Manage object ACLs (PHP SDK V2)

Prerequisites

Before you begin, make sure that you have:

• The oss:PutObjectAcl permission to set an object ACL

• The oss:GetObjectAcl permission to get an object ACL

For instructions on granting these permissions to a RAM user, see Attach a custom policy to a RAM user.

ACL types

OSS supports four ACL values for objects:

An object ACL takes precedence over the bucket ACL. For example, an object set to public-read in a private bucket is readable by all users, including anonymous users. If an object has no ACL configured, it inherits the bucket ACL.

Versioning behavior

By default, PutObjectAcl and GetObjectAcl operate on the current version of an object.

• If the current version is a delete marker, OSS returns 404 Not Found.

• To target a specific version, pass the versionId parameter in the request.

Set an object ACL

The following example sets the ACL of a specific object version to public-read using PutObjectAclRequest. Pass a versionId to target a specific version; omit it to target the current version.

<?php

require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Specify command line parameters.
$optsdesc = [
    "region"   => ['help' => 'The region where the bucket is located.', 'required' => True],
    "endpoint" => ['help' => 'The endpoint for accessing OSS.', 'required' => False],
    "bucket"   => ['help' => 'The bucket name.', 'required' => True],
    "key"      => ['help' => 'The object name.', 'required' => True],
];

$longopts = \array_map(function ($key) {
    return "$key:";
}, array_keys($optsdesc));

$options = getopt("", $longopts);

foreach ($optsdesc as $key => $value) {
    if ($value['required'] === True && empty($options[$key])) {
        $help = $value['help'];
        echo "Error: the following arguments are required: --$key, $help" . PHP_EOL;
        exit(1);
    }
}

$region = $options["region"];
$bucket = $options["bucket"];
$key    = $options["key"];

// Obtain access credentials from environment variables.
// Obtain the AccessKey ID and AccessKey secret from the EnvironmentVariableCredentialsProvider environment variable.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider($credentialsProvider);
$cfg->setRegion($region);
if (isset($options["endpoint"])) {
    $cfg->setEndpoint($options["endpoint"]);
}

$client = new Oss\Client($cfg);

// Set the ACL of a specific object version.
// Replace yourVersionId with the actual version ID.
// Omit versionId to set the ACL of the current version.
$request = new Oss\Models\PutObjectAclRequest(
    bucket:    $bucket,
    key:       $key,
    acl:       Oss\Models\ObjectACLType::PUBLIC_READ,
    versionId: "yourVersionId",
);

$result = $client->putObjectAcl($request);

printf(
    'status code: %s' . PHP_EOL .  // 200 indicates success.
    'request ID: %s' . PHP_EOL,    // Use the request ID for debugging.
    $result->statusCode,
    $result->requestId
);

Replace the following placeholders:

Get an object ACL

The following example retrieves the ACL of a specific object version using GetObjectAclRequest. Pass a versionId to query a specific version; omit it to query the current version.

<?php

require_once __DIR__ . '/../vendor/autoload.php';

use AlibabaCloud\Oss\V2 as Oss;

// Specify command line parameters.
$optsdesc = [
    "region"   => ['help' => 'The region where the bucket is located.', 'required' => True],
    "endpoint" => ['help' => 'The endpoint for accessing OSS.', 'required' => False],
    "bucket"   => ['help' => 'The bucket name.', 'required' => True],
    "key"      => ['help' => 'The object name.', 'required' => True],
];

$longopts = \array_map(function ($key) {
    return "$key:";
}, array_keys($optsdesc));

$options = getopt("", $longopts);

foreach ($optsdesc as $key => $value) {
    if ($value['required'] === True && empty($options[$key])) {
        $help = $value['help'];
        echo "Error: the following arguments are required: --$key, $help" . PHP_EOL;
        exit(1);
    }
}

$region = $options["region"];
$bucket = $options["bucket"];
$key    = $options["key"];

// Obtain access credentials from environment variables.
// Obtain the AccessKey ID and AccessKey secret from the EnvironmentVariableCredentialsProvider environment variable.
$credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider();

$cfg = Oss\Config::loadDefault();
$cfg->setCredentialsProvider($credentialsProvider);
$cfg->setRegion($region);
if (isset($options["endpoint"])) {
    $cfg->setEndpoint($options["endpoint"]);
}

$client = new Oss\Client($cfg);

// Get the ACL of a specific object version.
// Replace yourVersionId with the actual version ID.
// Omit versionId to get the ACL of the current version.
$request = new Oss\Models\GetObjectAclRequest(
    bucket:    $bucket,
    key:       $key,
    versionId: "yourVersionId",
);

$result = $client->getObjectAcl($request);

printf(
    'status code: %s' . PHP_EOL .  // 200 indicates success.
    'request ID: %s' . PHP_EOL .   // Use the request ID for debugging.
    'ACL: %s' . PHP_EOL,           // The ACL of the object, such as private and public-read.
    $result->statusCode,
    $result->requestId,
    $result->accessControlList->grant
);

Replace the following placeholders:

Usage notes

• The sample code uses region ID cn-hangzhou. To access OSS from another Alibaba Cloud service in the same region, use an internal endpoint instead of the default public endpoint. For more information, see Regions and endpoints.

• Credentials are loaded from environment variables using EnvironmentVariableCredentialsProvider. For more information, see Attach a custom policy to a RAM user.