Updated on 2024-04-26 GMT+08:00

Managing Bucket ACLs

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see the API Reference.

A bucket ACL can be configured in any of the following ways:

  1. Call ObsClient.setBucketAcl to specify a pre-defined access control policy.
  2. Call ObsClient.setBucketAcl to set the ACL directly.

The following table lists the five permission types supported by OBS.

Permission

Description

Value in OBS BrowserJS SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket.

A grantee with this permission for an object can obtain the object content and metadata.

ObsClient.enums.PermissionRead

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket.

This permission is not applicable to objects.

ObsClient.enums.PermissionWrite

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

ObsClient.enums.PermissionReadAcp

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

ObsClient.enums.PermissionWriteAcp

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket.

A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.

ObsClient.enums.PermissionFullControl

There are five access control policies pre-defined in OBS, as described in the following table:

Policy

Description

Value in OBS BrowserJS SDK

private

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

ObsClient.enums.AclPrivate

public-read

If this permission is set for a bucket, everyone can obtain the list of objects, multipart uploads, and object versions in the bucket, as well as metadata of the bucket.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

ObsClient.enums.AclPublicRead

public-read-write

If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart uploads in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; and abort multipart uploads.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

ObsClient.enums.AclPublicReadWrite

public-read-delivered

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket.

This permission cannot be set for objects.

ObsClient.enums.AclPublicReadDelivered

public-read-write-delivered

If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart uploads in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; cancel multipart uploads; and obtain content and metadata of objects in the bucket.

This permission cannot be set for objects.

ObsClient.enums.AclPublicReadWriteDelivered

Setting a Pre-defined Access Control Policy for a Bucket

Sample code:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

// Use a pre-defined access control policy to set the bucket ACL.
obsClient.setBucketAcl({
       Bucket: 'bucketname',
       // Set the bucket ACL to private.
       ACL: obsClient.enums.AclPrivate
}, function (err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

Use the ACL parameter to specify the ACL for a bucket.

Directly Setting a Bucket ACL

Sample code:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

// Directly set the bucket ACL.
obsClient.setBucketAcl({
       Bucket: 'bucketname',
       // Set the bucket owner.
       Owner: {'ID': 'ownerid'},
       Grants: [
             // Grant all permissions to a specified user.
            { Grantee : {Type : 'CanonicalUser',ID : 'userid'}, Permission : obsClient.enums.PermissionFullControl},
             // Grant the READ permission to all users.
            { Grantee : {Type : 'Group',URI : obsClient.enums.GroupAuthenticatedUsers}, Permission : obsClient.enums.AclPublicRead}
       ]
}, function (err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});
  • Use the Owner parameter to specify the bucket owner and the Grants parameter to specify the information about authorized users.
  • The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credential page of OBS Console.
  • OBS buckets support the following grantee group:
    • All users: ObsClient.enums.GroupAllUsers

Obtaining a Bucket ACL

You can call ObsClient.getBucketAcl to obtain the bucket ACL. Sample code is as follows:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

obsClient.getBucketAcl({
       Bucket: 'bucketname',
}, function (err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
              if(result.CommonMsg.Status < 300 && result.InterfaceResult){
                     console.log('RequestId-->' + result.InterfaceResult.RequestId);
                     console.log('Owner[ID]-->' + result.InterfaceResult.Owner.ID);
                     console.log('Grants:');
                     for(var i in result.InterfaceResult.Grants){
                           console.log('Grant[' + i + ']:');
                           console.log('Grantee[ID]-->' + result.InterfaceResult.Grants[i]['Grantee']['ID']);
                           console.log('Grantee[URI]-->' + result.InterfaceResult.Grants[i]['Grantee']['URI']);
                           console.log('Permission-->' + result.InterfaceResult.Grants[i]['Permission']);
                     }
              }
       }
});