CloudOps Orchestration Service:ACS-OSS-PutBucketReferer

Template name

ACS-OSS-PutBucketReferer sets hotlink protection for a bucket.

Execute Now

Template description

Configures hotlink protection for an OSS bucket.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Parameter	Description	Data type	Required	Default value	Limit
bucketName	The name of the Object Storage Service (OSS) bucket.	String	Yes
regionId	The region ID.	String	No	{{ ACS::RegionId }}
allowEmptyReferer	Whether to allow requests with an empty Referer header.	String	No	true
refererList	The Referer whitelist.	List	No	[]
OOSAssumeRole	The RAM role assumed by OOS.	String	No	""

Output parameters

Parameter	Description	Data type
refererInfo		Json

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetBucketReferer",
                "oss:PutBucketReferer"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Details

ACS-OSS-PutBucketReferer

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Configures hotlink protection for a bucket.
  name-en: ACS-OSS-PutBucketReferer
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: Region ID
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  bucketName:
    Label:
      en: Bucket Name
    Type: String
  allowEmptyReferer:
    Label:
      en: Allow Empty Referer
    Description:
      en: Specify whether to allow access to requests whose Referer field is empty
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
  refererList:
    Description:
      en: 'Example: [http://www.aliyun.com, https://www.aliyun.com]'
    Label:
      en: Referer Whitelist URLs
    Type: List
    Default: []
  OOSAssumeRole:
    Label:
      en: OOS Assume Role
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Conditions:
  Empty:
    'Fn::Equals':
      - '{{ refererList }}'
      - []
Tasks:
  - Name: convertXmlParameters
    Action: 'ACS::ECS::SMCConversionConstantByJqScript'
    Description:
      en: Automatically generates the hotlink protection rule for the bucket.
    Properties:
      parameter: '{{ refererList }}'
      jqScript:
        - '. [] | split("[") | join("") | split("]") | join("") | split("\"") | join("") |split(",") | map(. | .="<referer>"+.+"</referer>") as $item| $item | join("") as $itemList | "<refererconfiguration><allowemptyreferer>{{ allowEmptyReferer }}</allowemptyreferer><refererlist>"+$itemList+"</refererlist>" as $refererList |$refererList'
        - .
    Outputs:
      xmlValues:
        Type: String
        ValueSelector: firstValue
  - Name: putBucketReferer
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Enables hotlink protection for the bucket.
    Properties:
      Service: OSS
      API: PutBucketReferer
      Method: PUT
      URI: '?referer'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>{{ convertXmlParameters.xmlValues }}</refererconfiguration>'
  - Name: waitBucketRefererNoRefererList
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated when empty Referer headers are allowed.
    When: Empty
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      DesiredValues:
        - '{{ allowEmptyReferer }}'
      PropertySelector: '.RefererConfiguration.AllowEmptyReferer'
  - Name: waitBucketReferer
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated.
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      NotDesiredValues: '{{ refererList }}'
      PropertySelector: '.RefererConfiguration.RefererList.Referer-{{ refererList }}'
Outputs:
  refererInfo:
    Type: Json
    Value:
      bucketName: '{{ bucketName }}'
      allowEmptyReferer: '{{ allowEmptyReferer }}'
      refererList: '{{ refererList }}'