• Object Storage Service

obs
  1. Help Center
  2. Object Storage Service
  3. Developer Guide (Android SDK)
  4. Bucket Management
  5. Managing Bucket ACLs

Managing Bucket ACLs

A bucket ACL can be configured in three modes:

  1. Specify a pre-defined access control policy during bucket creation.
  2. Call ObsClient.setBucketAcl to specify a pre-defined access control policy.
  3. Call ObsClient.setBucketAcl to set the ACL directly.

The following table lists the five permission types supported by OBS.

Permission

Description

Value in OBS Android SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket.

A grantee with this permission for an object can obtain the object content and metadata.

Permission.PERMISSION_READ

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket.

This permission is not applicable to objects.

Permission.PERMISSION_WRITE

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

Permission.PERMISSION_READ_ACP

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

Permission.PERMISSION_WRITE_ACP

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket.

A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.

Permission.PERMISSION_FULL_CONTROL

There are seven access control policies pre-defined in OBS, as described in the following table:

Policy

Description

Value in OBS Android SDK

private

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

AccessControlList.REST_CANNED_PRIVATE

public-read

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ permission.

AccessControlList.REST_CANNED_PUBLIC_READ

public-read-write

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ and WRITE permissions.

AccessControlList.REST_CANNED_PUBLIC_READ_WRITE

authenticated-read

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other OBS users have the READ permission.

AccessControlList.REST_CANNED_AUTHENTICATED_READ

bucket-owner-read

Indicates that the owner of an object has the FULL_CONTROL permission for the object and the owner of the bucket where the object resides has the READ permission.

AccessControlList.REST_CANNED_BUCKET_OWNER_READ

bucket-owner-full-control

Indicates that the owner of an object has the FULL_CONTROL permission for the object and the owner of the bucket where the object resides has FULL_CONTROL permission for the object.

AccessControlList.REST_CANNED_BUCKET_OWNER_FULL_CONTROL

log-delivery-write

Indicates that a log delivery group has the WRITE and READ_ACP permissions for buckets.

AccessControlList.REST_CANNED_LOG_DELIVERY_WRITE

Specifying a Pre-defined Access Control Policy During Bucket Creation

Sample code:

String endPoint = "yourdomainname";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

ObsBucket obsBucket = new ObsBucket();
obsBucket.setBucketName("bucketname");
// Set the bucket ACL to public-read-write. 
obsBucket.setAcl(AccessControlList.REST_CANNED_PUBLIC_READ_WRITE);
// Create a bucket.
obsClient.createBucket(obsBucket);

// Close obsClient.
obsClient.close();

Setting a Pre-defined Access Control Policy for a Bucket

Sample code:

String endPoint = "yourdomainname";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

// Set the bucket ACL to log-delivery-write.
obsClient.setBucketAcl("bucketname", AccessControlList.REST_CANNED_LOG_DELIVERY_WRITE);

// Close obsClient.
obsClient.close();

Directly Setting a Bucket ACL

Sample code:

String endPoint = "yourdomainname";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

AccessControlList acl = new AccessControlList();
Owner owner = new Owner();
owner.setId("ownerid");
acl.setOwner(owner);
// Grant the FULL_CONTROL permission to a specified user.
acl.grantPermission(new CanonicalGrantee("userid"), Permission.PERMISSION_FULL_CONTROL);
// Grant the READ permission to all users.
acl.grantPermission(GroupGrantee.ALL_USERS, Permission.PERMISSION_READ);
// Grant the WRITE permission to authorized users.
acl.grantPermission(GroupGrantee.AUTHENTICATED_USERS, Permission.PERMISSION_WRITE);
// Grant the WIRTE and READ_ACP permissions to the log delivery group.
acl.grantPermission(GroupGrantee.LOG_DELIVERY, Permission.PERMISSION_WRITE);
acl.grantPermission(GroupGrantee.LOG_DELIVERY, Permission.PERMISSION_READ_ACP);
// Directly set the bucket ACL.
obsClient.setBucketAcl("bucketname", acl);

// Close obsClient.
obsClient.close();
NOTE:

The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credential page of OBS Console.

Obtaining a Bucket ACL

You can call ObsClient.getBucketAcl to obtain a bucket ACL. Sample code is as follows:

String endPoint = "yourdomainname";
String ak = "*** Provide your Access Key ***";
String sk = "*** Provide your Secret Key ***";
// Create an instance of ObsClient.
ObsClient obsClient = new ObsClient(ak, sk, endPoint);

AccessControlList acl = obsClient.getBucketAcl("bucketname");
Log.i("GetBucketAcl", acl);

// Close obsClient.
obsClient.close();