Configuring Public Access Block for a Bucket

Functions

This API creates or modifies the public access block configuration of an OBS bucket by enabling or disabling the feature.

To perform this operation, you must have the PutBucketPublicAccessBlock permission. The bucket owner can perform this operation by default and can grant this permission to others by using a bucket policy or a user policy.

If public access block is enabled, existing public access permissions are ignored and new public access permissions cannot be configured. If public access block is disabled, existing public access permissions continue to apply and new public access permissions can be configured.

Authorization Information

To call this API, you must be the bucket owner or have the permission to configure public access block for a bucket. You are advised to use IAM or bucket policies for authorization. For details about OBS authorization methods, see Differences Between OBS Permissions Control Methods.

• If you use IAM for authorization, you need to use either role/policy-based authorization or identity policy-based authorization and configure the required permissions:
  • If you use role/policy-based authorization (IAM v3 APIs in the old IAM version), you need to grant the obs:bucket:PutBucketPublicAccessBlock permission. For details, see Creating a Custom IAM Policy.
  • If you use identity policy-based authorization (IAM v5 APIs in the new IAM version), you need to grant the obs:bucket:putBucketPublicAccessBlock permission, as shown in the following table. For details, see Creating a Custom IAM Identity Policy.

    Action	Access Level	Resource Type (*: Required)	Condition Key	Alias	Dependencies
    obs:bucket:putBucketPublicAccessBlock	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-	-
    		-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain

• If you use bucket policies for authorization, you need to grant the obs:bucket:PutBucketPublicAccessBlock permission. For details, see Creating a Custom Bucket Policy.

Request Syntax

PUT /?publicAccessBlock HTTP/1.1
Host: bucketname.obs.region.myhuaweicloud.com 
Date: date
Authorization: authorization
Content-Type: application/xml
Content-Length: length

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>boolean</BlockPublicAcls>
	<IgnorePublicAcls>boolean</IgnorePublicAcls>
	<BlockPublicPolicy>boolean</BlockPublicPolicy>
	<RestrictPublicBuckets>boolean</RestrictPublicBuckets>
</PublicAccessBlockConfiguration>

Request Parameters

This request contains no parameters.

Request Headers

This request uses common headers. For details, see Table 3.

Request Elements

This request can use additional elements. For details about additional elements, see Table 1.

Response Syntax

HTTP/1.1 status_code
Date: date

Response Headers

This response uses common headers. For details, see Table 1.

Response Elements

This response contains no elements.

Error Responses

Table 2 describes possible special errors in this request.

For other errors, see Table 2.

Sample Request: Setting All Four Parameters to true

put /?publicAccessBlock HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Sat, 16 Nov 2024 08:59:07 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 288

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>true</BlockPublicAcls>
	<IgnorePublicAcls>true</IgnorePublicAcls>
	<BlockPublicPolicy>true</BlockPublicPolicy>
	<RestrictPublicBuckets>true</RestrictPublicBuckets>
</PublicAccessBlockConfiguration>

Sample Response: Setting All Four Parameters to true

HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF260000016435CE298386946AE4C482
x-obs-id-2: 32AAAQAAEAABSAAgAAEAABAAAQAAEAABCT9W2tcvLmMJ+plfdopaD62S0npbaRUz
Date: Sat, 16 Nov 2024 08:59:08 GMT
Content-Length: 0

Sample Request: Setting Only BlockPublicAcls to true

PUT /?publicAccessBlock HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Sat, 16 Nov 2024 08:59:07 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:75/Y4Ng1izvzc1nTGxpMXTE6ynw=
Content-Length: 147

<?xml version="1.0" encoding="UTF-8"?>
<PublicAccessBlockConfiguration>
	<BlockPublicAcls>true</BlockPublicAcls>
</PublicAccessBlockConfiguration>

Sample Response: Setting Only BlockPublicAcls to true

HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF260000016435CE298386946AE4C482
x-obs-id-2: 32AAAQAAEAABSAAgAAEAABAAAQAAEAABCT9W2tcvLmMJ+plfdopaD62S0npbaRUz
Date: Sat, 16 Nov 2024 08:59:08 GMT
Content-Length: 0