Bucket permission management

Updated at：2025-11-03

Set bucket access permissions

The following code sets the bucket's permission to private:

Ruby

1client.set_bucket_canned_acl(bucket_name, "private")

Canned ACL supports three types of permissions, which are: private, public-read and public-read-write. For details about permission, refer to BOS API Documentation - [Permission Control Using CannedAcl](BOS/API Reference/Access control.md#Permission control by CannedAcl).

Set access permissions for a specific user on the bucket

BOS provides the set_bucket_acl method to set the access permissions of specified users to the bucket, and you can refer to the following code to implement it:

Ruby

1acl = [{'grantee' => [{'id' => 'b124deeaf6f641c9ac27700b41a350a8'},
2                      {'id' => 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}],
3        'permission' => ['FULL_CONTROL']
4}]
5client.set_bucket_acl(bucket_name, acl)

Note:

The permission settings in Permission include three values: READ, WRITE, FULL_CONTROL, which correspond to relevant permissions respectively. For details, refer to BOS API Documentation - [Permission Control via Uploading ACL Files](BOS/API Reference/Access control.md#Permission control by uploading ACL files).

When specifying two or more grantees, refer to the format shown in the example above. Merging arrays will result in an error.

Set more bucket access permissions

Set anti-leech through referer allow list

Ruby

1acl = [{'grantee' => [{'id' => 'b124deeaf6f641c9ac27700b41a350a8'},
2                      {'id' => 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}],
3        'permission' => ['FULL_CONTROL'],
4        'condition' => {
5            'referer' => {
6                'stringLike' => ['http://www.abc.com/*'],
7                'stringEquals' => ['http://www.abc.com']
8             }
9        }
10}]
11client.set_bucket_acl(bucket_name, acl)

Restrict client IP access, only allow some client IPs to access

Ruby

1acl = [{'grantee' => [{'id' => 'b124deeaf6f641c9ac27700b41a350a8'},
2                      {'id' => 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}],
3        'permission' => ['FULL_CONTROL'],
4        'condition' => {
5            "ipAddress" => [
6                  '192.168.0.0/16',
7                  '192.169.0.*',
8                  '192.170.0.5'
9            ]
10        }
11}]
12client.set_bucket_acl(bucket_name, acl)

Set STS temporary token permissions

For temporary access identities created through STS, administrators can also set specific permissions. For an introduction to STS and how to set temporary permissions, please refer to [Temporary Authorization Access](BOS/API Reference/Access control.md#Temporary authorized access).

For setting STS temporary token permissions using the BOS Ruby SDK, you can refer to [Creating BosClient with STS](BOS/SDK/Ruby-SDK/Initialization.md#Create a BosClient with STS)

View bucket permissions

The following code can be used to view the bucket permissions:

Ruby

1client.get_bucket_acl(bucket_name)

The parameters available for calling in the resolution class returned by the get_bucket_acl method are as follows:

Parameters	Description
owner	Bucket owner information
id	User ID of bucket owner
acl	Identify the permission list of the bucket
grantee	Identify the grantee
-id	Authorized person ID
permission	Identify the grantee permissions

Overview

View the region to which a bucket belongs