Managing Object ACLs

Access control lists (ACLs) allow resource owners to grant other accounts the permissions to access resources. By default, only the bucket creator (also the bucket owner) has full control over the bucket, and only the object uploader (also the object owner) has full control over the object. If resource owners want to grant other accounts the read and write permissions on resources, they can use ACLs. ACLs grant permissions to accounts. After an account is granted permissions, both the account and its IAM users can access the resources.

For more information, see ACLs.

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see API Reference.

An object ACL can be configured in any of the following ways:

1. Specify a pre-defined ACL during object upload.
2. Call ObsClient->setObjectAcl to specify the pre-defined ACL.
3. Call ObsClient->setObjectAcl to specify a user-defined ACL.

<?php

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;
// Create an ObsClient instance.
$obsClient = new ObsClient([ 
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
    'signature' => 'obs'
]);

try {
    $resp = $obsClient->putObject([
        'Bucket' => 'bucketname',
        'Key' => 'objectname',
        'Body' => 'Hello OBS',
        // Set the object ACL to public read.
        'ACL' => ObsClient::AclPublicRead
    ]);
    printf("RequestId:%s\n", $resp['RequestId']);
} catch (ObsException $e) {
    printf("PutObjectFailed: Status:%d, Code:%s, Message:%s\n",
        $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
    $obsClient->close();
}

<?php
// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;

// Create an ObsClient instance.
$obsClient = new ObsClient([
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
    'signature' => 'obs'
]);

// Set the object ACL.
try {
    $resp = $obsClient->setObjectAcl([
        'Bucket' => 'bucketname',
        'Key' => 'objectname',
        // Set the object ACL to private.
        'ACL' => ObsClient::AclPrivate
    ]);

    printf("RequestId:%s\n", $resp['RequestId']);
} catch (ObsException $e) {
    // If the operation fails, obtain the exception details.
    printf("SetObjectAclFailed: Status:%d, Code:%s, Message:%s\n",
        $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
    // Close ObsClient to release resources.
    $obsClient->close();
}

Setting an Object ACL Directly

Sample code:

<?php
// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;

// Create an ObsClient instance.
$obsClient = new ObsClient([
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
    'signature' => 'obs'
]);

// Set the object ACL.
try {
    $resp = $obsClient->setObjectAcl([
        'Bucket' => 'bucketname',
        'Key' => 'objectname',
        // Specify the object owner.
        'Owner' => ['ID' => 'ownerid'],
        'Grants' => [
            // Grant the full control permission to a specified user.
            ['Grantee' => ['Type' => 'CanonicalUser', 'ID' => 'userid'], 'Permission' => ObsClient::PermissionFullControl],
            // Grant the read permission to all users.
            ['Grantee' => ['Type' => 'Group', 'URI' => ObsClient::AllUsers], 'Permission' => ObsClient::PermissionRead],
        ]
    ]);

    printf("RequestId:%s\n", $resp['RequestId']);
} catch (ObsException $e) {
    // If the operation fails, obtain the exception details.
    printf("SetObjectAclFailed: Status:%d, Code:%s, Message:%s\n",
        $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
    // Close ObsClient to release resources.
    $obsClient->close();
}

• Use the Owner parameter to specify the object owner and the Grants parameter to specify information about the authorized users.
• The owner or grantee ID required in the ACL indicates an account ID, which can be viewed on the My Credentials page of OBS Console.
• OBS buckets support the following grantee group:

  All users: ObsClient::GroupAllUsers

<?php
// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with the source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
use Obs\ObsException;

// Create an ObsClient instance.
$obsClient = new ObsClient([
    // Obtain an AK/SK pair using environment variables (recommended) or import an AK/SK pair in other ways. Using hard coding may result in leakage.
    // Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
    'key' => getenv('ACCESS_KEY_ID'),
    'secret' => getenv('SECRET_ACCESS_KEY'),
    'endpoint' => 'https://your-endpoint',
    'signature' => 'obs'
]);

// Obtain the object ACL.
try {
    $resp = $obsClient->getObjectAcl([
        'Bucket' => 'bucketname',
        'Key' => 'objectname'
    ]);

    printf( "RequestId:%s\n", $resp['RequestId']);
    printf( "Owner[ID]:%s\n", $resp['Owner']['ID']);
    foreach ($resp['Grants'] as $index => $grant) {
        printf( "Grants[%d]\n", $index + 1 );
        printf( "Grantee[ID]:%s\n", $grant['Grantee']['ID']);
        printf( "Grantee[URI]:%s\n", $grant['Grantee']['URI']);
        printf( "Permission:%s\n", $grant['Permission']);
    }
} catch (ObsException $e) {
    // If the operation fails, obtain the exception details.
    printf("GetObjectAclFailed: Status:%d, Code:%s, Message:%s\n",
        $e->getStatusCode(), $e->getExceptionCode(), $e->getExceptionMessage());
} finally {
    // Close ObsClient to release resources.
    $obsClient->close();
}