ACS-OSS-PutBucketReferer - CloudOps Orchestration Service - Centre de documentation Alibaba Cloud

Configurez la protection contre le vol de lien (hotlink) pour un bucket Object Storage Service (OSS).

Nom du modèle

Le modèle ACS-OSS-PutBucketReferer configure la protection contre le vol de lien pour un bucket.

Exécuter maintenant

Description du modèle

Ce modèle configure la protection contre le vol de lien pour un bucket OSS.

Type de modèle

Automatisé

Propriétaire

Alibaba Cloud

Paramètres d'entrée

|
**Paramètre**
|
**Description**
|
**Type de données**
|
**Obligatoire**
|
**Valeur par défaut**
|
**Limite**
| | --- | --- | --- | --- | --- | --- | |
bucketName
|
Nom du bucket Object Storage Service (OSS).
|
String
|
Oui
| | | |
regionId
|
ID de la région.
|
String
|
Non
|
{{ ACS::RegionId }}
| | |
allowEmptyReferer
|
Indique si les requêtes avec un en-tête Referer vide sont autorisées.
|
String
|
Non
|
true
| | |
refererList
|
Liste d'autorisation des referers.
|
List
|
Non
|
[]
| | |
OOSAssumeRole
|
Rôle RAM assumé par OOS.
|
String
|
Non
|
""
| |

Paramètres de sortie

|
**Paramètre**
|
**Description**
|
**Type de données**
| | --- | --- | --- | |
refererInfo
| |
Json
|

Politique d'autorisations requise pour exécuter le modèle

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetBucketReferer",
                "oss:PutBucketReferer"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Détails

ACS-OSS-PutBucketReferer

Contenu du modèle

FormatVersion: OOS-2019-06-01
Description:
  en: Configures hotlink protection for a bucket.
  name-en: ACS-OSS-PutBucketReferer
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: Region ID
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  bucketName:
    Label:
      en: Bucket Name
    Type: String
  allowEmptyReferer:
    Label:
      en: Allow Empty Referer
    Description:
      en: Specify whether to allow access to requests whose Referer field is empty
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
  refererList:
    Description:
      en: 'Example: [http://www.aliyun.com, https://www.aliyun.com]'
    Label:
      en: Referer Whitelist URLs
    Type: List
    Default: []
  OOSAssumeRole:
    Label:
      en: OOS Assume Role
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Conditions:
  Empty:
    'Fn::Equals':
      - '{{ refererList }}'
      - []
Tasks:
  - Name: convertXmlParameters
    Action: 'ACS::ECS::SMCConversionConstantByJqScript'
    Description:
      en: Automatically generates the hotlink protection rule for the bucket.
    Properties:
      parameter: '{{ refererList }}'
      jqScript:
        - '. [] | split("[") | join("") | split("]") | join("") | split("\"") | join("") |split(",") | map(. | .="<referer>"+.+"</referer>") as $item| $item | join("") as $itemList | "<refererconfiguration><allowemptyreferer>{{ allowEmptyReferer }}</allowemptyreferer><refererlist>"+$itemList+"</refererlist>" as $refererList |$refererList'
        - .
    Outputs:
      xmlValues:
        Type: String
        ValueSelector: firstValue
  - Name: putBucketReferer
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Enables hotlink protection for the bucket.
    Properties:
      Service: OSS
      API: PutBucketReferer
      Method: PUT
      URI: '?referer'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>{{ convertXmlParameters.xmlValues }}</refererconfiguration>'
  - Name: waitBucketRefererNoRefererList
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated when empty Referer headers are allowed.
    When: Empty
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      DesiredValues:
        - '{{ allowEmptyReferer }}'
      PropertySelector: '.RefererConfiguration.AllowEmptyReferer'
  - Name: waitBucketReferer
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated.
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      NotDesiredValues: '{{ refererList }}'
      PropertySelector: '.RefererConfiguration.RefererList.Referer-{{ refererList }}'
Outputs:
  refererInfo:
    Type: Json
    Value:
      bucketName: '{{ bucketName }}'
      allowEmptyReferer: '{{ allowEmptyReferer }}'
      refererList: '{{ refererList }}'