Manage object access permissions (C# SDK V2)

Prerequisites

Before you begin, ensure that you have:

• The oss:PutObjectAcl permission to set an object's ACL

• The oss:GetObjectAcl permission to get an object's ACL

For details on granting these permissions to a RAM user, see Grant custom permissions to a RAM user.

ACL types

An object supports four ACL values:

ACL precedence: Object ACL takes precedence over bucket ACL. If no ACL is set on an object, the object inherits the bucket ACL.

Usage notes

• By default, PutObjectAcl sets the ACL of the current version of an object. If the current version is a delete marker, OSS returns 404 Not Found. Pass a versionId to target a specific version.

• By default, GetObjectAcl returns the ACL of the current version of an object. If the current version is a delete marker, OSS returns 404 Not Found. Pass a versionId to target a specific version.

• The sample code uses the public endpoint of the China (Hangzhou) region (cn-hangzhou). To access OSS from other Alibaba Cloud services in the same region, use an internal endpoint. For endpoint mappings, see Regions and endpoints.

Set an object's ACL

The following example sets the ACL of a specific object version using PutObjectAclAsync.

using OSS = AlibabaCloud.OSS.V2;

var region = "cn-hangzhou";         // The region where the bucket is located.
var endpoint = null as string;      // Optional. Overrides the default endpoint if specified.
var bucket = "<your-bucket-name>";  // The name of the bucket.
var key = "<your-object-key>";      // The key (name) of the object.
var acl = "<acl-value>";            // ACL to apply: default, private, public-read, or public-read-write.
var versionId = "<version-id>";     // The version ID of the object. Omit to target the current version.

// Load default SDK configuration. Credentials are read from environment variables
// (OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET).
var cfg = OSS.Configuration.LoadDefault();
cfg.CredentialsProvider = new OSS.Credentials.EnvironmentVariableCredentialsProvider();
cfg.Region = region;

if (endpoint != null)
{
    cfg.Endpoint = endpoint;
}

using var client = new OSS.Client(cfg);

// Set the ACL of the specified object version.
var result = await client.PutObjectAclAsync(new OSS.Models.PutObjectAclRequest()
{
    Bucket = bucket,
    Key = key,
    Acl = acl,
    VersionId = versionId,
});

Replace the following placeholders with actual values:

Get an object's ACL

The following example retrieves the ACL of a specific object version using GetObjectAclAsync.

using OSS = AlibabaCloud.OSS.V2;

var region = "cn-hangzhou";
var endpoint = null as string;
var bucket = "<your-bucket-name>";
var key = "<your-object-key>";
var versionId = "<version-id>";

var cfg = OSS.Configuration.LoadDefault();
cfg.CredentialsProvider = new OSS.Credentials.EnvironmentVariableCredentialsProvider();
cfg.Region = region;

if (endpoint != null)
{
    cfg.Endpoint = endpoint;
}

using var client = new OSS.Client(cfg);

// Get the ACL of the specified object version.
var result = await client.GetObjectAclAsync(new OSS.Models.GetObjectAclRequest()
{
    Bucket = bucket,
    Key = key,
    VersionId = versionId,
});

// Print the result.
Console.WriteLine($"StatusCode: {result.StatusCode}");
Console.WriteLine($"RequestId: {result.RequestId}");
Console.WriteLine("Response headers:");
result.Headers.ToList().ForEach(x => Console.WriteLine($"  {x.Key}: {x.Value}"));
Console.WriteLine($"Acl: {result.Acl}");

The response includes: