Object permission control
Set access permission for an object.
Currently, BOS supports two methods for setting ACLs. The first method is to use Canned ACL. During PutObjectAcl, the object access permission is set via the header "x-bce-acl" or "x-bce-grant-permission". Currently configurable permissions include private and public-read. The two types of headers cannot appear in the same request simultaneously. The second method is to upload an ACL file. For details, refer to [Setting Object Permission Control](BOS/API Reference/Object-Related Interface/Permission control/PutObjectAcl.md)..
- Set object access permissions by using the "x-bce-acl" header field
1 from baidubce.services.bos import canned_acl
2# Set the object to private permission
3 bos_client.set_object_canned_acl(bucket_name, object_key, canned_acl=canned_acl.PRIVATE)
4# Set the object to public-read permission
5 bos_client.set_object_canned_acl(bucket_name, object_key, canned_acl=canned_acl.PUBLIC_READ)- Set object access permission using the headers "x-bce-grant-permission"
1 # Grant the specified user read permission for the object.
2 bos_client.set_object_canned_acl(bucket_name, object_key, grant_read='id="12345678dfd5487e99f5c85aca5c1234",id="1234567880274ea5a9d50fe94c151234"')
3# Grant the specified user FULL_CONTROL permission for the object.
4 bos_client.set_object_canned_acl(bucket_name, object_key, grant_full_control='id="12345678dfd5487e99f5c85aca5c1234",id="1234567880274ea5a9d50fe94c151234"')- Set object permissions using the set_object_acl() API.
1 # Grant the specified user read permission for the object.
2 acl = [{
3 "grantee":[{
4 "id":"12345678dfd5484399f5c85aca5c1234"
5 }],
6 "permission":["READ"]
7 }]
8 bos_client.set_object_acl(bucket_name, object_key, acl = acl)View object permissions
If the archive storage class objects have not been restored fully, or the archive storage class files have just been uploaded (for duration, refer to the restoration duration), Object ACL cannot be set
View object permissions using the following code:
1 response = bos_client.get_object_acl(bucket_name, object_key)
2 print("object acl:", response.access_control_list)The parameters available for calling in the resolution class returned by the getObjectAcl method are as follows:
| Parameters | Description |
|---|---|
| accessControlList | Identify the permission list of the object |
| grantee | Identify the grantee |
| -id | Authorized person ID |
| permission | Identify the grantee permissions |
Delete object permissions
If the archive storage class objects have not been restored fully, or the archive storage class files have just been uploaded (for duration, refer to the restoration duration), Object ACL cannot be deleted
The following code can be used to delete the object permissions:
1bos_client.delete_object_acl(bucket_name,object_key)