these like any other factory method (these happen tobe_ACLEntity factories):

.. literalinclude:: snippets.py :start-after: [START acl_user_settings] :end-before: [END acl_user_settings]

After that, you can save any changes you make with thesave method:

.. literalinclude:: snippets.py :start-after: [START acl_save] :end-before: [END acl_save]

You can alternatively save any existingACLobject (whether it was created by a factory method or not) from aBucket:

.. literalinclude:: snippets.py :start-after: [START acl_save_bucket] :end-before: [END acl_save_bucket]

To get the list ofentity androle for each unique pair, theACL class is iterable:

.. literalinclude:: snippets.py :start-after: [START acl_print] :end-before: [END acl_print]

This list of tuples can be used as theentity androle fieldswhen sending metadata for ACLs to the API.

Classes

ACL

ACL()

Container class representing a list of access controls.

BucketACL

BucketACL(bucket)

An ACL specifically for a bucket.

Parameter
NameDescription
bucketBucket

The bucket to which this ACL relates.

DefaultObjectACL

DefaultObjectACL(bucket)

A class representing the default object ACL for a bucket.

ObjectACL

ObjectACL(blob)

An ACL specifically for a Cloud Storage object / blob.

Parameter
NameDescription
blobBlob

The blob that this ACL corresponds to.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-01-29 UTC.