All Products
Search
Document Center

Object Storage Service:Manage object ACLs

Last Updated:Oct 19, 2023

In addition to bucket-level access control lists (ACLs), Object Storage Service (OSS) provides object-level ACLs. You can configure the ACL of an object when you upload it or modify its ACL after it is uploaded.

Object ACLs

The following table describes the ACLs that you can configure for an object.

Note

The ACL of an object takes precedence over the ACL of the bucket in which the object is stored. For example, if the ACL of an object in a private bucket is set to public-read, all users, including anonymous users, can read the object.

ACL

Description

Value

Inherited from bucket

If you do not configure the ACL of an object, the ACL of the object is the same as the ACL of the bucket in which the object is stored.

Aliyun::OSS::ACL::DEFAULT

Private

Only the object owner can perform read and write operations on the object. Other users cannot access the object.

Aliyun::OSS::ACL::PRIVATE

Public-read

Only the object owner can perform write operations on the object. Other users, including anonymous users, can only read the object.

Warning

All users can access the object over the Internet. This may result in unexpected access to the object and unexpectedly high fees. Exercise caution when you set the object ACL to public-read.

Aliyun::OSS::ACL::PUBLIC_READ

Public-read-write

All users, including anonymous users, can perform read and write operations on the object.

Warning

When you set the object ACL to this value, all users can access the object and write data to the object over the Internet. This may result in unauthorized access to the data in your bucket and high fees. If a user uploads prohibited data or information, your legitimate interests and rights may be infringed. Therefore, we recommend that you do not set the object ACL to public-read-write except in special cases.

Aliyun::OSS::ACL::PUBLIC_READ_WRITE

Examples

The following code provides an example on how to configure and obtain the ACL of an object:

require 'aliyun/oss'
client = Aliyun::OSS::Client.new(
  # In this example, the endpoint of the China (Hangzhou) region is used. Specify your actual endpoint. 
  endpoint: 'https://oss-cn-hangzhou.aliyuncs.com',
  # Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
  access_key_id: ENV['OSS_ACCESS_KEY_ID'],
  access_key_secret: ENV['OSS_ACCESS_KEY_SECRET']
)
# Specify the name of the bucket. Example: examplebucket. 
bucket = client.get_bucket('examplebucket')
# Specify the full path of the object. Do not include the bucket name in the full path. Example: exampledir/example.txt. 
# Query the object ACL that is specified when the object is uploaded. 
acl = bucket.get_object_acl('exampledir/example.txt')
puts acl
# Modify the object ACL. 
bucket.set_object_acl('exampledir/example.txt', Aliyun::OSS::ACL::PUBLIC_READ)
acl = bucket.get_object_acl('exampledir/example.txt')
puts acl                

References

  • For more information about the API operation that you can call to configure the ACL of an object, see PutObjectACL.

  • For more information about the API operation that you can call to query the ACL of an object, see GetObjectACL.