How to use Python SDK V2 to manage file access permissions - Object Storage Service

Usage notes

The sample code in this topic uses the region ID cn-hangzhou of the China (Hangzhou) region. By default, a public endpoint is used to access resources in a bucket. If you want to access resources in the bucket from other Alibaba Cloud services in the same region in which the bucket is located, use an internal endpoint. For more information about the regions and endpoints that OSS supports, see Regions and endpoints.
To set the access permissions for an object, you must have the oss:PutObjectAcl permission. To obtain the access permissions for an object, you must have the oss:GetObjectAcl permission. For more information, see Grant custom policies to a RAM user.

Method

Configure the ACL of an object

put_object_acl(request: PutObjectAclRequest, **kwargs) → PutObjectAclResult

Query the ACL of a bucket.

get_object_acl(request: GetObjectAclRequest, **kwargs) → GetObjectAclResult

Request parameters

Parameter name	Type	Description
request	PutObjectAclRequest	The request parameters. For more information, see PutObjectAclRequest
request	GetObjectAclRequest	The request parameters. For more information, see GetObjectAclRequest

Response parameters

Type	Description
PutObjectAclResult	The return value. For more information, see PutObjectAclResult
GetObjectAclResult	The return value. For more information, see GetObjectAclResult

For the complete definition of the method for setting the ACL of a file, see put_object_acl.

For the complete definition of the method for obtaining the ACL of a file, see get_object_acl.

ACL types

The following table describes the ACLs that you can configure for an object:

ACL	Description	ACL value
Inherit from bucket	Files inherit access permissions from the bucket.	default
Private	Only the file owner and authorized users can read and write the file. Other users cannot access the file.	private
Public-read	Only the file owner and authorized users can read and write the file. Other users can only read the file. Use this permission with caution.	public-read
Public-read-write	All users can read and write the file. Use this permission with caution.	public-read-write

The ACL of an object takes precedence over the ACL of the bucket that contains the object. For example, if the ACL of a bucket is private and the ACL of an object in the bucket is public read/write, all users are granted the read and write permissions on the object. If the ACL of an object is not configured, the ACL of the object is the same as that of the bucket in which the object is stored.

Sample code

Below is the sample code for configuring and obtaining the ACL of an object.

import argparse
import alibabacloud_oss_v2 as oss

# Create a command-line argument parser.
parser = argparse.ArgumentParser(description="put object acl sample")
# Add required parameters: region, bucket name, object key, and access control list (ACL).
parser.add_argument('--region', help='The region in which the bucket is located.', required=True)
parser.add_argument('--bucket', help='The name of the bucket.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS')
parser.add_argument('--key', help='The name of the object.', required=True)
parser.add_argument('--acl', help='Specify the access permission ACL for the object.', required=True)

def main():
    # Parse command-line arguments.
    args = parser.parse_args()

    # Load access credential information from environment variables.
    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    # Use the default configurations of the SDK.
    cfg = oss.config.load_default()
    # Set the credential provider.
    cfg.credentials_provider = credentials_provider
    # Set the region provided by the user.
    cfg.region = args.region
    # If an endpoint is provided, set the endpoint in the configuration.
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    # Create an OSS client.
    client = oss.Client(cfg)

    # Set the ACL of the object.
    result = client.put_object_acl(oss.PutObjectAclRequest(
        bucket=args.bucket,  # The bucket name.
        key=args.key,  # The object key.
        acl=args.acl,  # The new ACL value.
    ))

    # Print the output information after setting the ACL.
    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' version id: {result.version_id},'
    )

    # Obtain and print the current ACL settings of the object.
    result = client.get_object_acl(oss.GetObjectAclRequest(
        bucket=args.bucket,
        key=args.key,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' acl: {result.acl},'
          f' version id: {result.version_id},'
    )

# Call the main function when this script is run directly.
if __name__ == "__main__":
    main()

References

For the complete sample code for setting the ACL of a file, see put_object_acl.py.
For the complete sample code for obtaining the ACL of a file, see get_object_acl.py.