Use this file to discover all available pages before exploring further.
Updated May 8, 2026Raff Object Storage controls access at three levels, and they combine. Default everything to private. Only flip something public when the data’s whole purpose is to be served to unauthenticated readers — and even then, prefer a per-object public override on a private bucket.
Layered access is most permissive — if any layer grants read, the read succeeds. Public bucket + private object usually still ends up public; private bucket + public object exposes that one object only.A fourth option — presigned URLs — sits outside this model and is covered at the bottom.
Only the bucket owner has full access. No public or cross-account read or write.
Default — anything that isn’t a public asset bucket
Public Read
Anyone can read and download objects via their Object URL. Only the owner can write.
Static site hosting, public CDN origin, public download distribution
Public Read/Write
Anyone can read, write, and delete. Use with extreme caution.
Almost never. Anonymous bug-bounty drop boxes, intentional one-shot fileshares — and even then, probably not
Authenticated Read
Anyone with valid S3 credentials (any Raff account, any AWS account) can read.
Multi-tenant collaboration without making data fully public
Bucket-level ACL is bucket-wide. If you flip a bucket to Public Read, every object in it becomes publicly readable — current and future — unless that object has an explicit private override at the object level. Customer uploads, internal logs, anything you missed: all of it goes live.We do not recommend public ACL on a bucket unless the bucket’s entire purpose is public hosting. The safer pattern is to keep the bucket Private and override only the specific objects that need to be public on the object detail page.
The Bucket Policy section accepts an S3-style JSON policy document. It lets you express things ACLs can’t:
“Allow uploads only from these IP ranges”
“Deny all delete operations on this bucket”
“Force HTTPS — block plain HTTP requests”
“Public for read, but only the owner can write”
“Limit access to objects under one folder prefix”
The default empty policy is {"Version": "2012-10-17", "Statement": []} — no rules. Add statements directly, or pick a template from the Policy Examples dropdown:
Bucket-wide unauthenticated download access — equivalent to ACL Public Read but expressed as a policy you can edit
Public Read + List
Same as above, plus s3:ListBucket so visitors can browse the object listing
Deny Delete
Lock down s3:DeleteObject and s3:DeleteObjectVersion for everyone — useful for compliance / audit logs
IP Restricted Upload
Only allow s3:PutObject from a specific IP CIDR — restricts uploads to your office, CI runners, etc.
Enforce HTTPS Only
Deny any request that arrives over plain HTTP. Pair with public buckets to prevent accidental cleartext traffic
Read-Only Public, Write for Owner
The “static site” pattern — anyone can GET, only credentialed accounts can PUT/DELETE
Restrict to Folder Prefix
Limit access to objects under a specific key prefix (e.g. public/ is readable, private/ isn’t)
Pick a template, the editor fills in working JSON, you tweak (add your IP, your folder name, etc.), then Save Policy.To remove a policy entirely, Delete Policy clears the document; access falls back to the bucket’s ACL alone.
If you’d rather paste a template into your own infrastructure-as-code or write your own, here’s the JSON each one produces. Replace BUCKET_NAME with your actual bucket name; replace IP / prefix placeholders where called out.
When both are set, S3 evaluates bucket policy + bucket ACL + object ACL and grants access if any of them allows it — except for explicit Deny statements in a bucket policy, which override allows.Practical implications:
Adding a Public Read policy on top of a Private ACL → bucket is effectively public. The policy grants what the ACL doesn’t.
Adding a Deny Delete policy on top of any ACL → no one can delete, even the owner via console (use Delete Policy first if you need to clean up).
Enforce HTTPS Only is a hard filter — it doesn’t grant access, it blocks plain-HTTP requests entirely. Always safe to layer on.
If two layers conflict, the Deny wins. Use Deny carefully.
Each object can carry its own ACL that opens it up even when the bucket is private. Open the object’s Details page from the bucket’s Objects tab → row Actions → Details.
The Object overview card gives you what you need to share or reference the object:
HTTP endpoint — only works in a browser if the object is public
ETag
Server’s hash of the contents — for cache validation and integrity checks
Key
The object’s name including any folder prefix
At the bottom, the Access control list (ACL) dropdown sets per-object ACL: Private or Public. Save and the change applies immediately.The recommended pattern for an “almost-private” bucket: keep the bucket Private, then flip individual objects to Public only when needed. This is far safer than flipping the bucket public and trying to lock individual files back down.
Sometimes you want to share one file with one person without flipping any ACL. The dashboard’s per-object Share action (and the SDK’s generate_presigned_url / GetObjectPresign calls) generates a presigned URL — a long, time-limited HTTPS link that lets anyone download the object without credentials, until it expires.
Property
Value
Object visibility
Object stays private — no ACL change
Who can use the URL
Anyone holding it — no Raff account needed
Valid for
Time-limited (minutes to hours; configurable when the URL is generated)
Revocable mid-flight
No — valid until expiry. To revoke faster, rotate the access key that signed it
Best for
One-off sharing, email download links, third-party data drops, signed download tokens served by your app
Use a presigned URL when:
The file should not be permanently public
The recipient doesn’t have Raff access
The link should self-expire — no cleanup required
Use a public ACL or policy when:
The file is permanently public (static assets, public docs)
Periods in bucket names break HTTPS for public buckets. The wildcard cert covers *.s3.raffusercloud.com, not nested dots like bucket.with.dots.s3.raffusercloud.com. Use hyphens for public bucket names.
Open on the dashboard fails for private objects. That action uses the Object URL, which needs public access. Use Download or Share instead.
Switching a public bucket back to private doesn’t kill existing presigned URLs. They keep working until they expire. Rotate the signing access key if you need to revoke faster.
Deny in a bucket policy locks the owner out too. A Deny Delete you forgot will block your own cleanup until you Delete Policy from the dashboard.
Public buckets leak silently. There’s no daily report telling you a bucket is public — once it’s public, it’s public. Periodically audit the ACL column on the Buckets list.
