Ability to easily copy object ACL

In v1 of the SDK, copying over object ACL while copying an object was fairly easy.
Assuming we already had a CopyObjectRequest named req, this was all the additional code that was necessary.

AccessControlList acl = s3.getObjectAcl(bucketName, oldObjectName);
req.setAccessControlList(acl);

Now getObjectAcl returns a GetObjectAclResponse, and CopyObjectRequest only takes canned ACL. There's no way to directly copy it over. It appears I have to manually copy the fields of the GetObjectAclResponse to an AccessControlPolicy, then pass that to a separate PutObjectAclRequest. Not only is this more code, but it isn't very discoverable. It wasn't obvious how to go from a GetObjectAclResponse to something that could be set on another object.

I'd like there to be an easier way to copy ACL over when copying an S3 object using the v2 SDK.

[debora-ito]

Hi @FishkinsDC, thank you for reaching out.

CopyObjectRequest actually takes non-canned ACL with the grantFullControl(), grantRead(), grantReadACP() and grantWriteACP() methods. You can specify each grantee as a type=value pair, where the type is one of the following: emailAddress, id or uri.

You can read more about them in the CopyObject API docs: https://docs.aws.amazon.com/AmazonS3/latest/API/API_CopyObject.html

I know you'd still have to write some code to pass the grantees from the GetObjectAclResponse to each grant method, but you'd not have to do a separate call to PutObjectAcl. V1 returned AccessControlList as a benefit of a hand-written client, but in V2 the S3 client is auto-generated.

Please let us know if this helps.

Hi @debora-ito, thanks for the reply.

Being able to set each grant is nice in terms of eliminating the additional API call, but it doesn't seem like each of us should have to write code to loop through the list of Grants, determine which type to use for each Grant, aggregate those into comma-delimited lists for each of the four permission levels, then set those lists on each of the four fields of the CopyObjectRequest.

The grants(Collection<Grant> grants) setter provided by https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/services/s3/model/AccessControlPolicy.Builder.html#grants-java.util.Collection- is much nicer. I'd strongly prefer for an option like that to be present on CopyObjectRequest.

[adityajee]

Hi @debora-ito. Is there any update regarding this?
If not, can you point me to some examples of grantFullControl(), grantRead(), grantReadACP() and grantWriteACP() uses. Especially, how would the argument string look like based on the GetBucketAclResponse?

[bhoradc]

Thanks for filing the feature request. After team review, we're closing this as not planned.

Since April 2023, AWS S3 enables BucketOwnerEnforced by default on new buckets, and AWS recommends bucket policies and IAM as the primary access control mechanism for modern S3 use cases. Given that direction, we don't plan to add an SDK convenience specific to ACL grants.

If you have a specific question or scenario not covered here, please open a new issue so we can help.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.