Help Center/ Object Storage Service/ SDK Reference/ PHP/ Bucket APIs/ Basic Operations/ Managing Bucket ACLs
Updated on 2026-09-22 GMT+08:00
View PDF
Share

Managing Bucket ACLs

Access control lists (ACLs) allow resource owners to grant other accounts the permissions to access resources. By default, only the bucket creator (also the bucket owner) has full control over the bucket, and only the object uploader (also the object owner) has full control over the object. If resource owners want to grant other accounts the read and write permissions on resources, they can use ACLs. ACLs grant permissions to accounts. After an account is granted permissions, both the account and its IAM users can access the resources.

For more information, see ACLs.

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see API Reference.

A bucket ACL can be configured in any of the following ways:

  1. Specify a pre-defined ACL when creating a bucket.
  2. Call ObsClient->setBucketAcl to specify a pre-defined ACL.
  3. Call ObsClient->setBucketAcl to specify a user-defined ACL.

The following table lists the five permission types supported by OBS.

Permission

Description

Value in OBS PHP SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket.

A grantee with this permission for an object can obtain the object content and metadata.

ObsClient::PermissionRead

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket.

This permission is not applicable to objects.

ObsClient::PermissionWrite

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

ObsClient::PermissionReadAcp

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

ObsClient::PermissionWriteAcp

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket.

A grantee with this permission for an object has READ, READ_ACP, and WRITE_ACP permissions for the object.

ObsClient::PermissionFullControl

The following table lists the five types of pre-defined ACLs of OBS:

Policy

Description

Value in OBS PHP SDK

private

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

ObsClient::AclPrivate

public-read

If this permission is set for a bucket, everyone can obtain the list of objects, multipart uploads, and object versions in the bucket, as well as metadata of the bucket.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

ObsClient::AclPublicRead

public-read-write

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata, and can upload or delete objects, initiate multipart uploads, upload parts, assemble parts, copy parts, and abort multipart uploads.

If this permission is set for an object, everyone can obtain the content and metadata of the object.

ObsClient::AclPublicReadWrite

public-read-delivered

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket.

This permission cannot be set for objects.

ObsClient::AclPublicReadDelivered

public-read-write-delivered

If this permission is set for a bucket, everyone can obtain the object list, multipart uploads, and bucket metadata, and can upload or delete objects, initiate multipart uploads, upload parts, assemble parts, copy parts, and abort multipart uploads. In addition, everyone can obtain the content and metadata of the objects in the bucket.

This permission cannot be set for objects.

ObsClient::AclPublicReadWriteDelivered

Specifying a Pre-defined ACL During Bucket Creation

Sample code:

<?php

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;
// Create an ObsClient instance.
$obsClient = new ObsClient([ 
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
]);

try {
     // Create a bucket.
     $resp = $obsClient->createBucket([
         'Bucket' => 'bucketname',
         // Set the bucket ACL to public read and write.
         'ACL' => ObsClient::AclPublicReadWrite
    ]);
    printf("RequestId:%s\n",$resp['RequestId']);

} catch (ObsException $e) {
      // If the operation fails, obtain the exception details.
      printf("CreateBucketFailed: Status:%d, Code:%s, Message:%s\n",
         $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
      // Close ObsClient to release resources.
      $obsClient->close();
}

Setting a Pre-defined ACL for a Bucket

Sample code:

<?php

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;
// Create an ObsClient instance.
$obsClient = new ObsClient([ 
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
]);

try {
    // Set a predefined ACL.
    $resp = $obsClient->setBucketAcl([
       'Bucket' => 'bucketname',
       // Set the bucket ACL to private read and write.
       'ACL' => ObsClient::AclPrivate
    ]);
    printf("RequestId:%s\n",$resp['RequestId']);
} catch (ObsException $e) {
      // If the operation fails, obtain the exception details.
      printf("SetBucketAclFailed: Status:%d, Code:%s, Message:%s\n",
         $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
      // Close ObsClient to release resources.
      $obsClient->close();
}

Setting a User-defined Bucket ACL

Sample code:

<?php

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;
// Create an ObsClient instance.
$obsClient = new ObsClient([ 
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
]);

try {
    // Set a user-defined bucket ACL.
    $resp = $obsClient->setBucketAcl([
        'Bucket' => 'bucketname',
        // Set the bucket owner.
        'Owner' => [
             'ID' => 'ownerid'
        ],
        'Grants' => [
             // Grant the full control permission to a specified user.
             ['Grantee' => ['Type' => 'CanonicalUser', 'ID' => 'userid'], 'Permission' => ObsClient::PermissionFullControl],
             // Grant the read permission to all users.
             ['Grantee' => ['Type' => 'Group', 'URI' => ObsClient::GroupAllUsers], 'Permission' => ObsClient::PermissionRead],
        ]
    ]);

    printf("RequestId:%s\n",$resp['RequestId']);
} catch (ObsException $e) {
      // If the operation fails, obtain the exception details.
      printf("SetBucketAclFailed: Status:%d, Code:%s, Message:%s\n",
         $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
      // Close ObsClient to release resources.
      $obsClient->close();
}
  • Use the Owner parameter to specify the bucket owner and the Grants parameter to specify the information about authorized users.
  • The owner or grantee ID required in the ACL indicates an account ID, which can be viewed on the My Credentials page of OBS Console.
  • OBS buckets support the following grantee group:

    All users: ObsClient::GroupAllUsers

Obtaining a Bucket ACL

You can call ObsClient->getBucketAcl to obtain the bucket ACL. Sample code is as follows:

<?php

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;
// Create an ObsClient instance.
$obsClient = new ObsClient([ 
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
]);

try {
    // Obtain the bucket ACL.
    $resp = $obsClient->getBucketAcl([
       'Bucket' => 'bucketname'
    ]);

    printf("RequestId:%s\n",$resp['RequestId']);
    printf("Owner[ID]:%s\n", $resp['Owner']['ID']);
    foreach ($resp['Grants'] as $index => $grant) {
        printf("Grants[%d]\n", $index + 1);
        printf("Grantee[ID]:%s\n", $grant['Grantee']['ID']);
        printf("Grantee[URI]:%s\n", $grant['Grantee']['URI']);
        printf("Permission:%s\n", $grant['Permission']); 
    }
} catch (ObsException $e) {
      // If the operation fails, obtain the exception details.
      printf("GetBucketAclFailed: Status:%d, Code:%s, Message:%s\n",
         $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
      // Close ObsClient to release resources.
      $obsClient->close();
}
Parent topic: Basic Operations