grantWriteAcp

Specify access permissions explicitly to allows grantee to allow grantee to write the ACL for the applicable object.

By default, all objects are private. Only the owner has full access control. When uploading an object, you can use this header to explicitly grant access permissions to specific Amazon Web Services accounts or groups. This header maps to specific permissions that Amazon S3 supports in an ACL. For more information, see Access Control List (ACL) Overview in the Amazon S3 User Guide.

You specify each grantee as a type=value pair, where the type is one of the following:

• id – if the value specified is the canonical user ID of an Amazon Web Services account

• uri – if you are granting permissions to a predefined group

• emailAddress – if the value specified is the email address of an Amazon Web Services accountUsing email addresses to specify a grantee is only supported in the following Amazon Web Services Regions:

• US East (N. Virginia)

• US West (N. California)

• US West (Oregon)

• Asia Pacific (Singapore)

• Asia Pacific (Sydney)

• Asia Pacific (Tokyo)

• Europe (Ireland)

• South America (São Paulo) For a list of all the Amazon S3 supported Regions and endpoints, see Regions and Endpoints in the Amazon Web Services General Reference.

For example, the following x-amz-grant-read header grants the Amazon Web Services accounts identified by account IDs permissions to read object data and its metadata:

x-amz-grant-read: id="11112222333", id="444455556666"

• This functionality is not supported for directory buckets.

• This functionality is not supported for Amazon S3 on Outposts.