Access Control List (ACL): Definition, Types, Examples

What is an access control list (ACL)?

An access control list (ACL) is a list attached to a resource, such as a file, subnet or storage bucket, that says who may do what with it. Each entry names a subject, like a user, group or IP range, and the permissions allowed or denied. The system checks the list on every access.

How an ACL works

Each line in the list is an access control entry (ACE). It combines a subject (who), a permission such as read, write or execute (what) and, in many systems, an allow or deny decision. When a request arrives, the system looks the subject up in the list. Some systems stop at the first matching entry, others combine every entry that applies, so the evaluation rule matters as much as the entries themselves.

An ACL answers "for this resource, who can do what?". That is the opposite viewpoint to role-based access control, which starts from the user and asks which roles they hold.

Example: a POSIX file ACL

On Linux, the acl(5) man page defines the entry types: the owner, named users, the owning group, named groups, a mask and "other". Here is one file's ACL in the short text form that getfacl prints:

user::rwx
user:alice:rw-
group::r-x
group:engineering:rwx
mask::rwx
other::r--

Alice gets read and write although she is not the owner. The mask caps what named users and groups can actually do, so a mask of r-- would silently cut Alice back to read-only.

Types of ACL

• File system ACLs extend owner, group and other permissions with named users and groups. Linux filesystems and Windows NTFS both support them.
• Network ACLs allow or deny traffic by address, port and protocol. In AWS, a network ACL works at the subnet level, has numbered rules checked from the lowest number up, and is stateless, so return traffic needs its own rule. Security groups, by contrast, are stateful.
• Object storage ACLs grant basic read and write rights on a bucket or object. Amazon S3 disables ACLs by default on new buckets and recommends keeping them off, because bucket policies are more expressive.
• Application ACLs are permission lists a SaaS app or CMS keeps per document, project or record.

ACL vs RBAC vs IAM

An ACL is attached to the resource and is the right tool for a few resources with unusual exceptions. RBAC assigns permissions to roles, which scales better when many users share the same duties. Identity and access management (IAM) is the wider discipline that manages identities, roles and policies, and often uses ACLs underneath. Most real systems combine them: roles for the bulk of access, ACLs for exceptions.

Common ACL mistakes

• Wrong rule order. In first-match systems, a broad allow placed above a specific deny makes the deny dead.
• Forgetting the return path. On a stateless network ACL, allowing inbound requests without the matching outbound rule makes connections hang.
• Granting access to "everyone". A public group on a bucket exposes its contents to anyone. Check for these grants first when auditing.
• Ignoring the mask. A POSIX entry can look generous and still be capped by the mask.
• Letting entries pile up. Nobody remembers why an old entry exists, and removing it feels risky. Review ACLs on a schedule and tie each entry to an owner.

ACLs, load testing and monitoring

An ACL change is a classic cause of sudden 401, 403 or timeout errors. A network ACL or firewall that drops traffic from unknown addresses will also block a load test: LoadFocus starts cloud instances on demand, so you allow its published IP ranges before you test. If errors only appear under load, rate limiting at your edge may be the cause rather than the application.

To catch permission drift early, run a scheduled check on a protected endpoint with API monitoring and assert the expected status code, or do a one-off check with the API status checker. Our guide to cloud testing security covers access control for test environments, and API security and API access cover the credential side.

FAQ: ACL

What does ACL stand for?

ACL stands for access control list. In networking it is sometimes called a network access control list (NACL).

What is the difference between an ACL and a firewall?

A firewall is a device or service that filters traffic. An ACL is the rule list it, or a router, uses to decide what to allow. Many firewalls are configured through ACL-style rules.

Is an ACL the same as RBAC?

No. An ACL lists permissions per resource, RBAC assigns permissions to roles that users then hold. They are often used together.

Should I use S3 ACLs?

Usually not. Amazon S3 disables ACLs by default and recommends policies instead. Use ACLs only when you must control access for each object individually.

Are network ACLs stateful?

In AWS they are not. A network ACL evaluates each packet on its own, so you need rules for both directions. Security groups are stateful and allow replies automatically.