Object permission control

Updated at：2025-11-03

Set access permission for an object.

Currently, BOS supports two methods for setting ACLs. The first method is to use Canned ACL. During PutObjectAcl, the object access permission is set via the header "x-bce-acl" or "x-bce-grant-permission". Currently configurable permissions include private and public-read. The two types of headers cannot appear in the same request simultaneously. The second method is to upload an ACL file.

For details, refer to Setting Object Permission Control..

Set object access permission using the headers "x-bce-acl" or "x-bce-grant-permission"

set object acl First method (Set via request headers)

                Java
                
                SetObjectAclRequest setObjectAclRequest = new SetObjectAclRequest("yourBucketName","objectKey",CannedAccessControlList.PublicRead);
client.setObjectAcl(setObjectAclRequest);

set object acl First method (Set xBceGrantRead via request headers)

                Java
                
            

                String xBceGrantRead = "id=\"user_id1\""+",id=\"user_id2\"";
SetObjectAclRequest setObjectAclRequest = new SetObjectAclRequest();
setObjectAclRequest.withBucketName("yourBucketName");
setObjectAclRequest.withKey("objectKey");
setObjectAclRequest.setxBceGrantRead(xBceGrantRead);
client.setObjectAcl(setObjectAclRequest);
            

set object acl First method (Set xBceGrantFullControl via request headers)

                Java
                
            

                String xBceGrantFullControl = "id=\"user_id1\""+",id=\"user_id2\"";
SetObjectAclRequest setObjectAclRequest = new SetObjectAclRequest();
setObjectAclRequest.withBucketName("yourBucketName");
setObjectAclRequest.withKey("objectKey");
setObjectAclRequest.setxBceGrantFullControl(xBceGrantFullControl);
client.setObjectAcl(setObjectAclRequest);
            

Set object access permission via setObjectAcl

set object acl Second Method (JSON string)

                Java
                
                String jsonObjectAcl = "{\"accessControlList\":["+ "{\"grantee\":[{\"id\":\"*\"}], "+ "\"permission\":[\"FULL_CONTROL\"]"+"}]}";
SetObjectAclRequest setObjectAclRequest = new SetObjectAclRequest("yourBucketName","objectKey",jsonObjectAcl);
client.setObjectAcl(setObjectAclRequest);

set object acl Second Method, by which users only need to specify the specified parameters

                Java
                
            

                List<Grant> grants = new ArrayList<Grant>();
List<Grantee> grantees = new ArrayList<Grantee>();
List<Permission> permissions = new ArrayList<Permission>();
 // Grant permission to specific user
grantees.add(new Grantee("user_id1"));
grantees.add(new Grantee("user_id2"));
grantees.add(new Grantee("user_id3"));
 // Set permissions
permissions.add(Permission.READ);
grants.add(new Grant().withGrantee(grantees).withPermission(permissions));
SetObjectAclRequest setObjectAclRequest = new SetObjectAclRequest("yourBucketName","objectKey", grants);
client.setObjectAcl(setObjectAclRequest);
            

View object permissions

The following code can be used to check the object permissions:

                Java
                
                GetObjectAclRequest getObjectRequest = new GetObjectAclRequest();
getObjectRequest.withBucketName("yourBucketName");
getObjectRequest.withKey("objectKey");
GetObjectAclResponse response = client.getObjectAcl(getObjectRequest);

The parameters available for calling in the resolution class returned by the getObjectAcl method are as follows:

Parameters	Description
accessControlList	Identify the permission list of the object
grantee	Identify the grantee
-id	Authorized person ID
permission	Identify the grantee permissions

Delete object permissions

The following code can be used to delete the object permissions:

                Java
                
                DeleteObjectAclRequest deleteObjectAclRequest = new DeleteObjectAclRequest("yourBucketName","objectKey");
client.deleteObjectAcl(deleteObjectAclRequest);

Bucket management

Multipart upload of objects