Configuring a Default WORM Policy for a Bucket (SDK for C)

Function

OBS provides WORM in compliance mode. After a WORM policy is configured for a bucket, if no protection policy or retention period is set for newly uploaded objects, the bucket-level WORM policy will be automatically applied to these objects. You can call this API to configure a default protection policy and retention period for a bucket.

With a bucket's default WORM policy, if you do not specify a protection policy or retention period when you upload an object to the bucket, the default policy will be automatically applied to the newly uploaded object. An object-level WORM policy requires configuring a specific date, which indicates that an object will be protected until that date. For a default bucket-level WORM policy, a retention period is required, and the protection for an object starts when the object is uploaded to the bucket.

Restrictions

• To configure a default WORM policy for a bucket, you must be the bucket owner or have the required permission (obs:bucket:PutBucketObjectLockConfiguration granted using IAM or PutBucketObjectLockConfiguration granted using a bucket policy). For details, see Introduction to OBS Access Control, IAM Custom Policies, and Creating a Custom Bucket Policy.
• The mapping between OBS regions and endpoints must comply with what is listed in Regions and Endpoints.
• Before enabling bucket-level WORM, you need to enable versioning.

  WORM protects objects based on the object version IDs. Only object versions with any WORM retention policy configured can be protected. Assume that object test.txt 001 is protected by WORM. If another file with the same name is uploaded, a new object version test.txt 002 with no WORM policy configured will be generated. In such case, test.txt 002 is not protected and can be deleted. If you download an object without specifying a version ID, the current object version (test.txt 002) will be downloaded.

• A lifecycle rule cannot delete WORM-protected objects, but can transition their storage class. After an object is no longer protected, it will be deleted when meeting the expiration rule in a lifecycle configuration.
• Once you enable WORM for a bucket, you cannot disable it or suspend versioning for the bucket, but you can disable the default WORM policy for the bucket.
• If you have deregistered your account or your account has been frozen, the WORM-protected objects will be permanently deleted.
• WORM-based protection is not available for migration.
• The metadata of a WORM-protected object can still be modified.
• Parallel file systems do not support WORM.
• The WORM mode can only be COMPLIANCE.
• The retention period can be set to 1 to 36500 days or 1 to 100 years.
• You can modify or even delete the default WORM policy of a bucket. The change applies only to the objects uploaded after the change, but not to those uploaded before.
• During a multipart upload, the object parts uploaded are not protected before they are assembled. After object parts are assembled, the new object is protected by the default bucket-level WORM policy. You can also configure an object-level WORM policy for the new object.

Method

void set_bucket_object_lock_configuration(const obs_options *options,
    obs_bucket_object_lock_configuration *object_lock_config,
    obs_response_handler *handler, void *callback_data);

Request Parameters

Sample Code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#include "eSDKOBS.h"
#include <stdio.h>
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data);
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data);
int main()
{
    obs_initialize(OBS_INIT_ALL);
    obs_options options;
    init_obs_options(&options);
    // Enter the endpoint corresponding to the bucket for host_name. CN-Hong Kong is used here as an example. Replace it with the one currently in use.
    options.bucket_options.host_name = "obs.ap-southeast-1.myhuaweicloud.com";
    // Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK and store them in the configuration file or environment variables.
    // In this example, the AK and SK are stored in environment variables for identity authentication. Before running the code in this example, configure local environment variables ACCESS_KEY_ID and SECRET_ACCESS_KEY.
    options.bucket_options.access_key = getenv("ACCESS_KEY_ID");
    options.bucket_options.secret_access_key = getenv("SECRET_ACCESS_KEY");
    options.bucket_options.bucket_name = "example-bucket-name";
    // Configure the default retention policy. Use compliance mode and set the retention period to 365 days.
    obs_worm_default_retention retention = {0};
    retention.mode = "COMPLIANCE";
    retention.days = 365;
    retention.years = 0;
    // Configure bucket-level WORM.
    obs_bucket_object_lock_configuration lock_config = {0};
    lock_config.object_lock_enabled = "Enabled";
    lock_config.default_retention = &retention;
    obs_response_handler response_handler = {&response_properties_callback, &response_complete_callback};
    obs_status ret_status = OBS_STATUS_BUTT;
    set_bucket_object_lock_configuration(&options, &lock_config, &response_handler, &ret_status);
    if (OBS_STATUS_OK == ret_status) {
        printf("set bucket object lock configuration successfully.\n");
    } else {
        printf("set bucket object lock configuration failed(%s).\n", obs_get_status_name(ret_status));
    }
    obs_deinitialize();
}
obs_status response_properties_callback(const obs_response_properties *properties, void *callback_data)
{
    (void)properties; (void)callback_data;
    return OBS_STATUS_OK;
}
void response_complete_callback(obs_status status, const obs_error_details *error, void *callback_data)
{
    if (callback_data) { *(obs_status*)callback_data = status; }
    if (error && error->message) { printf("Error: %s\n", error->message); }
}

Helpful Links

• The API for configuring a default WORM policy for a bucket
• OBS Error Codes
• For more information about how to configure bucket-level WORM policies, see Configuring WORM to Protect Objects from Being Overwritten or Deleted.