Help Center> Object Storage Service> SDK Reference> iOS> Bucket Management> Managing Bucket ACLs
View PDF

Managing Bucket ACLs

A bucket ACL can be configured in three modes:

  1. Specify a pre-defined access control policy during bucket creation.
  2. Call OBSSetBucketACLWithCannedACLRequest to specify a pre-defined access control policy.
  3. Call OBSSetBucketACLWithPolicyRequest to set the ACL directly.

The following table lists the five permissions supported by OBS.

Permission

Description

Enumeration Value in OBS iOS SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket. A grantee with this permission for an object can obtain the object content and metadata.

OBSACLRead

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket. This permission is not applicable to objects.

OBSACLWrite

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object. A bucket or object owner has this permission permanently.

OBSACLRead_ACP

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object. A bucket or object owner has this permission permanently. A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

OBSACLWrite_ACP

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket. A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.

OBSACLFull_Control

There are five access control policies pre-defined in OBS, as described in the following table:

Policy

Description

Enumeration Value in OBS iOS SDK

private

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

OBSACLPolicyPrivate

public-read

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ permission.

OBSACLPolicyPublicRead

public-read-write

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ and WRITE permissions.

OBSACLPolicyPublicReadWrite

public-read-delivered

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket.

This permission cannot be set for objects.

OBSACLPolicyPublicReadDelivered

public-read-write-delivered

If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart tasks in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; abort multipart uploads; and obtain content and metadata of objects in the bucket.

This permission cannot be set for objects.

OBSACLPolicyPublicReadWriteDelivered

Specifying a Pre-defined Access Control Policy During Bucket Creation

Sample code:

static OBSClient *client;
NSString *endPoint = @"your-endpoint";
NSString *SK = @"*** Provide your Secret Key ***";
NSString *AK = @"*** Provide your Access Key ***";
    
// Initialize identity authentication.
OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK];
    
//Initialize service configuration.
OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider];
    
// Initialize an instance of OBSClient.
client = [[OBSClient alloc] initWithConfiguration:conf];
    
//Create a bucket.
OBSCreateBucketRequest *request = [[OBSCreateBucketRequest alloc] initWithBucketName:@"bucketname"];
// Set the access control policy to public-read-write.
request.bucketACLPolicy = OBSACLPolicyPublicReadWrite;
    
[client createBucket:request completionHandler:^(OBSCreateBucketResponse *response, NSError *error) {
    NSLog(@"%@",response.location);
}];

Setting a Pre-defined Access Control Policy for the Bucket

Sample code:

static OBSClient *client;
NSString *endPoint = @"your-endpoint";
NSString *SK = @"*** Provide your Secret Key ***";
NSString *AK = @"*** Provide your Access Key ***";
    
// Initialize identity authentication.
OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK];
    
//Initialize service configuration.
OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider];
    
// Initialize an instance of OBSClient.
client = [[OBSClient alloc] initWithConfiguration:conf];
    
//Set the pre-defined access control policy to  public-read-write.
OBSSetBucketACLWithCannedACLRequest *request = [[OBSSetBucketACLWithCannedACLRequest alloc]initWithBucketName:@"bucketname" cannedACL:OBSACLPolicyPublicRead];
[client setBucketACL:request completionHandler:^(OBSSetBucketACLResponse *response, NSError *error){
    NSLog(@"%@",response);
}];

Directly Setting the Bucket ACL

Sample code:

static OBSClient *client;
NSString *endPoint = @"your-endpoint";
NSString *SK = @"*** Provide your Secret Key ***";
NSString *AK = @"*** Provide your Access Key ***";
    
// Initialize identity authentication.
OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK];
    
//Initialize service configuration.
OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider];
    
// Initialize an instance of OBSClient.
client = [[OBSClient alloc] initWithConfiguration:conf];
    
// Initialize an instance of OBSUser.
OBSUser *owner = [[OBSUser alloc] initWithID:@"ownerID"];
// Set a grantee.
OBSACLGranteeUser *grantee = [[OBSACLGranteeUser alloc]initWithID:@"granteeID"];
// Grant the FULL_CONTROL permission to the grantee.
OBSACLGrant *grant = [[OBSACLGrant alloc]initWithGrantee:grantee permission:OBSACLFull_Control];
    
// Create a policy object.
OBSAccessControlPolicy *policy = [OBSAccessControlPolicy new];
policy.owner = owner;
[policy.accessControlList addObject:grant];
    
// Directly set the ACL for the bucket.
OBSSetBucketACLWithPolicyRequest *request = [[OBSSetBucketACLWithPolicyRequest alloc]initWithBucketName:@"bucketname" accessControlPolicy:policy];
[client setBucketACL:request completionHandler:^(OBSSetBucketACLResponse *response, NSError *error){
    NSLog(@"%@",response);
}];

The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credentials page of OBS Console.

Obtaining a Bucket ACL

You can call getBucketACL to obtain the bucket ACL. Sample code is as follows:

static OBSClient *client;
NSString *endPoint = @"your-endpoint";
NSString *SK = @"*** Provide your Secret Key ***";
NSString *AK = @"*** Provide your Access Key ***";
    
// Initialize identity authentication.
OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK];
    
//Initialize service configuration.
OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider];
    
// Initialize an instance of OBSClient.
client = [[OBSClient alloc] initWithConfiguration:conf];
    
// Obtain the bucket ACL.
OBSGetBucketACLRequest *request = [[OBSGetBucketACLRequest alloc] initWithBucketName:@"bucketname"];
[client getBucketACL:request completionHandler:^(OBSGetBucketACLResponse *response, NSError *error){
    NSLog(@"%@",response);
}];
Parent topic: Bucket Management