Context
You can give people outside your EDITO workspace public access to selected objects or prefixes without making the rest of your bucket public.
This article explains graphical sharing, MinIO anonymous-access policies and direct public access to Zarr and NetCDF datasets.
Understand what sharing does
Three operations are often confused:
Store data
The object exists in an EDITO or external S3 bucket. It is private unless the bucket or object policy grants broader access.
Share data publicly
An unauthenticated user can read the selected object or prefix through its public URL. Public sharing changes the storage access policy.
Publish data in the EDITO Data Catalogue
The dataset's metadata is registered in the Catalogue so that users can discover it. The Catalogue stores metadata and links; it does not store the dataset itself.
Making an object public does not automatically publish it in the Catalogue. Publishing Catalogue metadata does not automatically change a private bucket policy.
Before sharing
Confirm that:
You own or are authorized to share the data;
The content contains no personal, confidential, restricted or licensed material that prohibits public redistribution;
The public prefix does not contain unintended files;
The format can be consumed over HTTP or S3 as expected;
The public URL will remain stable for the required period.
For a group-project bucket, coordinate with the other project members before exposing shared content.
Share with File Explorer
Open File Explorer, locate the object or folder and use the sharing control displayed next to it.
Depending on the current interface, you may see a closed-eye icon for private content and an open-eye or sharing action for public content.
Use the interface to:
Make a file public;
Make a folder-like prefix public;
Choose temporary or persistent public access when those options are available;
Return the object or prefix to private access.
After sharing, test the generated public URL in a private browser window that is not authenticated to EDITO.
If the graphical action fails, use mc anonymous from a running EDITO service.
Share with MinIO Client
Inside a correctly configured EDITO service, the s3 alias is normally available without additional setup.
A personal bucket is normally oidc-[YOUR_USERNAME].
Replace the bucket and object paths in the following examples when working with a project or another configured bucket.
Make one object publicly readable
mc anonymous set download s3/oidc-[YOUR_USERNAME]/path/to/my_file
The corresponding public URL is normally:
https://minio.dive.edito.eu/oidc-[YOUR_USERNAME]/path/to/my_file
Use the exact object key and preserve its capitalization.
Make all objects under a prefix publicly readable
mc anonymous set download s3/oidc-[YOUR_USERNAME]/path/to/my_folder/
A folder displayed by File Explorer is an S3 prefix. The policy applies to objects whose keys fall under that prefix.
Share objects matching a prefix
mc anonymous set download s3/oidc-[YOUR_USERNAME]/path/to/my_files/prefix
Review the matched object keys before applying the policy so that unrelated content is not exposed.
List anonymous-access policies
mc anonymous list s3/oidc-[YOUR_USERNAME]
Use the output to review which buckets or prefixes currently permit unauthenticated access.
Remove anonymous access
mc anonymous set private s3/oidc-[YOUR_USERNAME]/<PUBLIC_OBJECT_OR_PREFIX>
Replace <PUBLIC_OBJECT_OR_PREFIX> with an object or prefix shown by the anonymous-policy listing.
After removing access, test the former public URL again without authentication.
💡 Anonymous policy modes
MinIO Client supports several anonymous policy modes:
private: no anonymous access
download: read/download access
upload: upload/write access without read access
public: read and write access
For normal dataset sharing, use download.
⚠️ upload and especially public allow unauthenticated writes. Do not use them unless you have a controlled operational need, a restricted prefix and a plan to monitor and remove unwanted content.
Share a Zarr dataset
Zarr is composed of many objects under one prefix. The complete Zarr prefix must be readable for another client to open the dataset successfully.
Upload or write the Zarr store
Upload an existing Zarr directory with File Explorer, mc or another S3 client, or write it directly with xarray and s3fs.
For the private-write example, including credentials, S3Map, chunk encoding and Dataset.to_zarr(), see Access EDITO storage from code, services and processes.
The examples below assume the store is located at oidc-[YOUR_USERNAME]/foobar.zarr. and was written with consolidated metadata.
Make the complete Zarr prefix public
Use the File Explorer sharing control on foobar.zarr, or run:
mc anonymous set download s3/oidc-[YOUR_USERNAME]/foobar.zarr
Confirm that metadata objects and chunk objects are all reachable through the public prefix.
Open the public Zarr store with xarray
Install xarray, dask and zarr, then run:
import xarray as xr
dataset = xr.open_dataset(
"https://minio.dive.edito.eu/oidc-[YOUR_USERNAME]/foobar.zarr",
engine="zarr",
)
print(dataset)
No EDITO account or S3 credentials are required after the Zarr prefix is public.
For large Zarr datasets, suitable chunking is important for efficient remote reads.
Share a NetCDF file
Upload the file
Upload foobar.nc to the personal or project bucket with File Explorer, mc or a Python S3 client.
For direct in-memory NetCDF upload from xarray, see Access EDITO storage from code, services and processes.
Make the NetCDF object public
Use File Explorer, or run:
mc anonymous set download s3/oidc-[YOUR_USERNAME]/foobar.nc
Its public URL is: https://minio.dive.edito.eu/oidc-[YOUR_USERNAME]/foobar.nc
Open the public NetCDF file with xarray
Install xarray and netCDF4, then run:
import xarray as xr
dataset = xr.open_dataset(
"https://minio.dive.edito.eu/oidc-[YOUR_USERNAME]/foobar.nc#mode=bytes",
engine="netcdf4",
)
print(dataset)
The #mode=bytes fragment instructs the relevant file-access layer to treat the remote resource as bytes.
For very large NetCDF files, direct HTTP access may still transfer substantial data depending on the file structure, server behavior and requested operation. Consider a cloud-optimized format such as Zarr when partial remote access is a primary requirement.
📌 Share other file types
The same download policy can expose text files, images, archives, GeoJSON, configuration files and other objects.
A public object is normally accessible at: https://minio.dive.edito.eu/<BUCKET>/<OBJECT_KEY>
Whether an application can stream or partially read the object depends on its format and the application's HTTP/S3 support.
Share content from an external bucket
For an external S3 bucket, public access is controlled by the external provider's bucket policy.
You can connect an already public external bucket to EDITO with the Anonymous option. Enabling that option tells EDITO not to use credentials; it does not change the provider-side policy.
For a private external bucket, use the provider's policy tools or credentials. The public URL format may differ from the EDITO MinIO URL (see Connect an external S3 storage to EDITO).
Publish the shared dataset in the EDITO Data Catalogue
A public URL makes the data accessible, but not necessarily discoverable.
To publish or reference the dataset in the EDITO Data Catalogue:
Host the dataset at a stable accessible location, such as a publicly shared personal or group-project prefix;
Prepare valid STAC metadata describing the dataset;
Create or update the relevant Catalogue, Collection and Item through the EDITO Data API;
Include the public asset URL in the Item metadata;
Configure the Catalogue visibility separately from the storage policy.
The Catalogue API stores metadata that points to the asset. It does not copy the dataset into Catalogue storage (see Use the EDITO Data Catalogue and Interact with the Data API).
Revoke or change public access
When the public link is no longer needed:
List current anonymous policies;
Set the object or prefix back to private;
Test the URL without authentication;
Remove or update any Catalogue asset link that should no longer be public;
Notify known consumers if the URL was part of an operational workflow.
Changing an object key or deleting an object also breaks its public URL.
Security recommendations
Use download rather than public for read-only sharing.
Apply the policy to the narrowest possible prefix.
Check all objects under a prefix before making it public.
Do not expose credentials in a public URL, notebook or example.
Do not assume that an obscure URL is private.
Review anonymous policies periodically.
Remove public access when it is no longer required.
Keep published URLs stable, or version the dataset and update metadata deliberately.
Verify licences and data-sharing obligations before publication.
Troubleshooting
The public URL returns AccessDenied
Check that:
mc anonymous set downloadwas applied to the correct bucket and prefix;The URL uses the same bucket and exact object key;
The parent and child objects required by a Zarr store are all under the shared prefix;
Another policy has not returned the prefix to private access.
The public URL returns NoSuchKey
Check capitalization, punctuation and the complete object key. S3 keys are exact and can contain characters that resemble folders.
A Zarr store opens incompletely or fails on metadata
Confirm that the entire store is public, including .zmetadata or other metadata objects and all required chunks. Confirm that the client has compatible xarray, zarr and dask versions.
A NetCDF file downloads instead of opening
That browser behavior is normal. Use an application that supports remote NetCDF access, or use the xarray example with #mode=bytes and the netcdf4 engine.
The object is public but absent from the Data Catalogue
Public storage access and Catalogue registration are separate. Create the required STAC metadata through the Data API.
What's next?
If you have any questions, problems, or suggestions, please feel free to contact us via chat using the widget available at the bottom right of the page.