How to manage file access permissions - Object Storage Service

This topic describes how to manage file access permissions.

Background information

Files support the following four types of access control lists (ACLs):

Access permission	Description	ACL value
Inherit from bucket	The file inherits the ACL of the bucket.	oss2.OBJECT_ACL_DEFAULT
Private	Only the file owner and authorized users have read and write permissions on the file. Other users cannot access the file.	oss2.OBJECT_ACL_PRIVATE
Public-read	The file owner and authorized users have read and write permissions on the file. Other users have only read permissions on the file. Use this permission with caution.	oss2.OBJECT_ACL_PUBLIC_READ
Public-read-write	All users have read and write permissions on the file. Use this permission with caution.	oss2.OBJECT_ACL_PUBLIC_READ_WRITE

The ACL of a file takes precedence over the ACL of the bucket. For example, if a bucket is private but a file in the bucket is public-read-write, all users have read and write permissions on the file. If a file does not have an ACL, it inherits the ACL of the bucket.

Usage notes

In this topic, the public endpoint of the China (Hangzhou) region is used. If you want to access OSS from other Alibaba Cloud services in the same region as OSS, use an internal endpoint. For more information about OSS regions and endpoints, see Regions and endpoints.
In this topic, access credentials are obtained from environment variables. For more information about how to configure access credentials, see Configure access credentials using OSS SDK for Python 1.0.
In this topic, an OSSClient instance is created by using an OSS endpoint. If you want to create an OSSClient instance by using custom domain names or Security Token Service (STS), see Initialization.
To configure the ACL for an object, you must have the oss:PutObjectAcl permission. To query object ACLs, you must have the oss:GetObjectAcl permission. For more information, see Attach a custom policy to a RAM user.

Set file access permissions

The following sample code provides an example on how to configure the ACL of an object:

# -*- coding: utf-8 -*-
import oss2
from oss2.credentials import EnvironmentVariableCredentialsProvider
# Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
auth = oss2.ProviderAuthV4(EnvironmentVariableCredentialsProvider())

# Specify the Endpoint for the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set the Endpoint to https://oss-cn-hangzhou.aliyuncs.com.
endpoint = "https://oss-cn-hangzhou.aliyuncs.com"

# Specify the region where the bucket is located, such as cn-hangzhou. Note that this parameter is required for V4 signatures.
region = "cn-hangzhou"

# Set yourBucketName to the name of the bucket.
bucket = oss2.Bucket(auth, endpoint, "yourBucketName", region=region)

# Set yourObjectName to the full path of the object. The full path cannot contain the bucket name.
bucket.put_object_acl('yourObjectName', oss2.OBJECT_ACL_PUBLIC_READ)

Get file access permissions

The following sample code provides an example on how to query the ACL of an object:

# -*- coding: utf-8 -*-
import oss2
from oss2.credentials import EnvironmentVariableCredentialsProvider
# Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured.
auth = oss2.ProviderAuthV4(EnvironmentVariableCredentialsProvider())

# Specify the Endpoint for the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set the Endpoint to https://oss-cn-hangzhou.aliyuncs.com.
endpoint = "https://oss-cn-hangzhou.aliyuncs.com"

# Specify the region where the bucket is located, such as cn-hangzhou. Note that this parameter is required for V4 signatures.
region = "cn-hangzhou"

# Set yourBucketName to the name of the bucket.
bucket = oss2.Bucket(auth, endpoint, "yourBucketName", region=region)

# Set yourObjectName to the full path of the object. The full path cannot contain the bucket name.
print(bucket.get_object_acl('yourObjectName').acl)

References

For more information about the API operation to set file access permissions, see PutObjectACL.
For more information about the API operation to retrieve file access permissions, see GetObjectACL.