ACLs

The client can read and replace bucket and object ACL documents:

AclPolicy bucketAcl = storage.getBucketAcl("photos");
AclPolicy objectAcl = storage.getObjectAcl("photos", "images/cat.jpg");

storage.putBucketAcl("photos", replacementBucketPolicy);
storage.putObjectAcl("photos", "images/cat.jpg", replacementObjectPolicy);

AclPolicy contains an ownerId and a list of Grant records. A grant has a GranteeType (CANONICAL_USER or GROUP), a grantee ID or group URI, and a Permission (READ, WRITE, READ_ACP, WRITE_ACP, or FULL_CONTROL). Its constructors reject a blank owner or grantee, and copy the grant list.

These methods send S3 ACL requests; they do not calculate effective permissions. A service with ACLs disabled may reject them. ObjectStore implements a limited ACL subset, so check service support before relying on specific grants. ACL replacements are writes and are not automatically retried.