CloudOps Orchestration Service:ACS-OSS-PutBucketReferer

Template name

ACS-OSS-PutBucketReferer

Execute Now

Template description

Configures a Referer whitelist for a bucket.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Output parameters

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetBucketReferer",
                "oss:PutBucketReferer"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

References

ACS-OSS-PutBucketReferer

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Put the bucket referer   
  name-en: ACS-OSS-PutBucketReferer  
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: RegionId      
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  bucketName:
    Label:
      en: BucketName      
    Type: String
  allowEmptyReferer:
    Description:
      en: Specify whether to allow access to requests whose Referer field is empty      
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
  refererList:
    Description:
      en: for example:[http://www.aliyun.com, https://www.aliyun.com]       
    Label:
      en: Save Referer Access Whitelist URL      
    Type: List
    Default: []
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole     
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: convertXmlParameters
    Action: 'ACS::ECS::SMCConversionConstantByJqScript'
    Description:
      en: Automatically make bucket referer configuration     
    Properties:
      parameter: '{{ refererList }}'
      jqScript:
        - '. [] | split("[") | join("") | split("]") | join("") | split("\"") | join("") |split(",") | map(. | .="<Referer>"+.+"</Referer>") as $item| $item | join("") as $itemList | "<RefererConfiguration><AllowEmptyReferer>{{ allowEmptyReferer }}</AllowEmptyReferer><RefererList>"+$itemList+"</RefererList>" as $refererList |$refererList'
        - .
    Outputs:
      xmlValues:
        Type: String
        ValueSelector: firstValue
  - Name: putBucketReferer
    Action: 'ACS::ExecuteAPI'
    Description:
      en: 'Enable the bucket referer'      
    Properties:
      Service: OSS
      API: PutBucketReferer
      Method: PUT
      URI: '?referer'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>{{ convertXmlParameters.xmlValues }}</RefererConfiguration>'
  - Name: waitBucketRefererNoRefererList
    Action: 'ACS::WaitFor'
    Description:
      en: Wait for the bucket referer modification to complete when referer is allowed to be empty      
    When:
      'Fn::Equals':
        - '{{ refererList }}'
        - []
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      DesiredValues:
        - '{{ allowEmptyReferer }}'
      PropertySelector: '.RefererConfiguration.AllowEmptyReferer'
  - Name: waitBucketReferer
    Action: 'ACS::WaitFor'
    Description:
      en: Wait for the bucket referer modification to complete      
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      NotDesiredValues: '{{ refererList }}'
      PropertySelector: '.RefererConfiguration.RefererList.Referer-{{ refererList }}'
Outputs:
  refererInfo:
    Type: Json
    Value:
      bucketName: '{{ bucketName }}'
      allowEmptyReferer: '{{ allowEmptyReferer }}'
      refererList: '{{ refererList }}'