• Object Storage Service

obs
  1. Help Center
  2. Object Storage Service
  3. Developer Guide (Node.js SDK)
  4. Bucket Management
  5. Managing Bucket ACLs

Managing Bucket ACLs

A bucket ACL can be configured in three modes:

  1. Specify a pre-defined access control policy during bucket creation.
  2. Call ObsClient.setBucketAcl to specify a pre-defined access control policy.
  3. Call ObsClient.setBucketAcl to set the ACL directly.

The following table lists the five permission types supported by OBS.

Permission

Description

Value in OBS Node.js SDK

READ

A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket.

A grantee with this permission for an object can obtain the object content and metadata.

ObsClient.enums.PermissionRead

WRITE

A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket.

This permission is not applicable to objects.

ObsClient.enums.PermissionWrite

READ_ACP

A grantee with this permission can obtain the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

ObsClient.enums.PermissionReadAcp

WRITE_ACP

A grantee with this permission can update the ACL of a bucket or object.

A bucket or object owner has this permission permanently.

A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions.

ObsClient.enums.PermissionWriteAcp

FULL_CONTROL

A grantee with this permission for a bucket has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the bucket.

A grantee with this permission for an object has READ, WRITE, READ_ACP, and WRITE_ACP permissions for the object.

ObsClient.enums.PermissionFullControl

There are seven access control policies pre-defined in OBS, as described in the following table:

Policy

Description

Value in OBS Node.js SDK

private

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users have no permission to access the bucket or object.

ObsClient.enums.AclPrivate

public-read

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ permission.

ObsClient.enums.AclPublicRead

public-read-write

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other users including anonymous users have the READ and WRITE permissions.

ObsClient.enums.AclPublicReadWrite

authenticated-read

Indicates that the owner of a bucket or object has the FULL_CONTROL permission for the bucket or object. Other OBS users have the READ permission.

ObsClient.enums.AclAuthenticatedRead

bucket-owner-read

Indicates that the owner of an object has the FULL_CONTROL permission for the object and the owner of the bucket where the object resides has the READ permission.

ObsClient.enums.AclBucketOwnerRead

bucket-owner-full-control

Indicates that the owner of an object has the FULL_CONTROL permission for the object and the owner of the bucket where the object resides has FULL_CONTROL permission for the object.

ObsClient.enums.AclBucketOwnerFullControl

log-delivery-write

Indicates that a log delivery group has the WRITE and READ_ACP permissions for buckets.

ObsClient.enums.AclLogDeliveryWrite

Specifying a Pre-defined Access Control Policy During Bucket Creation

Sample code:

// Import the OBS library.
var ObsClient = require('./lib/obs');

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    access_key_id: '*** Provide your Access Key ***',       
    secret_access_key: '*** Provide your Secret Key ***',       
    server : 'yourdomainname'
});

// Create a bucket.
obsClient.createBucket({
       Bucket : 'bucketname',
       // Set the bucket ACL to public-read-write. 
       ACL : obsClient.enums.AclPublicReadWrite
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

Setting a Pre-defined Access Control Policy for a Bucket

Sample code:

// Import the OBS library.
var ObsClient = require('./lib/obs');

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    access_key_id: '*** Provide your Access Key ***',       
    secret_access_key: '*** Provide your Secret Key ***',       
    server : 'yourdomainname'
});

// Use the pre-defined access control policy to set bucket permissions.
obsClient.setBucketAcl({
       Bucket : 'bucketname',
       // Set the bucket ACL to log-delivery-write.
       ACL : obsClient.enums.AclLogDeliveryWrite
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});
NOTE:

Use the ACL parameter to specify the ACL for a bucket.

Directly Setting a Bucket ACL

Sample code:

// Import the OBS library.
var ObsClient = require('./lib/obs');

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    access_key_id: '*** Provide your Access Key ***',       
    secret_access_key: '*** Provide your Secret Key ***',       
    server : 'yourdomainname'
});

// Directly set the bucket ACL.
obsClient.setBucketAcl({
       Bucket : 'bucketname',
       // Set the bucket owner.
       Owner:{'ID':'ownerid','Name':'ownername'},
       Grants:{
         Grant:[
             // Grant all permissions to a specified user.
            { Grantee : {Type : 'CanonicalUser',ID : 'userid'}, Permission : obsClient.enums.PermissionFullControl},
             // Grant the READ permission to all users.
            { Grantee : {Type : 'Group',URI : obsClient.enums.GroupAuthenticatedUsers}, Permission : obsClient.enums.AclPublicRead},
             // Grant the WRITE permission to authorized users.
            { Grantee : {Type : 'Group',URI : obsClient.enums.GroupAuthenticatedUsers}, Permission : obsClient.enums.AclPublicWrite},
             // Grant the WIRTE and READ_ACP permissions to the log delivery group.
            { Grantee : {Type : 'Group',URI : obsClient.enums.GroupLogDelivery}, Permission : obsClient.enums.AclPublicWrite},
            { Grantee : {Type : 'Group',URI: obsClient.enums.GroupLogDelivery}, Permission : obsClient.enums.PermissionReadAcp}
         ]
      }
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});
NOTE:
  • User the Owner parameter to set the bucket owner and use the Grants parameter to grant permissions for authorized users.
  • The owner or grantee ID needed in the ACL indicates the account ID, which can be viewed on the My Credential page of OBS Console.
  • OBS buckets support three types of grantee group:
    • Authorized users: ObsClient.enums.GroupAuthenticatedUsers
    • All users: ObsClient.enums.GroupAllUsers
    • Log delivery group: ObsClient.enums.GroupLogDelivery

Obtaining a Bucket ACL

You can call ObsClient.getBucketAcl to obtain a bucket ACL. Sample code is as follows:

// Import the OBS library.
var ObsClient = require('./lib/obs');

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    access_key_id: '*** Provide your Access Key ***',       
    secret_access_key: '*** Provide your Secret Key ***',       
    server : 'yourdomainname'
});

obsClient.getBucketAcl({
       Bucket : 'bucketname',
}, (err, result) => {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
              if(result.CommonMsg.Status < 300 && result.InterfaceResult){
                     console.log('RequestId-->' + result.InterfaceResult.RequestId);
                     console.log('Owner[ID]-->' + result.InterfaceResult.Owner.ID);
                     console.log('Owner[Name]-->' + result.InterfaceResult.Owner.Name);
                     console.log('Grants:');
                     for(let i=0;i<result.InterfaceResult.Grants.Grant.length;i++){
                           console.log('Grant[' + i + ']:');
                           console.log('Grantee[ID]-->' + result.InterfaceResult.Grants.Grant[i]['Grantee']['ID']);
                           console.log('Grantee[Name]-->' + result.InterfaceResult.Grants.Grant[i]['Grantee']['Name']);
                           console.log('Grantee[URI]-->' + result.InterfaceResult.Grants.Grant[i]['Grantee']['URI']);
                           console.log('Permission-->' + result.InterfaceResult.Grants.Grant[i]['Permission']);
                     }
              }
       }
});