Configuring BPA for a Bucket (SDK for C)

If you have any questions during development, post them on the Issues page of GitHub.

Function

Public access means that a requester can access a bucket and its data without specific permissions or identity authentication. This poses risks such as data leak and malicious access. OBS supports Block Public Access (BPA) for buckets. You can call this API to configure bucket-level BPA to ensure data security in your bucket.

If BPA is enabled, existing public access permissions are ignored and new public access permissions cannot be configured. If BPA is disabled, existing public access permissions continue to apply and new public access permissions can be configured.

Restrictions

To configure BPA for a bucket, you must be the bucket owner or have the required permission (obs:bucket:PutBucketPublicAccessBlock granted using IAM or PutBucketPublicAccessBlock granted using a bucket policy). For details, see Introduction to OBS Access Control, IAM Custom Policies, and Creating a Custom Bucket Policy.
The mapping between OBS regions and endpoints must comply with what is listed in Regions and Endpoints.
You can enable BPA only for buckets, not for accounts or specified objects.
To ensure that BPA can work appropriately, the total size of all bucket policies cannot exceed 20 KB, and the combined size of all ACLs and bucket policies cannot exceed 32 KB. If the size exceeds the upper limit, requests for setting bucket policies or bucket ACLs, querying the public status of buckets, and enabling BPA may be denied, with error code 400 and message "Bucket policy and bucket acl is too large/complicated to perform block public access analysis" returned.
BPA is not available for back-to-source by mirroring scenarios.
During cross-region replication, if the destination bucket has the BlockPublicAcls setting, objects with public ACLs in the source bucket will fail to be replicated.

Method

void put_bucket_public_access_block(const obs_options *options,
    const obs_bucket_public_access_block *public_access_block,
    obs_response_handler *handler, void *callback_data);

Request Parameters

**Table 1** List of request parameters
Parameter	Type	Mandatory (Yes/No)	Description
options	const obs_options*	Yes	Explanation: Context of the requested bucket. Configure options (SDK for C) and set the AK, SK, endpoint, bucket, timeout interval, and temporary credentials through obs_options. Restrictions: None Value range: None Default value: None
public_access_block	const Table 2*	Yes	Explanation: Bucket-level BPA configuration structure. Restrictions: None Value range: None Default value: None
handler	obs_response_handler *	Yes	Explanation: A callback structure where all members are pointers to callback functions, used to set the callback functions that handle response data. Restrictions: None Value range: None Default value: None
callback_data	void *	No	Explanation: Custom callback data. Restrictions: None Value range: None Default value: None

**Table 2** obs_bucket_public_access_block
Parameter	Type	Mandatory (Yes/No)	Description
block_public_acls	bool	Yes	Explanation: Whether to block public ACLs. If this parameter is set to true, object upload and ACL modification APIs are not allowed to set public ACLs. Restrictions: None Value range: true: Public ACLs are blocked. false: Public ACLs are not blocked. Default value: false
ignore_public_acls	bool	Yes	Explanation: Whether to ignore public ACLs. If this parameter is set to true, public ACLs do not take effect when OBS checks permissions. Restrictions: None Value range: true: Public ACLs are ignored. false: Public ACLs are not ignored. Default value: false
block_public_policy	bool	Yes	Explanation: Whether to block public policies. If this parameter is set to true, public policies cannot be set using the API for modifying bucket policies. Restrictions: None Value range: true: Public policies are blocked. false: Public policies are not blocked. Default value: false
restrict_public_buckets	bool	Yes	Explanation: Whether to restrict the existing public bucket policy. If this parameter is set to true, only the cloud service and bucket owner accounts are allowed to access the bucket. Restrictions: This configuration does not affect existing bucket policies or prohibit the configuration of new public bucket policies. Value range: true: The account access is restricted. false: The account access is not restricted. Default value: false

Sample Code

This example configures BPA for a bucket.

     #include "eSDKOBS.h"
#include <stdio.h>
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data);
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data);
int main()
{
    obs_initialize(OBS_INIT_ALL);
    obs_options options;
    init_obs_options(&options);
    // Enter the endpoint corresponding to the bucket for host_name. CN-Hong Kong is used here as an example. Replace it with the one currently in use.
    options.bucket_options.host_name = "obs.ap-southeast-1.myhuaweicloud.com";
    // Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
    // In this example, the AK and SK are stored in environment variables for identity authentication. Before running the code in this example, configure local environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY.
    options.bucket_options.access_key = getenv("ACCESS_KEY_ID");
    options.bucket_options.secret_access_key = getenv("SECRET_ACCESS_KEY");
    options.bucket_options.bucket_name = "example-bucket-name";
    // Configure BPA and enable all protection switches.
    obs_bucket_public_access_block bpa_config = {0};
    bpa_config.block_public_acls = true;
    bpa_config.ignore_public_acls = true;
    bpa_config.block_public_policy = true;
    bpa_config.restrict_public_buckets = true;
    obs_response_handler response_handler = {&response_properties_callback, &response_complete_callback};
    obs_status ret_status = OBS_STATUS_BUTT;
    put_bucket_public_access_block(&options, &bpa_config, &response_handler, &ret_status);
    if (OBS_STATUS_OK == ret_status) {
        printf("put bucket public access block successfully.\n");
    } else {
        printf("put bucket public access block failed(%s).\n", obs_get_status_name(ret_status));
    }
    obs_deinitialize();
}
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data)
{
    (void)properties; (void)callback_data;
    return OBS_STATUS_OK;
}
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data)
{
    if (callback_data) { *(obs_status*)callback_data = status; }
    if (error && error->message) { printf("Error: %s\n", error->message); }
}
 
 
  