ACS-OSS-PutBucketEncryption - CloudOps Orchestration Service

Configure le chiffrement côté serveur pour un compartiment Object Storage Service (OSS).

Nom du modèle

ACS-OSS-PutBucketEncryption

Execute Now

Description du modèle

Configure une règle de chiffrement des données pour un compartiment Object Storage Service (OSS).

Type de modèle

Automatisé

Propriétaire

Alibaba Cloud

Paramètres d'entrée

Paramètre	Description	Type de données	Obligatoire	Valeur par défaut	Limite
SSEAlgorithm	Méthode de chiffrement côté serveur (SSE).	String	Oui
bucketName	Nom du compartiment OSS.	String	Oui
regionId	ID de la région.	String	Non	{{ ACS::RegionId }}
KMSMasterKeyID	ID de la clé Key Management Service (KMS).	String	Non	False
OOSAssumeRole	Rôle RAM à endosser par CloudOps Orchestration Service (OOS).	String	Non	""

Paramètres de sortie

Aucun.

Stratégie d'autorisation requise pour exécuter le modèle

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutBucketEncryption"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Références

ACS-OSS-PutBucketEncryption

Contenu du modèle

FormatVersion: OOS-2019-06-01
Description:
  en: Encryption rules for configuring buckets
  name-en: ACS-OSS-PutBucketEncryption 
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: RegionId   
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  SSEAlgorithm:
    Label:
      en: SSEAlgorithm      
    Description:
      en: Set the default encryption method of the server      
    Type: String
    AllowedValues:
      - KMS
      - AES256
  KMSMasterKeyID:
    Label:
      en: KMSMasterKeyID      
    Description:
      en: >-
        When the ssealgorithm value is KMS, you need to enter the key ID,
        otherwise, it must be empty(Default No is empty)      
    Type: String
    Default: No
  bucketName:
    Label:
      en: BucketName       
    Type: String
    AssociationProperty: ALIYUN::OSS::Bucket::BucketName
    AssociationPropertyMetadata:
      RegionId: regionId
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: chooseWetherHasKMSMasterKeyIDTask
    Action: 'ACS::Choice'
    Properties:
      DefaultTask: putBucketEncryptionNoKeyId
      Choices:
        - When:
            'Fn::Equals':
              - KMS
              - '{{ SSEAlgorithm }}'
          NextTask: putBucketEncryption
        - When:
            'Fn::Equals':
              - AES256
              - '{{ SSEAlgorithm }}'
          NextTask: putBucketEncryptionNoKeyId
  - Name: putBucketEncryptionNoKeyId
    Action: 'ACS::ExecuteAPI'
    Description:
      en: 'Encryption rules for configuring buckets(AES256)'      
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: PutBucketEncryption
      Method: PUT
      URI: '?encryption'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        RegionId: '{{ regionId }}'
        BucketName: '{{ bucketName }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>
             <ServerSideEncryptionRule>
               <ApplyServerSideEncryptionByDefault>
                 <SSEAlgorithm>{{ SSEAlgorithm }}</SSEAlgorithm>
                 <KMSMasterKeyID></KMSMasterKeyID>
               </ApplyServerSideEncryptionByDefault>
             </ServerSideEncryptionRule>'
  - Name: putBucketEncryption
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Encryption rules for configuring buckets(KMS)     
    Properties:
      Service: OSS
      API: PutBucketEncryption
      Method: PUT
      URI: '?encryption'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        RegionId: '{{ regionId }}'
        BucketName: '{{ bucketName }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>
             <ServerSideEncryptionRule>
               <ApplyServerSideEncryptionByDefault>
                 <SSEAlgorithm>{{ SSEAlgorithm }}</SSEAlgorithm>
                 <KMSMasterKeyID>{{ KMSMasterKeyID }}</KMSMasterKeyID>
               </ApplyServerSideEncryptionByDefault>
             </ServerSideEncryptionRule>'