Writing RLS policies directly on buckets and objects table

So far, we’ve only written RLS policies on the comment-attachments bucket, but we can also write RLS policies directly for the storage.objects and storage.buckets table. When would we do that? Let’s have a quick peek at what Supabase Studio shows me in the RLS section right now:

Figure 11.9: Storage RLS

We have two policies on comment-attachments, and no policies on storage.objects or storage.buckets.

However, this isn’t quite correct. Both of our comment-attachments policies are inside of storage.objects as this table is where the file information is stored. It’s just a visual helper from Supabase Studio that detects which buckets are targeted within the policies and separates them visually. This means that if there was a more general policy without bucket_id = 'your-bucket-name' in the RLS expression, it would show under Other policies under storage.objects...