ACS-OSS-PutBucketEncryption - CloudOps Orchestration Service: Central de Documentação do Alibaba Cloud

Configura a criptografia do lado do servidor para um bucket do Object Storage Service (OSS).

Nome do modelo

ACS-OSS-PutBucketEncryption

Executar agora

Descrição do modelo

Define uma regra de criptografia de dados para um bucket do Object Storage Service (OSS).

Tipo de modelo

Automatizado

Proprietário

Alibaba Cloud

Parâmetros de entrada

Parâmetro	Descrição	Tipo de dados	Obrigatório	Valor padrão	Limite
SSEAlgorithm	Método de criptografia do lado do servidor (SSE).	String	Sim
bucketName	Nome do bucket do OSS.	String	Sim
regionId	ID da região.	String	Não	{{ ACS::RegionId }}
KMSMasterKeyID	ID da chave do Key Management Service (KMS).	String	Não	False
OOSAssumeRole	Função do RAM que o CloudOps Orchestration Service (OOS) deve assumir.	String	Não	""

Parâmetros de saída

N/D.

Política de permissões necessária para executar o modelo

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss:PutBucketEncryption"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Referências

ACS-OSS-PutBucketEncryption

Conteúdo do modelo

FormatVersion: OOS-2019-06-01
Description:
  en: Encryption rules for configuring buckets
  name-en: ACS-OSS-PutBucketEncryption 
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: RegionId   
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  SSEAlgorithm:
    Label:
      en: SSEAlgorithm      
    Description:
      en: Set the default encryption method of the server      
    Type: String
    AllowedValues:
      - KMS
      - AES256
  KMSMasterKeyID:
    Label:
      en: KMSMasterKeyID      
    Description:
      en: >-
        When the ssealgorithm value is KMS, you need to enter the key ID,
        otherwise, it must be empty(Default No is empty)      
    Type: String
    Default: No
  bucketName:
    Label:
      en: BucketName       
    Type: String
    AssociationProperty: ALIYUN::OSS::Bucket::BucketName
    AssociationPropertyMetadata:
      RegionId: regionId
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: chooseWetherHasKMSMasterKeyIDTask
    Action: 'ACS::Choice'
    Properties:
      DefaultTask: putBucketEncryptionNoKeyId
      Choices:
        - When:
            'Fn::Equals':
              - KMS
              - '{{ SSEAlgorithm }}'
          NextTask: putBucketEncryption
        - When:
            'Fn::Equals':
              - AES256
              - '{{ SSEAlgorithm }}'
          NextTask: putBucketEncryptionNoKeyId
  - Name: putBucketEncryptionNoKeyId
    Action: 'ACS::ExecuteAPI'
    Description:
      en: 'Encryption rules for configuring buckets(AES256)'      
    OnSuccess: 'ACS::END'
    Properties:
      Service: OSS
      API: PutBucketEncryption
      Method: PUT
      URI: '?encryption'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        RegionId: '{{ regionId }}'
        BucketName: '{{ bucketName }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>
             <ServerSideEncryptionRule>
               <ApplyServerSideEncryptionByDefault>
                 <SSEAlgorithm>{{ SSEAlgorithm }}</SSEAlgorithm>
                 <KMSMasterKeyID></KMSMasterKeyID>
               </ApplyServerSideEncryptionByDefault>
             </ServerSideEncryptionRule>'
  - Name: putBucketEncryption
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Encryption rules for configuring buckets(KMS)     
    Properties:
      Service: OSS
      API: PutBucketEncryption
      Method: PUT
      URI: '?encryption'
      Headers:
        Content-MD5: ""
        Content-Type: application/xml
      Parameters:
        RegionId: '{{ regionId }}'
        BucketName: '{{ bucketName }}'
      Body: '<?xml version="1.0" encoding="UTF-8"?>
             <ServerSideEncryptionRule>
               <ApplyServerSideEncryptionByDefault>
                 <SSEAlgorithm>{{ SSEAlgorithm }}</SSEAlgorithm>
                 <KMSMasterKeyID>{{ KMSMasterKeyID }}</KMSMasterKeyID>
               </ApplyServerSideEncryptionByDefault>
             </ServerSideEncryptionRule>'