Bucket permission management
Bucket permission management
Currently, BOS supports two methods for setting ACLs. For details, refer to Permission Control
The first method is to use Canned ACL. During put_object_acl, the object access permission is set via the header "x-bce-acl", "x-bce-grant-read" or "x-bce-grant-permission". Currently configurable permissions include private and public-read. The three types of headers cannot appear in the same request simultaneously.
The second method is to set the access_control_list structure in the custom Acl style, specifically by uploading its json string, or directly upload an ACL file. For details, refer to Permission Control Overview
View bucket permissions
The following code can be used to view the bucket permissions:
1GetBucketAclRequest getBucketAclRequest("bucketName");
2GetBucketAclResponse getBucketAclResponse;
3int ret = client.get_bucket_acl(getBucketAclRequest, &getBucketAclResponse);
4if (ret) {
5 LOGF(WARN, "client err: %d", ret);
6}
7if (getBucketAclResponse.is_fail()) {
8 LOGF(WARN,"get_bucket_acl: [status_code = %d], [message = %s], [requestid = %s]",
9 getBucketAclResponse.status_code(),
10 getBucketAclResponse.error().message().c_str(),
11 getBucketAclResponse.error().request_id().c_str());
12}
13 // Obtain ownerid
14std::string owner_id = getBucketAclResponse.owner().id;
15 // Obtain ACL structure data
16std::vector<Grant> aclData = getBucketAclResponse.access_control_list();
17std::string jsonStr = getBucketAclResponse.json_access_control_list();The parameters available for calling in the response returned by the get_bucket_acl method are as follows:
| Parameters | Types | Description |
|---|---|---|
| owner | Owner(string) | Bucket owner id |
| access_control_list | vector<Grant> | Container for storing ACL |
For the meaning of all Grant fields, refer to Permission Control Overview for details
Note:
- When using STS for access control, the C++ SDK only supports passing STS credentials but does not support retrieving them.
Set bucket access permissions
Set Canned ACL
The following code sets the bucket's permission to private.
1PutBucketAclRequest putBucketAclRequest(bucketName);
2PutBucketAclResponse putBucketAclResponse;
3putBucketAclRequest.set_canned_acl("private");
4int ret = client.put_bucket_acl(putBucketAclRequest, &putBucketAclResponse);
5if (ret) {
6 LOGF(WARN, "client err: %d", ret);
7}
8if (putBucketAclResponse.is_fail()) {
9 LOGF(WARN,"put_bucket_acl: [status_code = %d], [message = %s], [requestid = %s]",
10 putBucketAclResponse.status_code(),
11 putBucketAclResponse.error().message().c_str(),
12 putBucketAclResponse.error().request_id().c_str());
13}CannedACL contains three values: private, public-read and public-read-write, which correspond to respective permissions.
For details, refer to BOS API Documentation [Permission Control Using CannedAcl](BOS/API Reference/Access control.md#Permission control by CannedAcl).
Set custom ACL
Users can refer to the following code to set bucket's custom access permissions, supporting three different parameters:
1PutBucketAclRequest putBucketAclRequest(bucketName);
2PutBucketAclResponse putBucketAclResponse;
3 // 1. Upload ACL json string
4std::string jsonAcl =
5 "{\"accessControlList\":[{\"grantee\":[{\"id\":\"*\"}],\"permission\":[\"READ\"]},{"
6 "\"grantee\":[{\"id\":\"cb5f8xxxxxxxxxx82bbc\"}],\"permission\":["
7 "\"FULL_CONTROL\"]}]}";
8std::string cannedAcl="public-read";
9putBucketAclRequest.set_json_acl(jsonAcl);
10 // 2. Upload ACL file
11std::string aclFilePath = "/tmp/acl.json"
12int setRet = putBucketAclRequest.set_acl_file(aclFilePath);
13if (ret) {
14 LOGF(WARN, "client set_acl_file: %d", ret);
15}
16 // 3. Set access_control_list data
17std::vector<Grant> grants;
18Grant grant;
19grantee.id = "77fxxxxxxxxxxx5fa406";
20grant.grantee.push_back(grantee);
21grant.permission.push_back("READ");
22grants.push_back(grant);
23putBucketAclRequest.set_access_control_list(grants);
24int ret = client.put_bucket_acl(putObjectAclRequest, &putBucketAclRequest);
25if (ret) {
26 LOGF(WARN, "client err: %d", ret);
27}
28if (putBucketAclRequest.is_fail()) {
29 LOGF(WARN,"put_bucket_acl: [status_code = %d], [message = %s], [requestid = %s]",
30 putBucketAclRequest.status_code(),
31 putBucketAclRequest.error().message().c_str(),
32 putBucketAclRequest.error().request_id().c_str());
33}