This topic describes how to configure, query, and delete the policies of a bucket.

Background information

Bucket policies provide resource-based authorization for users. Bucket policies apply to the following scenarios:

  • Authorize RAM users of other accounts to access your OSS resources.

    You can authorize RAM users of other accounts to access your OSS resources.

  • Authorize anonymous users to access your OSS resources using specific IP addresses or IP ranges.

    In some cases, you must authorize anonymous users to access OSS resources using specific IP addresses or IP ranges. For example, confidential documents of an enterprise are only allowed to be accessed within the enterprise but not in other regions. Previously, configuring RAM policies for every user was a tedious and complex task because of the potential for a large number of internal users. To resolve this issue, you can configure access policies with IP restrictions based on bucket policies to authorize a large number of users easily and efficiently.

For more information about bucket policy configurations and use cases, see Use bucket policies to authorize other users to access OSS resources. For more information about bucket policy syntax, see Policy structure and syntax.

Configure bucket policies

The following code provides an example on how to configure a bucket policy:

#include <alibabacloud/oss/OssClient.h>
using namespace AlibabaCloud::OSS;

int main(void)
{
    /* Initialize the OSS account information. */
    std::string AccessKeyId = "yourAccessKeyId";
    std::string AccessKeySecret = "yourAccessKeySecret";
    std::string Endpoint = "yourEndpoint";
    std::string BucketName = "yourBucketName";

    /* Initialize network resources. */
    InitializeSdk();

    ClientConfiguration conf;
    OssClient client(Endpoint, AccessKeyId, AccessKeySecret, conf);

    /* Configure a bucket policy. For example, allow users to list or download objects prefixed with user1/ in the bucket.    std::string policy = 
        R"(
        {
            "Statement": [
            {
                "Action": [
                    "oss:GetObject",
                    "oss:ListObjects"
                ],
                    "Effect" : "Allow",
                        "Resource" : ["acs:oss:*:*:*/user1/*"]
            }
            ],
                "Version": "1"
        }
        )";
    SetBucketPolicyRequest request(BucketName);
    request.setPolicy(policy);
    auto outcome = client.SetBucketPolicy(request);

    if (! outcome.isSuccess()) {
        /* Handle exceptions. */
        std::cout << "Set Bucket Policy fail" <<
            ",code:" << outcome.error().Code() <<
            ",message:" << outcome.error().Message() <<
            ",requestId:" << outcome.error().RequestId() << std::endl;
    }

    /* Release network resources. */
    ShutdownSdk();
    return 0;
}

For more information about how to configure bucket policies, see PutBucketPolicy.

Query bucket policies

The following code provides an example on how to query the policies configured for a bucket:

#include <alibabacloud/oss/OssClient.h>
using namespace AlibabaCloud::OSS;

int main(void)
{
    /* Initialize the OSS account information. */
    std::string AccessKeyId = "yourAccessKeyId";
    std::string AccessKeySecret = "yourAccessKeySecret";
    std::string Endpoint = "yourEndpoint";
    std::string BucketName = "yourBucketName";

    /* Initialize network resources. */
    InitializeSdk();

    ClientConfiguration conf;
    OssClient client(Endpoint, AccessKeyId, AccessKeySecret, conf);

    /* Query the policies configured for the bucket. */
    GetBucketPolicyRequest request(BucketName);
    auto outcome = client.GetBucketPolicy(request);

    if (! outcome.isSuccess()) {
        /* Handle exceptions. */
        std::cout << "Get Bucket Policy fail" <<
            ",code:" << outcome.error().Code() <<
            ",message:" << outcome.error().Message() <<
            ",requestId:" << outcome.error().RequestId() << std::endl;
            ShutdownSdk();
            return -1;
    }

    /* Display the policies configued for the bucket. */
    std::cout << outcome.result().Policy() << std::endl;

    /* Release network resources. */
    ShutdownSdk();
    return 0;
}

For more information about how to query bucket policies, see GetBucketPolicy.

Delete bucket policies

The following code provides an example on how to delete the policies configured for a bucket:

#include <alibabacloud/oss/OssClient.h>
using namespace AlibabaCloud::OSS;

int main(void)
{
    /* Initialize the OSS account information. */
    std::string AccessKeyId = "yourAccessKeyId";
    std::string AccessKeySecret = "yourAccessKeySecret";
    std::string Endpoint = "yourEndpoint";
    std::string BucketName = "yourBucketName";

    /* Initialize network resources. */
    InitializeSdk();

    ClientConfiguration conf;
    OssClient client(Endpoint, AccessKeyId, AccessKeySecret, conf);

    /* Delete the policies configured for the bucket. */
    DeleteBucketPolicyRequest request(BucketName);
    auto outcome = client.DeleteBucketPolicy(request);

    if (! outcome.isSuccess()) {
        /* Handle exceptions. */
        std::cout << "Delete Bucket Policy fail" <<
            ",code:" << outcome.error().Code() <<
            ",message:" << outcome.error().Message() <<
            ",requestId:" << outcome.error().RequestId() << std::endl;
    }

    /* Release network resources. */
    ShutdownSdk();
    return 0;
}

For more information about how to delete bucket policies, see DeleteBucketPolicy.