Help Center/ Object Storage Service/ SDK Reference/ BrowserJS/ Object Management/ Managing Object ACLs
Updated on 2024-04-26 GMT+08:00
View PDF

Managing Object ACLs

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see the API Reference.

Object ACLs, similar to bucket ACLs, support pre-defined access control policies and direct configuration. For details, see Managing Bucket ACLs.

An object ACL can be configured in any of the following ways:

  1. Specify a pre-defined access control policy during object upload.
  2. Call ObsClient.setObjectAcl to specify a pre-defined access control policy.
  3. Call ObsClient.setObjectAcl to set the ACL directly.

Specifying a Pre-defined Access Control Policy During Object Upload

Sample code:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

obsClient.putObject({
       Bucket : 'bucketname',
       Key : 'objectname',
       Body : 'Hello OBS',
       // Set the object ACL to public-read.
       ACL : obsClient.enums.AclPublicRead
}, function (err, result){
       if(err){              
          console.error('Error-->' + err);       
       }else{              
          console.log('Status-->' + result.CommonMsg.Status);        
       }
});

Setting a Pre-defined Access Control Policy for an Object

Sample code:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

obsClient.setObjectAcl({
       Bucket : 'bucketname',
       Key : 'objectname',
       // Set the object ACL to private.
       ACL : obsClient.enums.AclPrivate
}, function (err, result) {
       if(err){              
          console.error('Error-->' + err);       
       }else{              
          console.log('Status-->' + result.CommonMsg.Status);        
       }
});

Use the ACL parameter to specify access permissions for an object.

Directly Setting an Object ACL

Sample code:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

obsClient.setObjectAcl({
       Bucket : 'bucketname',
       Key : 'objectname',
       // Set the object owner.  
       Owner:{'ID':'ownerid'},
       Grants:[                             
              // Grant all permissions to a specified user.
               { Grantee : {Type : 'CanonicalUser',ID : 'userid'}, Permission : obsClient.enums.PermissionFullControl},
                     // Grant the READ permission to all users.
               { Grantee: {Type : 'Group', URI : obsClient.enums.GroupAllUsers}, Permission : obsClient.enums.PermissionRead}
       ]
}, function (err, result) {
       if(err){              
          console.error('Error-->' + err);       
       }else{              
          console.log('Status-->' + result.CommonMsg.Status);        
       }
});
  • Use the Owner parameter to specify the object owner and the Grants parameter to specify information about the authorized users.
  • The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credential page of OBS Console.
  • OBS buckets support the following grantee group:
    • All users: ObsClient.enums.GroupAllUsers

Obtaining an Object ACL

You can call ObsClient.getObjectAcl to obtain an object ACL. Sample code is as follows:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/eu/usermanual-ca/ca_01_0003.html.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    // Replace the example endpoint with the actual one in your case.
    server: 'https://obs.eu-west-101.myhuaweicloud.eu'
});

obsClient.getObjectAcl({
       Bucket : 'bucketname',
       Key : 'objectname'
}, function (err, result) {
       if(err){              
          console.error('Error-->' + err);       
       }else{              
          console.log('Status-->' + result.CommonMsg.Status);
                 if(result.CommonMsg.Status < 300 && result.InterfaceResult){
                           console.log('Owner[ID]-->' + result.InterfaceResult.Owner.ID);
                           for(var i in result.InterfaceResult.Grants){
                                  console.log('Grant[' + i + ']:');
                                  console.log('Grantee[ID]-->' + result.InterfaceResult.Grants[i]['Grantee']['ID']);
                                  console.log('Grantee[URI]-->' + result.InterfaceResult.Grants[i]['Grantee']['URI']);
                                  console.log('Permission-->' + result.InterfaceResult.Grants[i]['Permission']);
                           }
                 }            
       }
});
Parent topic: Object Management