Bucket权限管理
设置Bucket的访问权限
如下代码将Bucket的权限设置为了private。
public void setBucketPrivate (BosClient client, String bucketName) {
client.setBucketAcl(<bucketName>, CannedAccessControlList.Private);
}
CannedAccessControlList是枚举类型,包含三个值: Private
、 PublicRead
、 PublicReadWrite
,它们分别对应相关权限。具体内容可以参考BOS API文档 使用CannedAcl方式的权限控制。
设置指定用户对Bucket的访问权限
BOS还可以实现设置指定用户对Bucket的访问权限,参考如下代码实现:
List<Grant> accessControlList = new ArrayList<Grant>();
List<Grantee> grantees = new ArrayList<Grantee>();
List<Permission> permissions = new ArrayList<Permission>();
List<String> ipAddress = new ArrayList<String>();
List<String> stringLike = new ArrayList<String>();
List<String> stringEquals = new ArrayList<String>();
List<String> resource = new ArrayList<String>();
List<String> notResource = new ArrayList<String>();
Referer referer = new Referer();
Condition condition = new Condition();
// 授权给特定用户
grantees.add(new Grantee("user_id1"));
grantees.add(new Grantee("user_id2"));
grantees.add(new Grantee("user_id3"));
//授权给Everyone
grantees.add(new Grantee("*"));
//设置权限
permissions.add(Permission.WRITE);
permissions.add(Permission.READ);
permissions.add(Permission.LIST);
// 设置ip
ipAddress.add("ipAddress1");
ipAddress.add("ipAddress2");
ipAddress.add("ipAddress3");
condition.setIpAddress(ipAddress);
//设置 refer stringLike
stringLike.add("http://www.example1.com/");
stringLike.add("http://www.example2.com/");
stringLike.add("http://www.example3.com/");
referer.setStringLike(stringLike);
condition.setReferer(referer);
// 设置 refer stringEquals
stringEquals.add("http://www.baidu.com");
stringEquals.add("http://www.xiaomi.com");
stringEquals.add("http://www.google.com");
referer.setStringEquals(stringEquals);
condition.setReferer(referer);
// 设置 resource
resource.add("yourBucketName");
//设置notResource
List<String> notResouce = new ArrayList<String>();
notResouce.add("yourBucketName");
notResouce.add("yourBucketName/*");
Grant grant = new Grant();
grant.setGrantee(grantees);
grant.setPermission(permissions);
grant.setCondition(condition);
grant.setResource(resource);
List<Grantee> grantees1 = new ArrayList<Grantee>();
List<Permission> permissions1 = new ArrayList<Permission>();
List<String> ipAddress1 = new ArrayList<String>();
List<String> stringLike1 = new ArrayList<String>();
List<String> stringEquals1 = new ArrayList<String>();
List<String> resource1 = new ArrayList<String>();
List<String> notResource1 = new ArrayList<String>();
Referer referer1 = new Referer();
Condition condition1 = new Condition();
// 授权给特定用户
grantees1.add(new Grantee("user_id4"));
grantees1.add(new Grantee("user_id5"));
grantees1.add(new Grantee("user_id6"));
//授权给Everyone
grantees.add(new Grantee("*"));
//设置权限
permissions.add(Permission.FULL_CONTROL);
permissions1.add(Permission.WRITE);
permissions1.add(Permission.READ);
permissions1.add(Permission.LIST);
// 设置ip
ipAddress1.add("ipAddress4");
ipAddress1.add("ipAddress5");
ipAddress1.add("ipAddress6");
condition1.setIpAddress(ipAddress1);
//设置 refer stringLike
stringLike1.add("http://www.example4.com/");
stringLike1.add("http://www.example5.com/");
stringLike1.add("http://www.example6.com/");
referer1.setStringLike(stringLike1);
condition1.setReferer(referer1);
// 设置 refer stringEquals
stringEquals1.add("http://www.baidu1.com");
stringEquals1.add("http://www.xiaomi1.com");
stringEquals1.add("http://www.google1.com");
referer1.setStringEquals(stringEquals1);
condition1.setReferer(referer1);
// 设置 resource
resource1.add("yourBucketName");
// 设置notResource
List<String> notResouce = new ArrayList<String>();
notResouce.add("yourBucketName");
notResouce.add("yourBucketName/*");
Grant grant1 = new Grant();
grant1.setGrantee(grantees1);
grant1.setPermission(permissions1);
grant1.setCondition(condition1);
grant1.setResource(resource1);
accessControlList.add(grant);
accessControlList.add(grant1);
SetBucketAclRequest request = new SetBucketAclRequest("yourBucketName",accessControlList);
client.setBucketAcl(request);
注意: resource和notResource不能同时设置 Permission中的权限设置包含三个值:
READ
、WRITE
、FULL_CONTROL
,它们分别对应相关权限。具体内容可以参考BOS API文档 上传ACL文件方式的权限控制。
设置更多Bucket访问权限
- 通过设置refer白名单方式设置防盗链
String jsonAcl = "";
client.setBucketAcl("bucketName", jsonAcl)
其中jsonAcl为{\"accessControlList\":["+ "{\"grantee\":[{\"id\":\"*\"}], "+ "\"permission\":[\"FULL_CONTROL\"], "+ "\"condition\":{\"referer\":{\"stringEquals\":[\"http://test/index\"]}" + "}}]}
- 限制客户端IP访问,只允许部分客户端IP访问
String jsonAcl = "";
client.setBucketAcl("bucketName", jsonAcl)
其中jsonAcl为{\"accessControlList\":["+ "{\"grantee\":[{\"id\":\"*\"}], "+ "\"permission\":[\"FULL_CONTROL\"], "+ "\"condition\":{\"ipAddress\":[\"192.170.0.6\"]" + "}}]}"}
设置STS临时token权限
对于通过STS方式创建的临时访问身份,管理员也可进行专门的权限设定。 STS的简介及设置临时权限的方式可参见临时授权访问。
使用BOS JAVA SDK设置STS临时token权限可参考使用STS创建BosClient
查看Bucket的权限
如下代码可以查看Bucket的权限:
GetBucketAclResponse aclResponse = client.getBucketAcl("bucketName");
System.out.println(aclResponse.getAccessControlList().toString());
getBucketAcl
方法返回的解析类中可供调用的参数有:
参数 | 说明 |
---|---|
owner | Bucket owner信息 |
id | Bucket owner的用户ID |
acl | 标识Bucket的权限列表 |
grantee | 标识被授权人 |
-id | 被授权人ID |
permission | 标识被授权人的权限 |