Bucket permission management
Set bucket access permissions
The following code sets the bucket's permission to private:
1bos_client.set_bucket_canned_acl(bucket_name, canned_acl.PRIVATE)canned_acl contains three parameters: PRIVATE, PUBLIC_READ and PUBLIC_READ_WRITE, and their corresponding permissions are: private, public-read and public-read-write. For details about permission, refer to BOS API Documentation - [Permission Control Using CannedAcl](BOS/API Reference/Access control.md#Permission control by CannedAcl).
Set access permissions for a specific user on the bucket
BOS provides the set_bucket_acl method to set the access permissions of specified users to the bucket, and you can refer to the following code to implement it:
1bos_client.set_bucket_acl(
2 bucket_name,
3 [{'grantee': [{'id': 'b124deeaf6f641c9ac27700b41a350a8'},
4 {'id': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}],
5 'permission': ['FULL_CONTROL'],
6 'resource':['your_bucket_name/prefix/*']
7 }])Note:
idrefers to the user ID, which you can view in the user information.- The permission settings in
permissioninclude includes three values:READ,WRITEandFULL_CONTROL, which correspond to relevant permissions respectively. For details, refer to BOS API Documentation - [Permission Control via Uploading ACL Files](BOS/API Reference/Access control.md#Permission control by uploading ACL files).- The second parameter acl of
set_bucket_acl()does not need to include the "accessControlList" field, as it has already been encapsulated in the API.
Set more bucket access permissions
- Set anti-leech through referer allow list
1myAcl =[{"grantee":[{"id": "*"}],
2 "permission":["FULL_CONTROL"],
3 "condition":{
4 "referer":{"stringEquals":["http://test/index"]}
5 }
6 }]
7bos_client.set_bucket_acl(bucket_name, myAcl)- Restrict client IP access, only allow some client IPs to access
1myAcl = [{"grantee":[{"id":"*"}],
2 "permission":["FULL_CONTROL"],
3 "condition":{"ipAddress":["192.170.0.6"]}
4 }]
5bos_client.set_bucket_acl(bucket_name, myAcl)Set STS temporary token permissions
For temporary access identities created through STS, administrators can also set specific permissions. For an introduction to STS and how to set temporary permissions, please refer to [Temporary Authorization Access](BOS/API Reference/Access control.md#Temporary authorized access).
For setting STS temporary token permissions using the BOS Python SDK, you can refer to [Accessing BOS via STS](BOS/SDK/Python-SDK/Initialization.md#Accessing BOS via STS)
View bucket permissions
The following code can be used to view the bucket permissions:
1response = bos_client.get_bucket_acl(bucket_name)
2
3bos_client.set_bucket_acl(bucket_name, response.access_control_list)The parameters available for calling in the resolution class returned by the get_bucket_acl method are as follows:
| Parameters | Description |
|---|---|
| owner | Bucket owner information |
| +id | User ID of bucket owner |
| access_control_list | Identify the permission list of the bucket |
| +grantee | Identify the grantee |
| ++id | Authorized person ID |
| +permission | Identify the grantee permissions |
| +resource | Resources affected by ACL configuration items |