Configuring a Bucket Policy (SDK for C)

Function

A bucket policy is an access control policy that applies to a bucket and objects in it. You can use a bucket policy to authorize other accounts to perform specified operations on the bucket and resources in it. Compared with ACLs, bucket policies provide more refined permission control. They can control not only authorized accounts but also anonymous users' access to buckets and objects. In addition, bucket policies support the specification of resources, conditions, and actions.

This API is used to configure a policy for a bucket.

Restrictions

• To configure a policy for a bucket, you must be the bucket owner or have the required permission (obs:bucket:PutBucketPolicy granted using IAM or PutBucketPolicy granted using a bucket policy). For details, see Introduction to OBS Access Control, IAM Custom Policies, and Creating a Custom Bucket Policy.
• The mapping between OBS regions and endpoints must comply with what is listed in Regions and Endpoints.
• If a bucket already has a policy, the policy will be overwritten by the one specified in this request.
• There is no limit on the number of bucket policies (statements) for a bucket, but the JSON descriptions of all bucket policies in a bucket cannot exceed 20 KB in total.

Method

void set_bucket_policy(const obs_options *options, const char *policy,
           obs_response_handler *handler, void *callback_data);

Request Parameters

Sample Code

This example configures a policy for a bucket to allow a specified account to read objects in the bucket.

#include "eSDKOBS.h"
#include <stdio.h>
// Response callback function
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data);
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data);
int main()
{
    // Call the obs_initialize method at the program entry to initialize global resources such as the network and memory.
    obs_status ret_status = obs_initialize(OBS_INIT_ALL);
    if (OBS_STATUS_OK != ret_status)
    {
        printf("obs_initialize failed(%s).\n", obs_get_status_name(ret_status));
        return -1;
    }
    obs_options options;
    // Create and initialize options, including the access domain name (host_name), access keys (access_key and secret_access_key), and bucket name (bucket_name).
    init_obs_options(&options);
    // Enter the endpoint corresponding to the bucket for host_name. CN North-Beijing4 is used here as an example. Replace it with the one currently in use.
    options.bucket_options.host_name = "obs.cn-north-4.myhuaweicloud.com";
    // Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
    // In this example, the AK and SK are stored in environment variables for identity authentication. Before running the code in this example, configure local environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY.
    options.bucket_options.access_key = getenv("ACCESS_KEY_ID");
    options.bucket_options.secret_access_key = getenv("SECRET_ACCESS_KEY");
    if (!options.bucket_options.access_key || !options.bucket_options.secret_access_key) {
        printf("ERROR: ACCESS_KEY_ID and SECRET_ACCESS_KEY environment variables must be set.\n");
        obs_deinitialize();
        return -1;
    }
    // Specify the bucket name, for example, example-bucket-name.
    options.bucket_options.bucket_name = "example-bucket-name";
    // Configure the bucket policy. In this example, the specified account is allowed to read objects in the bucket.
    // Replace domain_id with the actual account ID. For details about how to obtain the account ID, see Obtaining an Account ID and a User ID. 
    const char *domain_id = "0a******************************0a";
    const char *bucket_name = "example-bucket-name";
    char bucket_policy[4096] = {0};
    snprintf_s(bucket_policy, sizeof(bucket_policy), _TRUNCATE,
        "{"
        "\"Statement\":[{"
        "\"Sid\":\"AllowAccountRead\","
        "\"Effect\":\"Allow\","
        "\"Resource\":\"%s/*\","
        "\"Principal\":{\"ID\":[\"%s\"]},"
        "\"Action\":[\"GetObject\"]"
        "}]"
        "}",
        bucket_name, domain_id);
    // Set the response callback function.
    obs_response_handler response_handler =
    {
        &response_properties_callback,
        &response_complete_callback
    };
    ret_status = OBS_STATUS_BUTT;
    set_bucket_policy(&options, bucket_policy, &response_handler, &ret_status);
    if (OBS_STATUS_OK == ret_status) {
        printf("set bucket policy successfully.\n");
    } else {
        printf("set bucket policy failed(%s).\n", obs_get_status_name(ret_status));
    }
    // Release the allocated global resources.
    obs_deinitialize();
}
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data)
{
    (void)properties; (void)callback_data;
    return OBS_STATUS_OK;
}
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data)
{
    if (callback_data) { *(obs_status*)callback_data = status; }
    if (error && error->message) { printf("Error: %s\n", error->message); }
}

Helpful Links

• Configuring a Bucket Policy
• OBS Error Codes
• Access Control FAQ