In addition to bucket-level access control lists (ACLs), Object Storage Service (OSS) provides object-level ACLs. You can configure the ACL of an object when you upload it or modify its ACL after it is uploaded.
Object ACLs
An Object has four read/write permissions:
The ACL of an object takes precedence over the ACL of the bucket in which the object is stored. For example, if the ACL of an object in a private bucket is set to public-read, all users, including anonymous users, can read the object.
Permission type | Description | Permission value |
Inherited from bucket | If you do not configure the ACL of an object, the ACL of the object is the same as the ACL of the bucket in which the object is stored. | Aliyun::OSS::ACL::DEFAULT |
Private | Only the object owner can perform read and write operations on the object. Other users cannot access the object. | Aliyun::OSS::ACL::PRIVATE |
Public-read | Only the object owner can perform write operations on the object. Other users, including anonymous users, can only read the object. Warning This may result in unauthorized access to data in your bucket and high costs. Exercise caution when you set the object ACL to public-read. | Aliyun::OSS::ACL::PUBLIC_READ |
Public-read-write | All users, including anonymous users, can perform read and write operations on the object. Warning If you set the object ACL to this value, all users can access the object and write data to the object over the Internet. This may result in unauthorized access to data in your bucket and high costs. If a user uploads prohibited data or information to the bucket, your legitimate interests and rights may be infringed. Therefore, we recommend that you do not set the ACL of a bucket to public-read-write unless necessary. | Aliyun::OSS::ACL::PUBLIC_READ_WRITE |
Examples
The following code provides an example on how to configure and obtain the ACL of an object:
require 'aliyun/oss'
client = Aliyun::OSS::Client.new(
# The China (Hangzhou) region is used as an example. Replace the endpoint with the one for your region.
endpoint: 'https://oss-cn-hangzhou.aliyuncs.com',
# Obtain access credentials from environment variables. Before you run this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
access_key_id: ENV['OSS_ACCESS_KEY_ID'],
access_key_secret: ENV['OSS_ACCESS_KEY_SECRET']
)
# Specify the bucket name. For example, examplebucket.
bucket = client.get_bucket('examplebucket')
# Specify the full path of the object. The full path cannot contain the bucket name. For example, exampledir/example.txt.
# Get the ACL of the object that is set during the upload.
acl = bucket.get_object_acl('exampledir/example.txt')
puts acl
# Modify the ACL of the object.
bucket.set_object_acl('exampledir/example.txt', Aliyun::OSS::ACL::PUBLIC_READ)
acl = bucket.get_object_acl('exampledir/example.txt')
puts acl References
For more information about the API operation that you can call to configure the ACL of an object, see PutObjectACL.
For more information about the API operation that you can call to query the ACL of an object, see GetObjectACL.