Managing Object ACLs

Access control lists (ACLs) allow resource owners to grant other accounts the permissions to access resources. By default, only the resource owner has full control over resources when a bucket or object is created. That is, the bucket creator has full control over the bucket, and the object uploader has full control over the object. Other accounts do not have the permissions to access resources. If resource owners want to grant other accounts the read and write permissions on resources, they can use ACLs. ACLs grant permissions to accounts. After an account is granted permissions, both the account and its IAM users can access the resources.

For more information, see ACLs.

If you have any questions during development, post them on the Issues page of GitHub. For details about parameters and usage of each API, see API Reference.

An object ACL can be configured in any of the following ways:

1. Specify a pre-defined ACL during object upload.
2. Call ObsClient->setObjectAcl to specify the pre-defined ACL.
3. Call ObsClient->setObjectAcl to specify a user-defined ACL.

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
// Create an ObsClient instance.
$obsClient = new ObsClient ( [ 
      //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
      //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
      'key' => getenv('ACCESS_KEY_ID'),
      'secret' => getenv('SECRET_ACCESS_KEY'),
      'endpoint' => 'https://your-endpoint',
      'signature' => 'obs'
] );

$resp = $obsClient -> putObject([
       'Bucket' => 'bucketname',
       'Key' => 'objectname',
       'Body' => 'Hello OBS',
       // Set the object ACL to public read.
       'ACL' => ObsClient::AclPublicRead
]);

printf("RequestId:%s\n", $resp['RequestId']);

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
// Create an ObsClient instance.
$obsClient = new ObsClient ( [ 
      //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
      //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
      'key' => getenv('ACCESS_KEY_ID'),
      'secret' => getenv('SECRET_ACCESS_KEY'),
      'endpoint' => 'https://your-endpoint',
      'signature' => 'obs'
] );

$resp = $obsClient -> setObjectAcl([
       'Bucket' => 'bucketname',
       'Key' => 'objectname',
       // Set the object to be private.
       'ACL' => ObsClient::AclPrivate
]);

printf("RequestId:%s\n", $resp['RequestId']);

Setting an Object ACL Directly

Sample code:

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
// Create an ObsClient instance.
$obsClient = new ObsClient ( [ 
      //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
      //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
      'key' => getenv('ACCESS_KEY_ID'),
      'secret' => getenv('SECRET_ACCESS_KEY'),
      'endpoint' => 'https://your-endpoint',
      'signature' => 'obs'
] );

$resp = $obsClient -> setObjectAcl([
       'Bucket' => 'bucketname',
       'Key' => 'objectname',
       // Set the object owner.
       'Owner' => ['ID' => 'ownerid'],
       'Grants' => [
              // Grant all permissions to a specified user.
              ['Grantee' => ['Type' => 'CanonicalUser', 'ID' => 'userid'], 'Permission' => ObsClient::PermissionFullControl],
              // Grant the READ permission to all users.
              ['Grantee' => ['Type' => 'Group', 'URI' => ObsClient::AllUsers], 'Permission' => ObsClient::PermissionRead],
       ]      
]);

printf("RequestId:%s\n", $resp['RequestId']);

• Use the Owner parameter to specify the object owner and the Grants parameter to specify information about the authorized users.
• The owner or grantee ID required in the ACL indicates an account ID, which can be viewed on the My Credentials page of OBS Console.
• OBS buckets support the following grantee group:
  • All users: ObsClient::GroupAllUsers

// Import the dependency library.
require 'vendor/autoload.php';
// Import the SDK code library during the installation with source code.
// require 'obs-autoloader.php';
// Declare the namespace.
use Obs\ObsClient;
// Create an ObsClient instance.
$obsClient = new ObsClient ( [ 
      //Obtain an AK/SK pair using environment variables or import the AK/SK pair in other ways. Using hard coding may result in leakage.
      //Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
      'key' => getenv('ACCESS_KEY_ID'),
      'secret' => getenv('SECRET_ACCESS_KEY'),
      'endpoint' => 'https://your-endpoint',
      'signature' => 'obs'
] );

$resp = $obsClient->getObjectAcl ( [ 
       'Bucket' => 'bucketname',
       'Key' => 'objectname' 
] );

printf ( "RequestId:%s\n", $resp ['RequestId'] );
printf ( "Owner[ID]:%s\n", $resp ['Owner'] ['ID'] );
foreach ( $resp ['Grants'] as $index => $grant ) {
       printf ( "Grants[%d]\n", $index + 1 );
       printf ( "Grantee[ID]:%s\n", $grant ['Grantee'] ['ID'] );
       printf ( "Grantee[URI]:%s\n", $grant ['Grantee'] ['URI'] );
       printf ( "Permission:%s\n", $grant ['Permission'] );
}