Configuring BPA for a Bucket

Functions

Public access means that a requester can access a bucket and its data without specific permissions or identity authentication. This poses risks such as data leak and malicious access. OBS supports Block Public Access (BPA) for buckets. You can call this API to configure bucket-level BPA to ensure data security in your bucket. For more information about how to configure bucket-level BPA, see Block Public Access.

If BPA is enabled, existing public access permissions are ignored and new public access permissions cannot be configured. If BPA is disabled, existing public access permissions continue to apply and new public access permissions can be configured.

Constraints

• You can block public access only for buckets, not for accounts or specified objects.
• To ensure that Block Public Access can work appropriately, the total size of all bucket policies cannot exceed 20 KB, and the combined size of all ACLs and bucket policies cannot exceed 32 KB. If the size exceeds the upper limit, requests for setting bucket policies or bucket ACLs, querying the public status of buckets, and enabling Block Public Access may be denied, with error code 400 and message "Bucket policy and bucket acl is too large/complicated to perform block public access analysis" returned.
• Block Public Access is not available for mirroring-based back to source scenarios.
• During cross-region replication, if the destination bucket has the BlockPublicAcls setting, objects with public ACLs in the source bucket will fail to be replicated.
• To use Block Public Access, you must have the following permissions.

  Table 1 Permissions required for using Block Public Access

  Operation	Required Permissions
  Configuring Block Public Access for a bucket	Bucket owner or a user with the PutBucketPublicAccessBlock permission
  Obtaining the Block Public Access configuration of a bucket	Bucket owner or a user with the GetBucketPublicAccessBlock permission
  Deleting the Block Public Access configuration of a bucket	Bucket owner or a user with the DeleteBucketPublicAccessBlock permission
  Obtaining the public access status of a bucket policy	Bucket owner or a user with the GetBucketPolicyPublicStatus permission
  Obtaining the public access status of a bucket	Bucket owner or a user with the GetBucketPublicStatus permission

Authorization Information

To call this API, you must be the bucket owner or have the permission to configure BPA for a bucket. You are advised to use IAM or bucket policies for authorization. For details about OBS authorization methods, see Differences Between OBS Permissions Control Methods.

• If you use IAM for authorization, you need to use either role/policy-based authorization or identity policy-based authorization and configure the required permissions:
  • If you use role/policy-based authorization (IAM v3 APIs in the old IAM version), you need to grant the obs:bucket:PutBucketPublicAccessBlock permission. For details, see Creating a Custom IAM Policy.
  • If you use identity policy-based authorization (IAM v5 APIs in the new IAM version), you need to grant the obs:bucket:putBucketPublicAccessBlock permission, as shown in the following table. For details, see Creating a Custom IAM Identity Policy.

    Action	Access Level	Resource Type (*: Required)	Condition Key	Alias	Dependencies
    obs:bucket:putBucketPublicAccessBlock	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-	-
    		-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain

• If you use bucket policies for authorization, you need to grant the obs:bucket:PutBucketPublicAccessBlock permission. For details, see Creating a Custom Bucket Policy.

Request Syntax

PUT /?publicAccessBlock HTTP/1.1
Host: bucketname.obs.region.myhuaweicloud.com 
Date: date
Authorization: authorization
Content-Type: application/xml
Content-Length: length

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>boolean</BlockPublicAcls>
	<IgnorePublicAcls>boolean</IgnorePublicAcls>
	<BlockPublicPolicy>boolean</BlockPublicPolicy>
	<RestrictPublicBuckets>boolean</RestrictPublicBuckets>
</PublicAccessBlockConfiguration>

URI Parameters

This request contains no parameters.

Request Headers

This request uses common headers. For details, see Table 3.

Request Body

This request uses request body parameters. For details, see Table 2.

Response Syntax

HTTP/1.1 status_code
Date: date

Response Headers

This response uses common headers. For details, see Table 1.

Response Body

The response of this API does not contain a response body.

Error Responses

Table 3 describes possible special errors in this request.

For other errors, see Table 2.

Sample Request: Setting All Four Parameters to true

put /?publicAccessBlock HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Sat, 16 Nov 2024 08:59:07 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 288

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>true</BlockPublicAcls>
	<IgnorePublicAcls>true</IgnorePublicAcls>
	<BlockPublicPolicy>true</BlockPublicPolicy>
	<RestrictPublicBuckets>true</RestrictPublicBuckets>
</PublicAccessBlockConfiguration>

Sample Response: Setting All Four Parameters to true

HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF260000016435CE298386946AE4C482
x-obs-id-2: 32AAAQAAEAABSAAgAAEAABAAAQAAEAABCT9W2tcvLmMJ+plfdopaD62S0npbaRUz
Date: Sat, 16 Nov 2024 08:59:08 GMT
Content-Length: 0

Sample Request: Setting Only BlockPublicAcls to true

PUT /?publicAccessBlock HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Sat, 16 Nov 2024 08:59:07 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 147

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>true</BlockPublicAcls>
</PublicAccessBlockConfiguration>

Sample Response: Setting Only BlockPublicAcls to true

HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF260000016435CE298386946AE4C482
x-obs-id-2: 32AAAQAAEAABSAAgAAEAABAAAQAAEAABCT9W2tcvLmMJ+plfdopaD62S0npbaRUz
Date: Sat, 16 Nov 2024 08:59:08 GMT
Content-Length: 0

Using SDKs to Call APIs

You are advised to use OBS SDKs to call APIs. SDKs encapsulate APIs to simplify development. You can call SDK API functions to access OBS without manually calculating signatures.

References

• For more information about how to configure block public access for buckets, see Block Public Access.
• For details about the billing items involved in API operations, see Billing Items.