All Products
Search
Document Center

Object Storage Service:Manage object ACLs using OSS SDK for PHP 2.0

Last Updated:Jun 17, 2026

You can set and query the access control lists (ACLs) of objects by using OSS SDK for PHP.

Usage notes

  • The sample code in this topic uses the cn-hangzhou region and the public endpoint by default. If you access the bucket from another Alibaba Cloud service in the same region, use an internal endpoint for better performance and security. For more information about regions and endpoints, see Regions and Endpoints.

  • To set an object ACL, you must have the oss:PutObjectAcl permission. To query an object ACL, you must have the oss:GetObjectAcl permission. For more information, see Grant a custom policy.

Types of ACLs

The following table describes the ACL types available for an object.

ACL

Description

Value

Inherited from the bucket

The object inherits the ACL of the bucket in which it is stored.

oss.ObjectACLDefault

Private

Only the object owner and authorized users can read and write the object. Other users cannot access the object.

oss.ObjectACLPrivate

Public-read

Only the object owner and authorized users can read and write the object. Other users can only read the object. Exercise caution when you set the object ACL to this value.

ObjectACLPublicRead

Public-read-write

All users can read and write the object. Exercise caution when you set the object ACL to this value.

oss.ObjectACLPublicReadWrite

An object ACL takes precedence over the bucket ACL. For example, if an object in a private bucket has the public-read ACL, all users, including anonymous users, can read the object. If no ACL is set for an object, the object inherits the ACL of its bucket.

Sample code

1. Set the ACL of an object.

<?php

require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

$optsdesc = [
    "region" => ['help' => 'The region in which the bucket is located.', 'required' => True],
    "endpoint" => ['help' => 'The domain names that other services can use to access OSS.', 'required' => False],
    "bucket" => ['help' => 'The name of the bucket', 'required' => True],
    "key" => ['help' => 'The name of the object', 'required' => True],
];

// Create an array of long options required by getopt. Example: --region:.
$longopts = array_map(function ($key) {
    return "$key:";
}, array_keys($optsdesc));

// Parse the command line parameters.
$options = getopt("", $longopts); 

// Check whether the required parameters are missing.
foreach ($optsdesc as $key => $value) {
    if ($value['required'] === True && empty($options[$key])) {
        // Print the help information and exit if required parameters are missing.
        $help = $value['help'];
        echo "Error: the following arguments are required: --$key, $help\n";
        exit(1);
    }
}

// Extract the values of the parameters.
$region = $options["region"];
$bucket = $options["bucket"];
$key = $options["key"];

// Obtain access credentials (AccessKey ID and AccessKey secret) from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

// Load the default configurations and specify the credential provider and region.
$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider($credentialsProvider);
$cfg->setRegion($region);

// If the endpoint parameter is specified, it will be configured as the custom access URL.
if (isset($options["endpoint"])) {
    $cfg->setEndpoint($options["endpoint"]);
}

// Initialize the OSSClient instance.
$client = new Oss\Client($cfg);

// Create a PutObjectAclRequest object and specify the bucket name, object key and ACL.
$request = new Oss\Models\PutObjectAclRequest($bucket, $key, Oss\Models\ObjectACLType::PUBLIC_READ);

// Set the ACL of the object to public-read.
$result = $client->putObjectAcl($request);

// Output the HTTP status code and request ID from the response.
printf(
    'status code:' . $result->statusCode . PHP_EOL .
    'request id:' . $result->requestId
);

2. Query the ACL of a bucket.

<?php

// Introduce autoload files to load dependent libraries.
require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Specify descriptions for command line parameters.
$optsdesc = [
    "region" => ['help' => 'The region in which the bucket is located', 'required' => True], // (Required) Specify the region in which the bucket is located.
    "endpoint" => ['help' => 'The domain names that other services can use to access OSS', 'required' => False], // (Optional) Specify the OSS endpoint.
    "bucket" => ['help' => 'The name of the bucket', 'required' => True], // (Required) Specify the name of the bucket.
    "key" => ['help' => 'The name of the object', 'required' => True], // (Required) Specify the name of the object.
];

// Generate a long options list to parse the command line parameters.
$longopts = \array_map(function ($key) {
    return "$key:"; // Add a colon (:) to the end of each parameter to indicate that a value is required.
}, array_keys($optsdesc));

// Parse the command line parameters.
$options = getopt("", $longopts); 

// Check whether the required parameters are missing.
foreach ($optsdesc as $key => $value) {
    if ($value['required'] === True && empty($options[$key])) {
        $help = $value['help'];
        echo "Error: the following arguments are required: --$key, $help"; // Display the required but missing parameters.
        exit(1); 
    }
}

// Obtain the values of the command line parameters.
$region = $options["region"]; // The region in which the bucket is located.
$bucket = $options["bucket"]; // The name of the bucket.
$key = $options["key"]; // The name of the object.

// Load the AccessKey ID and AccessKey secret from environment variables.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

// Use the default configurations of the SDK.
$cfg = Oss\Config::loadDefault();

// Specify the credential provider.
$cfg->setCredentialsProvider($credentialsProvider);

// Specify the region.
$cfg->setRegion($region);

// If an endpoint is provided, specify the endpoint.
if (isset($options["endpoint"])) {
    $cfg->setEndpoint($options["endpoint"]);
}

// Create an OSSClient instance.
$client = new Oss\Client($cfg);

// Create a request object for obtaining the ACL of the object.
$request = new Oss\Models\GetObjectAclRequest(bucket: $bucket, key: $key);

// Use the getObjectAcl method to query the ACL of the object.
$result = $client->getObjectAcl($request);

// Display the result.
printf(
    'status code:' . $result->statusCode . PHP_EOL . // The HTTP status code.
    'request id:' . $result->requestId . PHP_EOL . // The request ID.
    'acl:' . $result->accessControlList->grant // The ACL of the object.
);

References

  • For the complete sample code for setting the ACL of an object, visit GitHub.

  • For the API operation for setting the ACL of an object, see PutObjectACL.

  • For the complete sample code for querying the ACL of an object, visit GitHub.

  • For the API operation for querying the ACL of an object, see GetObjectACL.