GETOBJECTACL()`¶

About GetObjectAcl¶

End of support notice: Beginning November 21, 2025, Amazon S3 will stop returning DisplayName. Update your applications to use canonical IDs (unique identifier for Amazon Web Services accounts), Amazon Web Services account ID (12 digit identifier) or IAM ARNs (full resource naming) as a direct replacement of DisplayName.

This change affects the following Amazon Web Services Regions: US East (N. Virginia) Region, US West (N. California) Region, US West (Oregon) Region, Asia Pacific (Singapore) Region, Asia Pacific (Sydney) Region, Asia Pacific (Tokyo) Region, Europe (Ireland) Region, and South America (São Paulo) Region.

This operation is not supported for directory buckets.

Returns the access control list (ACL) of an object. To use this operation, you must have s3:GetObjectAcl permissions or READ_ACP access to the object. For more information, see Mapping of ACL permissions and access policy permissions in the Amazon S3 User Guide

This functionality is not supported for Amazon S3 on Outposts.

By default, GET returns ACL information about the current version of an object. To return ACL information about a different version, use the versionId subresource.

If your bucket uses the bucket owner enforced setting for S3 Object Ownership, requests to read ACLs are still supported and return the bucket-owner-full-control ACL with the owner being the account that created the bucket. For more information, see Controlling object ownership and disabling ACLs in the Amazon S3 User Guide.

The following operations are related to GetObjectAcl:

You must URL encode any signed header values that contain spaces. For example, if your header value is my file.txt, containing two spaces after my, you must URL encode this value to my%20%20file.txt.

Method Signature¶

METHODS /AWS1/IF_S3~GETOBJECTACL
  IMPORTING
    !IV_BUCKET TYPE /AWS1/S3_BUCKETNAME OPTIONAL
    !IV_KEY TYPE /AWS1/S3_OBJECTKEY OPTIONAL
    !IV_VERSIONID TYPE /AWS1/S3_OBJECTVERSIONID OPTIONAL
    !IV_REQUESTPAYER TYPE /AWS1/S3_REQUESTPAYER OPTIONAL
    !IV_EXPECTEDBUCKETOWNER TYPE /AWS1/S3_ACCOUNTID OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_s3_getobjectacloutput
  RAISING
    /AWS1/CX_S3_NOSUCHKEY
    /AWS1/CX_S3_CLIENTEXC
    /AWS1/CX_S3_SERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_bucket` `TYPE /AWS1/S3_BUCKETNAME` `/AWS1/S3_BUCKETNAME`¶

The bucket name that contains the object for which to get the ACL information.

Access points - When you use this action with an access point for general purpose buckets, you must provide the alias of the access point in place of the bucket name or specify the access point ARN. When you use this action with an access point for directory buckets, you must provide the access point name in place of the bucket name. When using the access point ARN, you must direct requests to the access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com. When using this action with an access point through the Amazon Web Services SDKs, you provide the access point ARN in place of the bucket name. For more information about access point ARNs, see Using access points in the Amazon S3 User Guide.

`iv_key` `TYPE /AWS1/S3_OBJECTKEY` `/AWS1/S3_OBJECTKEY`¶

The key of the object for which to get the ACL information.

Optional arguments:¶

`iv_versionid` `TYPE /AWS1/S3_OBJECTVERSIONID` `/AWS1/S3_OBJECTVERSIONID`¶

Version ID used to reference a specific version of the object.

This functionality is not supported for directory buckets.

`iv_requestpayer` `TYPE /AWS1/S3_REQUESTPAYER` `/AWS1/S3_REQUESTPAYER`¶

RequestPayer

`iv_expectedbucketowner` `TYPE /AWS1/S3_ACCOUNTID` `/AWS1/S3_ACCOUNTID`¶

The account ID of the expected bucket owner. If the account ID that you provide does not match the actual owner of the bucket, the request fails with the HTTP status code 403 Forbidden (access denied).

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_s3_getobjectacloutput` `/AWS1/CL_S3_GETOBJECTACLOUTPUT`¶

Domain /AWS1/RT_ACCOUNT_ID

Primitive Type NUMC

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->getobjectacl(
  iv_bucket = |string|
  iv_expectedbucketowner = |string|
  iv_key = |string|
  iv_requestpayer = |string|
  iv_versionid = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lo_owner = lo_result->get_owner( ).
  IF lo_owner IS NOT INITIAL.
    lv_displayname = lo_owner->get_displayname( ).
    lv_id = lo_owner->get_id( ).
  ENDIF.
  LOOP AT lo_result->get_grants( ) into lo_row.
    lo_row_1 = lo_row.
    IF lo_row_1 IS NOT INITIAL.
      lo_grantee = lo_row_1->get_grantee( ).
      IF lo_grantee IS NOT INITIAL.
        lv_displayname = lo_grantee->get_displayname( ).
        lv_emailaddress = lo_grantee->get_emailaddress( ).
        lv_id = lo_grantee->get_id( ).
        lv_uri = lo_grantee->get_uri( ).
        lv_type = lo_grantee->get_type( ).
      ENDIF.
      lv_permission = lo_row_1->get_permission( ).
    ENDIF.
  ENDLOOP.
  lv_requestcharged = lo_result->get_requestcharged( ).
ENDIF.

To retrieve object ACL¶

The following example retrieves access control list (ACL) of an object.

DATA(lo_result) = lo_client->getobjectacl(
  iv_bucket = |examplebucket|
  iv_key = |HappyFace.jpg|
).

/AWS1/IF_S3=>GETOBJECTACL()¶