CloudOps Orchestration Service：ACS-OSS-PutBucketReferer

Nama template

Template ACS-OSS-PutBucketReferer mengonfigurasi Perlindungan hotlink untuk sebuah bucket.

Jalankan Sekarang

Deskripsi template

Mengonfigurasi Perlindungan hotlink untuk bucket Object Storage Service (OSS).

Tipe template

Otomatis

Pemilik

Alibaba Cloud

Parameter input

Parameter output

Kebijakan izin yang diperlukan untuk mengeksekusi template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:GetBucketReferer",
                "oss:PutBucketReferer"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Detail

ACS-OSS-PutBucketReferer

Isi Template

FormatVersion: OOS-2019-06-01
Description:
  en: Configures hotlink protection for a bucket.
  name-en: ACS-OSS-PutBucketReferer
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: Region ID
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  bucketName:
    Label:
      en: Bucket Name
    Type: String
  allowEmptyReferer:
    Label:
      en: Allow Empty Referer
    Description:
      en: Specify whether to allow access to requests whose Referer field is empty
    Type: String
    Default: 'true'
    AllowedValues:
      - 'true'
      - 'false'
  refererList:
    Description:
      en: 'Example: [http://www.aliyun.com, https://www.aliyun.com]'
    Label:
      en: Referer Whitelist URLs
    Type: List
    Default: []
  OOSAssumeRole:
    Label:
      en: OOS Assume Role
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Conditions:
  Empty:
    'Fn::Equals':
      - '{{ refererList }}'
      - []
Tasks:
  - Name: convertXmlParameters
    Action: 'ACS::ECS::SMCConversionConstantByJqScript'
    Description:
      en: Automatically generates the hotlink protection rule for the bucket.
    Properties:
      parameter: '{{ refererList }}'
      jqScript:
        - '. [] | split("[") | join("") | split("]") | join("") | split("\"") | join("") |split(",") | map(. | .="<referer>"+.+"</referer>") as $item| $item | join("") as $itemList | "<refererconfiguration><allowemptyreferer>{{ allowEmptyReferer }}</allowemptyreferer><refererlist>"+$itemList+"</refererlist>" as $refererList |$refererList'
        - .
    Outputs:
      xmlValues:
        Type: String
        ValueSelector: firstValue
  - Name: putBucketReferer
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Enables hotlink protection for the bucket.
    Properties:
      Service: OSS
      API: PutBucketReferer
      Method: PUT
      URI: '?referer'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>{{ convertXmlParameters.xmlValues }}</refererconfiguration>'
  - Name: waitBucketRefererNoRefererList
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated when empty Referer headers are allowed.
    When: Empty
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      DesiredValues:
        - '{{ allowEmptyReferer }}'
      PropertySelector: '.RefererConfiguration.AllowEmptyReferer'
  - Name: waitBucketReferer
    Action: 'ACS::WaitFor'
    Description:
      en: Waits for the hotlink protection settings to be updated.
    Properties:
      Service: OSS
      API: GetBucketReferer
      Method: GET
      URI: '?referer'
      Headers: {}
      Parameters:
        BucketName: '{{ bucketName }}'
        RegionId: '{{ regionId }}'
      NotDesiredValues: '{{ refererList }}'
      PropertySelector: '.RefererConfiguration.RefererList.Referer-{{ refererList }}'
Outputs:
  refererInfo:
    Type: Json
    Value:
      bucketName: '{{ bucketName }}'
      allowEmptyReferer: '{{ allowEmptyReferer }}'
      refererList: '{{ refererList }}'