Help Center> Object Storage Service> SDK Reference> Java> Bucket Management> Managing Bucket ACLs
View PDF

Managing Bucket ACLs

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see the API Reference

A bucket ACL can be configured in three modes:

  1. Specify a pre-defined access control policy during bucket creation.
  2. Call ObsClient.setBucketAcl to specify a pre-defined access control policy.
  3. Call ObsClient.setBucketAcl to set the ACL directly.

The following table lists the five permission types supported by OBS.

Permission

Description

Value in OBS Java SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in and metadata of the bucket.

A grantee with this permission for an object can obtain the object content and metadata.

Permission.PERMISSION_READ

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket.

This permission is not applicable to objects.

Permission.PERMISSION_WRITE

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

Permission.PERMISSION_READ_ACP

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

Permission.PERMISSION_WRITE_ACP

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket.

A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.

Permission.PERMISSION_FULL_CONTROL

There are five access control policies pre-defined in OBS, as described in the following table:

Permission

Description

Value in OBS Java SDK

private

The owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

AccessControlList.REST_CANNED_PRIVATE

public-read

If this permission is set for a bucket, everyone can obtain the list of objects, multipart uploads, and object versions in the bucket, as well as metadata of the bucket.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

AccessControlList.REST_CANNED_PUBLIC_READ

public-read-write

If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart uploads in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; and abort multipart uploads.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

AccessControlList.REST_CANNED_PUBLIC_READ_WRITE

public-read-delivered

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket.

This permission cannot be set for objects.

AccessControlList.REST_CANNED_PUBLIC_READ_DELIVERED

public-read-write-delivered

If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart uploads in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; abort multipart uploads; obtain content and metadata of objects in the bucket.

This permission cannot be set for objects.

AccessControlList.REST_CANNED_PUBLIC_READ_WRITE_DELIVERED

Specifying a Pre-defined Access Control Policy During Bucket Creation

Sample code:

String endPoint = "https://your-endpoint";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

ObsBucket obsBucket = new ObsBucket();
obsBucket.setBucketName("bucketname");
// Set the bucket ACL to public-read-write.
obsBucket.setAcl(AccessControlList.REST_CANNED_PUBLIC_READ_WRITE);
// Create a bucket.
obsClient.createBucket(obsBucket);

Setting a Pre-defined Access Control Policy for a Bucket

Sample code:

String endPoint = "https://your-endpoint";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

// Set the bucket ACL to private.
obsClient.setBucketAcl("bucketname", AccessControlList.REST_CANNED_PRIVATE);

Directly Setting a Bucket ACL

Sample code:

String endPoint = "https://your-endpoint";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

AccessControlList acl = new AccessControlList();
Owner owner = new Owner();
owner.setId("ownerid");
acl.setOwner(owner);
// Grant the FULL_CONTROL permission to a specified user.
acl.grantPermission(new CanonicalGrantee("userid"), Permission.PERMISSION_FULL_CONTROL);
// Grant the READ permission to all users.
acl.grantPermission(GroupGrantee.ALL_USERS, Permission.PERMISSION_READ);
// Directly set the bucket ACL.
obsClient.setBucketAcl("bucketname", acl);

The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credential page of OBS Console.

Obtaining a Bucket ACL

You can call ObsClient.getBucketAcl to obtain the bucket ACL. Sample code is as follows:

String endPoint = "https://your-endpoint";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

AccessControlList acl = obsClient.getBucketAcl("bucketname");
System.out.println(acl);
Parent topic: Bucket Management