Manage object ACLs (Python SDK V2)

Notes

• The sample code uses the region ID cn-hangzhou for the China (Hangzhou) region and accesses OSS over a public endpoint by default. To access OSS from other Alibaba Cloud services in the same region, use an internal endpoint. For more information, see OSS regions and endpoints.

• Configuring object ACLs requires the oss:PutObjectAcl permission. Querying object ACLs requires the oss:GetObjectAcl permission. For more information, see Grant custom permissions to RAM users.

Types of ACLs

The following table describes the ACLs available for an object.

An object ACL takes precedence over the bucket ACL. For example, if a bucket ACL is private but an object ACL is public-read-write, all users have read and write permissions on that object. If no ACL is configured for an object, the object inherits the bucket ACL.

Sample code

The following code shows how to configure and query the ACL of an object.

import argparse
import alibabacloud_oss_v2 as oss

# Create a command-line argument parser and describe the purpose of the script: put object ACL sample.
parser = argparse.ArgumentParser(description="put object acl sample")

# Add the command-line argument --region, which specifies the region where the bucket is located. This argument is required.
parser.add_argument('--region', help='The region in which the bucket is located.', required=True)
# Add the command-line argument --bucket, which specifies the name of the bucket. This argument is required.
parser.add_argument('--bucket', help='The name of the bucket.', required=True)
# Add the command-line argument --endpoint, which specifies the domain names that other services can use to access OSS. This argument is optional.
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS')
# Add the command-line argument --key, which specifies the name of the object. This argument is required.
parser.add_argument('--key', help='The name of the object.', required=True)
# Add the command-line argument --acl, which specifies the access control list (ACL) of the object. This argument is required.
parser.add_argument('--acl', help='Specify the access permission ACL for the object.', required=True)
# Add the command-line argument --version_id, which specifies the version ID of the object. This argument is required.
parser.add_argument('--version_id', help='The version ID of the object.', required=True)

def main():
    # Parse the command-line arguments to obtain the user-input values.
    args = parser.parse_args()

    # Load the authentication information required to access OSS from environment variables for identity verification.
    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    # Use the default configurations of the SDK to create a configuration object and set the credential provider.
    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider

    # Set the region property of the configuration object based on the command-line arguments.
    cfg.region = args.region

    # If a custom endpoint is provided, update the endpoint property of the configuration object.
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    # Use the preceding configurations to initialize the OSS client and prepare for interaction with OSS.
    client = oss.Client(cfg)

    # Send a request to set the ACL of the object.
    result = client.put_object_acl(oss.PutObjectAclRequest(
        bucket=args.bucket,           # Specify the bucket name.
        key=args.key,                 # Specify the object name.
        acl=args.acl,                 # The new ACL value.
        version_id=args.version_id,   # Specify the object version ID.
    ))

    # Print the output information after setting the ACL, including the status code, request ID, and version ID.
    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' version id: {result.version_id},'
          )

    # Obtain and print the current ACL settings of the object.
    result = client.get_object_acl(oss.GetObjectAclRequest(
        bucket=args.bucket,
        key=args.key,
        version_id=args.version_id
    ))

    # Print the retrieved object ACL settings, including the status code, request ID, ACL, and version ID.
    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' acl: {result.acl},'
          f' version id: {result.version_id},'
          )

# When this script is run directly, call the main function to start the processing logic.
if __name__ == "__main__":
    main()  # The entry point of the script. The program flow starts here.