Managing Bucket ACLs

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see the API Reference.

A bucket ACL can be configured in any of the following ways:

Specify a pre-defined access control policy during bucket creation.
Call ObsClient.setBucketAcl to specify a pre-defined access control policy.
Call ObsClient.setBucketAcl to set the ACL directly.

The following table lists the five permission types supported by OBS.

Permission	Description	Value in OBS Node.js SDK
READ	A grantee with this permission for a bucket can obtain the list of objects in and metadata of the bucket. A grantee with this permission for an object can obtain the object content and metadata.	ObsClient.enums.PermissionRead
WRITE	A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket. This permission is not applicable to objects.	ObsClient.enums.PermissionWrite
READ_ACP	A grantee with this permission can obtain the ACL of a bucket or object. A bucket or object owner has this permission permanently.	ObsClient.enums.PermissionReadAcp
WRITE_ACP	A grantee with this permission can update the ACL of a bucket or object. A bucket or object owner has this permission permanently. A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.	ObsClient.enums.PermissionWriteAcp
FULL_CONTROL	A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket. A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.	ObsClient.enums.PermissionFullControl

There are five access control policies pre-defined in OBS, as described in the following table:

Permission	Description	Value in OBS Node.js SDK
private	Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.	ObsClient.enums.AclPrivate
public-read	If this permission is set for a bucket, everyone can obtain the list of objects, multipart uploads, and object versions in the bucket, as well as metadata of the bucket. If this permission is set for an object, everyone can obtain the content and metadata of the object.	ObsClient.enums.AclPublicRead
public-read-write	If this permission is granted on a bucket, anyone can obtain the object list, multipart tasks, and metadata, and can upload or delete objects, initialize multipart upload tasks, upload parts, merge parts, copy parts, and cancel multipart upload tasks. If this permission is set for an object, everyone can obtain the content and metadata of the object.	ObsClient.enums.AclPublicReadWrite
public-read-delivered	If this permission is set for a bucket, everyone can obtain the object list, multipart tasks, and bucket metadata in the bucket, and obtain the content and metadata of the objects in the bucket. This permission cannot be set for objects.	ObsClient.enums.AclPublicReadDelivered
public-read-write-delivered	If this permission is set for a bucket, everyone can obtain the object list in the bucket, multipart tasks in the bucket, metadata of the bucket; upload objects; delete objects; initialize multipart uploads; upload parts; combine parts; copy parts; abort multipart uploads; and obtain content and metadata of objects in the bucket. This permission cannot be set for objects.	ObsClient.enums.AclPublicReadWriteDelivered

Specifying a Pre-defined Access Control Policy During Bucket Creation

Sample code:

// Import the OBS library.
// Use npm to install the client.
var ObsClient = require('esdk-obs-nodejs');
// Use the source code to install the client.
// var ObsClient = require('./lib/obs');

// Create an ObsClient instance.
var obsClient = new ObsClient({
       //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
       //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
       access_key_id: process.env.ACCESS_KEY_ID,
       secret_access_key: process.env.SECRET_ACCESS_KEY,
       server : 'https://your-endpoint'
});

// Create a bucket.
obsClient.createBucket({
       Bucket : 'bucketname',
       // Set the bucket ACL to public-read-write. 
       ACL : obsClient.enums.AclPublicReadWrite
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

Setting a Pre-defined Access Control Policy for a Bucket

Sample code:

// Import the OBS library.
// Use npm to install the client.
var ObsClient = require('esdk-obs-nodejs');
// Use the source code to install the client.
// var ObsClient = require('./lib/obs');

// Create an ObsClient instance.
var obsClient = new ObsClient({
       //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
       //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
       access_key_id: process.env.ACCESS_KEY_ID,
       secret_access_key: process.env.SECRET_ACCESS_KEY,
       server : 'https://your-endpoint'
});

// Use the pre-defined access control policy to set bucket permissions.
obsClient.setBucketAcl({
       Bucket : 'bucketname',
       // Set the bucket ACL to private.
       ACL : obsClient.enums.AclPrivate
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

Use the ACL parameter to specify the ACL for a bucket.

Directly Setting a Bucket ACL

Sample code:

// Import the OBS library.
// Use npm to install the client.
var ObsClient = require('esdk-obs-nodejs');
// Use the source code to install the client.
// var ObsClient = require('./lib/obs');

// Create an ObsClient instance.
var obsClient = new ObsClient({
       //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
       //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
       access_key_id: process.env.ACCESS_KEY_ID,
       secret_access_key: process.env.SECRET_ACCESS_KEY,
       server : 'https://your-endpoint'
});

// Directly set the bucket ACL.
obsClient.setBucketAcl({
       Bucket : 'bucketname',
       // Set the bucket owner.
       Owner:{'ID':'ownerid'},
       Grants:[
             // Grant all permissions to a specified user.
            { Grantee : {Type : 'CanonicalUser',ID : 'userid'}, Permission : obsClient.enums.PermissionFullControl},
             // Grant the READ permission to all users.
            { Grantee : {Type : 'Group',URI : obsClient.enums.GroupAllUsers}, Permission : obsClient.enums.PermissionRead}
      ]
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

Use the Owner parameter to set the bucket owner and use the Grants parameter to grant permissions for authorized users.
The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credentials page of OBS Console.
OBS buckets support the following grantee group:
- All users: ObsClient.enums.GroupAllUsers

Obtaining a Bucket ACL

You can call ObsClient.getBucketAcl to obtain a bucket ACL. Sample code is as follows:

// Import the OBS library.
// Use npm to install the client.
var ObsClient = require('esdk-obs-nodejs');
// Use the source code to install the client.
// var ObsClient = require('./lib/obs');

// Create an ObsClient instance.
var obsClient = new ObsClient({
       //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
       //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
       access_key_id: process.env.ACCESS_KEY_ID,
       secret_access_key: process.env.SECRET_ACCESS_KEY,
       server : 'https://your-endpoint'
});

obsClient.getBucketAcl({
       Bucket : 'bucketname',
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
              if(result.CommonMsg.Status < 300 && result.InterfaceResult){
                     console.log('RequestId-->' + result.InterfaceResult.RequestId);
                     console.log('Owner[ID]-->' + result.InterfaceResult.Owner.ID);
                     console.log('Grants:');
                     for(let i=0;i<result.InterfaceResult.Grants.length;i++){
                           console.log('Grant[' + i + ']:');
                           console.log('Grantee[ID]-->' + result.InterfaceResult.Grants[i]['Grantee']['ID']);
                           console.log('Grantee[URI]-->' + result.InterfaceResult.Grants[i]['Grantee']['URI']);
                           console.log('Permission-->' + result.InterfaceResult.Grants[i]['Permission']);
                     }
              }
       }
});

Parent topic: Bucket Management

Previous topic: Obtaining Bucket Metadata

Next topic: Managing Bucket Policies

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot