CloudOps Orchestration Service:ACS-OSS-PutBucketReferer

Template name

ACS-OSS-PutBucketReferer sets hotlink protection for a bucket.

Execute Now

Template description

Configures hotlink protection for an OSS bucket.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Output parameters

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetBucketReferer",
                "oss:PutBucketReferer"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Details

ACS-OSS-PutBucketReferer

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Configures hotlink protection for a bucket.
  name-en: ACS-OSS-PutBucketReferer
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: Region ID
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  bucketName:
    Label:
      en: Bucket Name
    Type: String
  allowEmptyReferer:
    Label:
      en: Allow Empty Referer
    Description:
      en: Specify whether to allow access to requests whose Referer field is empty
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
  refererList:
    Description:
      en: 'Example: [http://www.aliyun.com, https://www.aliyun.com]'
    Label:
      en: Referer Whitelist URLs
    Type: List
    Default: []
  OOSAssumeRole:
    Label:
      en: OOS Assume Role
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Conditions:
  Empty:
    'Fn::Equals':
      - '{{ refererList }}'
      - []
Tasks:
  - Name: convertXmlParameters
    Action: 'ACS::ECS::SMCConversionConstantByJqScript'
    Description:
      en: Automatically generates the hotlink protection rule for the bucket.
    Properties:
      parameter: '{{ refererList }}'
      jqScript:
        - '. [] | split("[") | join("") | split("]") | join("") | split("\"") | join("") |split(",") | map(. | .="<referer>"+.+"</referer>") as $item| $item | join("") as $itemList | "<refererconfiguration><allowemptyreferer>{{ allowEmptyReferer }}</allowemptyreferer><refererlist>"+$itemList+"</refererlist>" as $refererList |$refererList'
        - .
    Outputs:
      xmlValues:
        Type: String
        ValueSelector: firstValue
  - Name: putBucketReferer
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Enables hotlink protection for the bucket.
    Properties:
      Service: OSS
      API: PutBucketReferer
      Method: PUT
      URI: '?referer'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>{{ convertXmlParameters.xmlValues }}</refererconfiguration>'
  - Name: waitBucketRefererNoRefererList
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated when empty Referer headers are allowed.
    When: Empty
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      DesiredValues:
        - '{{ allowEmptyReferer }}'
      PropertySelector: '.RefererConfiguration.AllowEmptyReferer'
  - Name: waitBucketReferer
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated.
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      NotDesiredValues: '{{ refererList }}'
      PropertySelector: '.RefererConfiguration.RefererList.Referer-{{ refererList }}'
Outputs:
  refererInfo:
    Type: Json
    Value:
      bucketName: '{{ bucketName }}'
      allowEmptyReferer: '{{ allowEmptyReferer }}'
      refererList: '{{ refererList }}'