Adding Tags to an Object

Tag Rules

OBS offers object tags for you to classify objects in buckets. You can tag an object when you upload it to a bucket or after it is stored in the bucket.

An object tag is a key-value pair. To use tags, follow the rules below:

• An object can have up to 10 tags.
• A tag key:
  • Must be unique if there are multiple tags specified for an object.
  • Can be up to 128 characters long. It must be case sensitive and unique and cannot start or end with a space. It cannot be left blank and cannot contain any ASCII control characters (0x00–0x1F) or the following special characters: / | < > = * \ A key must be URL-encoded before being sent to the server.
• A tag value:

  Can be up to 255 characters long. It must be case sensitive and cannot start or end with a space. It can be left blank, but cannot contain any ASCII control characters (0x00–0x1F) or the following special characters: / | < > = * \ A value must be URL-encoded before being sent to the server.

Important Notes

• Object tags are now in open beta testing, and you can use them for free. Once the testing period is over, you will be billed for using object tags.
• To read or write object tags, you must have required permissions. Such permissions can be granted using bucket policies. By default, only the object owner can read or write the object's tags.
• You can add tags during PUT upload, multipart upload, simple upload, and copy operations, or after objects are uploaded.
• Add or changing tags does not change the LastModified time of the object.
• During cross-region replication, tags of source objects are not copied.
• Tags cannot be added to files in parallel file systems.

Access Control

Only the object owner and users who have the required permissions can perform operations related to object tags. The permissions can be granted through IAM or bucket policies. For details, see Creating a Custom Policy or Creating a Custom Bucket Policy.

• Permissions required for object tag operations (versioning disabled):
  • obs:object:PutObjectTagging used to add object tags
  • obs:object:GetObjectTagging used to obtain object tags
  • obs:object:DeleteObjectTagging used to delete object tags
• Permissions required for object tag operations (versioning enabled):
  • obs:object:PutObjectVersionTagging used to add object tags
  • obs:object:GetObjectVersionTagging used to obtain object tags
  • obs:object:DeleteObjectVersionTagging used to delete object tags

If you have permission to add object tags in an IAM policy but the operation still fails, a Deny statement in an SCP policy or bucket policy is the most likely cause. Allow the required permission and then perform the operation.

For example, to allow users to access objects with specific tags, configure the policy by referring to Authorizing an IAM User to Operate Objects with Specific Tags.

Scenarios

Specifying object tags in a lifecycle rule

<LifecycleConfiguration>
    <Rule>
        <ID>sample-rule</ID>  
        <Filter>
            <And>
                <Prefix>texta/</Prefix>
                <Tag>
                    <Key>key1</Key>
                    <Value>value1</Value>
                </Tag>
                <Tag>
                    <Key>key2</Key>
                    <Value>value2</Value>
                </Tag>
            </And>
        </Filter>
        <Status>Enabled</Status>
        <Expiration>
            <Days>120</Days>
        </Expiration>
    </Rule>
</LifecycleConfiguration>

• Authorize an IAM user to operate objects with a specific tag.

  Object tags can be used for fine-grained access control. For example, to authorize an IAM user to access all objects with a key2/value2 tag, configure the IAM policy as follows:

  {
  	"Statement": [{
  		"Effect": "Allow",
  		"Action": ["GetObject"],
  		"Resource": "*",
  		"Condition": {
  			"StringEquals": {
  				"ExistingObjectTag/key2":["value2"]
  			}
  		}
  	}]
  }

Ways to Add Object Tags

You can use OBS Console obsutil, or APIs to add tags to an object. You cannot use SDKs or OBS Browser+ to do so.

Logging and Monitoring

OBS provides end-to-end logging and auditing capabilities to help you promptly detect and handle deletion operations. You can configure object tagging operations (REST.PUT.TAGGING, REST.GET.TAGGING, and REST.DEL.TAGGING) and enable CTS to record the corresponding events (setBucketTagging, getBucketTagging, and deleteBucketTagging). The system will record detailed logs for all object tagging operations for auditing or further analysis. For details, see Using Logging to Record OBS Logs.

Related Operations

In the tag list, click Edit to change the tag value or click Delete to remove the tag.

Helpful Links

• You can configure lifecycle rules to manage objects. For details, see Lifecycle Management.
• You can configure a bucket policy to allow access to objects with specified tags. For details, see Configuring a Bucket Policy.