Bucket permission management

Updated at：2025-11-03

Set bucket access permissions

The following example sets the bucket's permission to private.

                Java
                
                public void setBucketPrivate (BosClient client, String bucketName) {
    client.setBucketAcl(<bucketName>, CannedAccessControlList.Private);
}

CannedAccessControlList an enumerated type and contains three values: Private, PublicRead and PublicReadWrite, which correspond to relevant permissions respectively. For details, refer to BOS API Documentation [Permission Control Using CannedAcl](BOS/API Reference/Access control.md#Permission control by CannedAcl).

Set access permissions for a specific user on the bucket

BOS can also set the access permissions of a specified user to the bucket. Refer to the following code for implementation:

                Java
                
            

                List<Grant> accessControlList = new ArrayList<Grant>();
List<Grantee> grantees = new ArrayList<Grantee>();
List<Permission> permissions = new ArrayList<Permission>();
List<String> ipAddress = new ArrayList<String>();
List<String> stringLike = new ArrayList<String>();
List<String> stringEquals = new ArrayList<String>();
List<String> resource = new ArrayList<String>();
List<String> notResource = new ArrayList<String>();
Referer referer = new Referer();
Condition condition = new Condition();
 // Grant permission to specific user
grantees.add(new Grantee("user_id1"));
grantees.add(new Grantee("user_id2"));
grantees.add(new Grantee("user_id3"));
 //Grant permission to Everyone
grantees.add(new Grantee("*"));
 //Set permissions
permissions.add(Permission.WRITE);
permissions.add(Permission.READ);
permissions.add(Permission.LIST);
 // Set ip
ipAddress.add("ipAddress1");
ipAddress.add("ipAddress2");
ipAddress.add("ipAddress3");
condition.setIpAddress(ipAddress);
 // Set refer stringLike
stringLike.add("http://www.example1.com/");
stringLike.add("http://www.example2.com/");
stringLike.add("http://www.example3.com/");
referer.setStringLike(stringLike);
condition.setReferer(referer);
 // Set refer stringEquals
stringEquals.add("http://www.baidu.com");
stringEquals.add("http://www.xiaomi.com");
stringEquals.add("http://www.google.com");
referer.setStringEquals(stringEquals);
condition.setReferer(referer);
 // Set resource
resource.add("yourBucketName");
 // Set notResource
List<String> notResouce = new ArrayList<String>();
notResouce.add("yourBucketName");
notResouce.add("yourBucketName/*");
Grant grant = new Grant();
grant.setGrantee(grantees);
grant.setPermission(permissions);
grant.setCondition(condition);
grant.setResource(resource);
List<Grantee> grantees1 = new ArrayList<Grantee>();
List<Permission> permissions1 = new ArrayList<Permission>();
List<String> ipAddress1 = new ArrayList<String>();
List<String> stringLike1 = new ArrayList<String>();
List<String> stringEquals1 = new ArrayList<String>();
List<String> resource1 = new ArrayList<String>();
List<String> notResource1 = new ArrayList<String>();
Referer referer1 = new Referer();
Condition condition1 = new Condition();
 // Grant permission to specific user
grantees1.add(new Grantee("user_id4"));
grantees1.add(new Grantee("user_id5"));
grantees1.add(new Grantee("user_id6"));
 //Grant permission to Everyone
grantees.add(new Grantee("*"));
 //Set permissions
permissions.add(Permission.FULL_CONTROL);
permissions1.add(Permission.WRITE);
permissions1.add(Permission.READ);
permissions1.add(Permission.LIST);
 // Set ip
ipAddress1.add("ipAddress4");
ipAddress1.add("ipAddress5");
ipAddress1.add("ipAddress6");
condition1.setIpAddress(ipAddress1);
 // Set refer stringLike
stringLike1.add("http://www.example4.com/");
stringLike1.add("http://www.example5.com/");
stringLike1.add("http://www.example6.com/");
referer1.setStringLike(stringLike1);
condition1.setReferer(referer1);
 // Set refer stringEquals
stringEquals1.add("http://www.baidu1.com");
stringEquals1.add("http://www.xiaomi1.com");
stringEquals1.add("http://www.google1.com");
referer1.setStringEquals(stringEquals1);
condition1.setReferer(referer1);
 // Set resource
resource1.add("yourBucketName");
 // Set notResource
List<String> notResouce = new ArrayList<String>();
notResouce.add("yourBucketName");
notResouce.add("yourBucketName/*");
Grant grant1 = new Grant();
grant1.setGrantee(grantees1);
grant1.setPermission(permissions1);
grant1.setCondition(condition1);
grant1.setResource(resource1);
accessControlList.add(grant);
accessControlList.add(grant1);
SetBucketAclRequest request = new SetBucketAclRequest("yourBucketName",accessControlList);
client.setBucketAcl(request);
            

Note: resource and notResource cannot be set at the same time The permission settings in Permission include three values: READ, WRITE, FULL_CONTROL, which correspond to relevant permissions respectively. For details, refer to BOS API Documentation - [Permission Control via Uploading ACL Files](BOS/API Reference/Access control.md#Permission control by uploading ACL files).

Set more bucket access permissions

Set anti-leech through refer allow list

                Java
                
                String jsonAcl = "";
client.setBucketAcl("bucketName", jsonAcl)

Among them, jsonAcl is {"accessControlList":["+ "{"grantee":[{"id":"*"}], "+ ""permission":["FULL_CONTROL"], "+ ""condition":{"referer":{"stringEquals":["http://test/index"]}" + "}}]}

Restrict client IP access, only allow some client IPs to access

                Java
                
                String jsonAcl = "";
client.setBucketAcl("bucketName", jsonAcl)

Among them, jsonAcl is {\"accessControlList\":["+ "{\"grantee\":[{\"id\":\"*\"}], "+ "\"permission\":[\"FULL_CONTROL\"], "+ "\"condition\":{\"ipAddress\":[\"192.170.0.6\"]" + "}}]}")

Set STS temporary token permissions

For temporary access identities created through STS, administrators can also set specific permissions. For an introduction to STS and how to set temporary permissions, please refer to [Temporary Authorization Access](BOS/API Reference/Access control.md#Temporary authorized access).

For setting STS temporary token permissions using the BOS JAVA SDK, you can refer to [Creating BosClient with STS](BOS/SDK/Java-SDK/Initialization.md#Create a BosClient with STS)

View bucket permissions

The following code can be used to view the bucket permissions:

                Java
                
                GetBucketAclResponse aclResponse = client.getBucketAcl("bucketName");
System.out.println(aclResponse.getAccessControlList().toString());

The parameters available for calling in the resolution class returned by the getBucketAcl method are as follows:

Parameters	Description
owner	Bucket owner information
id	User ID of bucket owner
acl	Identify the permission list of the bucket
grantee	Identify the grantee
-id	Authorized person ID
permission	Identify the grantee permissions

Set bucket storage class

View the region to which a bucket belongs