Managing Bucket ACLs
Access control lists (ACLs) allow resource owners to grant other accounts the permissions to access resources. By default, only the resource owner has full control over resources when a bucket or object is created. That is, the bucket creator has full control over the bucket, and the object uploader has full control over the object. Other accounts do not have the permissions to access resources. If resource owners want to grant other accounts the read and write permissions on resources, they can use ACLs. ACLs grant permissions to accounts. After an account is granted permissions, both the account and its IAM users can access the resources.
For more information, see ACLs.
A bucket ACL can be configured in any of the following ways:
- Specify a pre-defined ACL when creating a bucket.
- Call OBSSetBucketACLWithCannedACLRequest to specify a pre-defined ACL.
- Call OBSSetBucketACLWithPolicyRequest to specify a user-defined ACL.
OBS supports five types of bucket or object ACLs. For details, see the following table:
Permission |
Description |
Enumeration Value in OBS iOS SDK |
---|---|---|
READ |
A grantee with this permission for a bucket can obtain the list of objects in and metadata of the bucket. A grantee with this permission for an object can obtain the object content and metadata. |
OBSACLRead |
WRITE |
A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket. This permission is not applicable to objects. |
OBSACLWrite |
READ_ACP |
A grantee with this permission can obtain the ACL of a bucket or object. A bucket or object owner has this permission permanently. |
OBSACLRead_ACP |
WRITE_ACP |
A grantee with this permission can update the ACL of a bucket or object. A bucket or object owner has this permission permanently. A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions. |
OBSACLWrite_ACP |
FULL_CONTROL |
A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket. A grantee with this permission for an object has READ, READ_ACP, and WRITE_ACP permissions for the object. |
OBSACLFull_Control |
There are five access control policies pre-defined in OBS, as described in the following table:
Policy |
Description |
Enumeration Value in OBS iOS SDK |
---|---|---|
private |
Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object. |
OBSACLPolicyPrivate |
public-read |
Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ permission. |
OBSACLPolicyPublicRead |
public-read-write |
Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ and WRITE permissions. |
OBSACLPolicyPublicReadWrite |
public-read-delivered |
If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket. This permission cannot be set for objects. |
OBSACLPolicyPublicReadDelivered |
public-read-write-delivered |
If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart tasks in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; abort multipart uploads; and obtain content and metadata of objects in the bucket. This permission cannot be set for objects. |
OBSACLPolicyPublicReadWriteDelivered |
Specifying a Pre-defined ACL During Bucket Creation
Sample code:
static OBSClient *client; NSString *endPoint = @"your-endpoint"; // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey. // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html. char* ak_env = getenv("AccessKeyID"); char* sk_env = getenv("SecretAccessKey"); NSString *AK = [NSString stringWithUTF8String:ak_env]; NSString *SK = [NSString stringWithUTF8String:sk_env]; // Initialize identity authentication. OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK]; //Initialize service configuration. OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider]; // Initialize an instance of OBSClient. client = [[OBSClient alloc] initWithConfiguration:conf]; //Create a bucket. OBSCreateBucketRequest *request = [[OBSCreateBucketRequest alloc] initWithBucketName:@"bucketname"]; // Set the ACL to public read and write. request.bucketACLPolicy = OBSACLPolicyPublicReadWrite; [client createBucket:request completionHandler:^(OBSCreateBucketResponse *response, NSError *error) { NSLog(@"%@",response.location); }];
Setting a Pre-defined ACL for a Bucket
Sample code:
static OBSClient *client; NSString *endPoint = @"your-endpoint"; // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey. // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html. char* ak_env = getenv("AccessKeyID"); char* sk_env = getenv("SecretAccessKey"); NSString *AK = [NSString stringWithUTF8String:ak_env]; NSString *SK = [NSString stringWithUTF8String:sk_env]; // Initialize identity authentication. OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK]; //Initialize service configuration. OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider]; // Initialize an instance of OBSClient. client = [[OBSClient alloc] initWithConfiguration:conf]; //Set the pre-defined ACL to public read and private write. OBSSetBucketACLWithCannedACLRequest *request = [[OBSSetBucketACLWithCannedACLRequest alloc]initWithBucketName:@"bucketname" cannedACL:OBSACLPolicyPublicRead]; [client setBucketACL:request completionHandler:^(OBSSetBucketACLResponse *response, NSError *error){ NSLog(@"%@",response); }];
Setting a User-defined Bucket ACL
Sample code:
static OBSClient *client; NSString *endPoint = @"your-endpoint"; // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey. // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html. char* ak_env = getenv("AccessKeyID"); char* sk_env = getenv("SecretAccessKey"); NSString *AK = [NSString stringWithUTF8String:ak_env]; NSString *SK = [NSString stringWithUTF8String:sk_env]; // Initialize identity authentication. OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK]; //Initialize service configuration. OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider]; // Initialize an instance of OBSClient. client = [[OBSClient alloc] initWithConfiguration:conf]; // Initialize an instance of OBSUser. OBSUser *owner = [[OBSUser alloc] initWithID:@"ownerID"]; // Set a grantee. OBSACLGranteeUser *grantee = [[OBSACLGranteeUser alloc]initWithID:@"granteeID"]; // Grant the FULL_CONTROL permission to the grantee. OBSACLGrant *grant = [[OBSACLGrant alloc]initWithGrantee:grantee permission:OBSACLFull_Control]; // Create a policy object. OBSAccessControlPolicy *policy = [OBSAccessControlPolicy new]; policy.owner = owner; [policy.accessControlList addObject:grant]; // Set the bucket ACL. OBSSetBucketACLWithPolicyRequest *request = [[OBSSetBucketACLWithPolicyRequest alloc]initWithBucketName:@"bucketname" accessControlPolicy:policy]; [client setBucketACL:request completionHandler:^(OBSSetBucketACLResponse *response, NSError *error){ NSLog(@"%@",response); }];

- The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credentials page of OBS Console.
Obtaining a Bucket ACL
You can call getBucketACL to obtain the bucket ACL. Sample code:
static OBSClient *client; NSString *endPoint = @"your-endpoint"; // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey. // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html. char* ak_env = getenv("AccessKeyID"); char* sk_env = getenv("SecretAccessKey"); NSString *AK = [NSString stringWithUTF8String:ak_env]; NSString *SK = [NSString stringWithUTF8String:sk_env]; // Initialize identity authentication. OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK]; //Initialize service configuration. OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider]; // Initialize an instance of OBSClient. client = [[OBSClient alloc] initWithConfiguration:conf]; // Obtain the bucket ACL. OBSGetBucketACLRequest *request = [[OBSGetBucketACLRequest alloc] initWithBucketName:@"bucketname"]; [client getBucketACL:request completionHandler:^(OBSGetBucketACLResponse *response, NSError *error){ NSLog(@"%@",response); }];
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot