title: Policy document for object for AWS s3 - What ACL
body: <p>What i want to accomplish is sending file direct from browser to s3 with signature-v4. I have problem with constructing policy document for object</p>
  
  <p>From this:
  <a href="https://blog.shikisoft.com/signing-aws-s3-uploads-with-signature-v4-ruby-on-rails-angularjs/" rel="nofollow noreferrer">https://blog.shikisoft.com/signing-aws-s3-uploads-with-signature-v4-ruby-on-rails-angularjs/</a></p>
  
  <p>I can see how this document should look: </p>
  
  <pre><code>Base64.encode64(
      {
        "expiration" =&gt; 1.hour.from_now.utc.xmlschema,
        "conditions" =&gt; [
          { "bucket" =&gt;  bucket },
          [ "starts-with", "$key", "" ],
          { "acl" =&gt; "private" },
          [ "starts-with", "$Content-Type", "" ],
          {"x-amz-algorithm" =&gt; x_amz_algorithm },
          {"x-amz-credential" =&gt; x_amz_credential },
          {"x-amz-date" =&gt; x_amz_date},
          [ "content-length-range", 0, 524288000 ]
        ]
      }.to_json
  </code></pre>
  
  <p>I dont know what ACL should i use.</p>
  
  <p><strong>I want to give user permission only to upload a file with certain .extension(s), and after this user shoudnt be able to delete it or even read it. The permission should be only for that file</strong> </p>
  
  <p>Here is a list of ACL permissions (I belive it is right place )
  <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#canned-acl</a></p>
  
  <p>Can I achive somehow permission only for upload, only for delete, only for read, only for read and delete for one file ? The other question is Content Type that I belive should be generated based on extension. </p>
  
  <p>Please forgive me if I lack some basic concepts</p>
  
  <p><strong>EDIT 1</strong></p>
  
  <p>I didnt mention that I want to use multipart upload and from docs of aws
  <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/dev/mpuAndPermissions.html</a></p>
  
  <p>beside <code>s3:getObject</code>, <code>s3:putObject</code>, I need to give <code>s3:ListMultipartUploadParts</code> also</p>
  
  <p>How can I restrict it only to files or folders ? The case is that every user has private files and should have access only to files that he owns</p>