Manage bucket ACLs with Swift-Object Storage Service(OSS)-阿里云帮助中心

Use the Swift SDK to set and get bucket access control lists (ACLs) to control who can access your bucket and what actions they can perform.

ACL types

OSS supports three bucket ACL settings:

ACL	Description
`private`	Only the bucket owner has read and write access. All other users are denied access. This is the default setting.
`public-read`	The bucket owner has full control. Anonymous users can read objects in the bucket.
`public-read-write`	The bucket owner has full control. Anonymous users can read and write objects in the bucket. Use this setting only when public write access is required, as it increases security exposure.

Prerequisites

Before you begin, ensure that you have:

The oss:PutBucketAcl permission to set a bucket ACL
The oss:GetBucketAcl permission to get a bucket ACL

For instructions on granting these permissions, see Grant custom permissions to a RAM user.

Usage notes

The sample code uses the China (Hangzhou) region (cn-hangzhou) and a public endpoint by default. To access OSS from other Alibaba Cloud services in the same region, use an internal endpoint. For a full list of regions and endpoints, see Regions and endpoints.
Credentials are read from the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables. Set these variables before running the sample code.

Set a bucket ACL

The following example sets the ACL of a bucket to public-read using the PutBucketAcl API operation.

import AlibabaCloudOSS
import Foundation

@main
struct Main {
    static func main() async {

        do {

            // Specify the region where the bucket is located. Example: cn-hangzhou for China (Hangzhou).
            let region = "cn-hangzhou"
            // Specify the bucket name.
            let bucket = "yourBucketName"
            // Optional. Specify the endpoint. For China (Hangzhou), use https://oss-cn-hangzhou.aliyuncs.com.
            let endpoint: String? = nil
            // The ACL to set. Supported values: private, public-read, public-read-write.
            let acl = "public-read"

            // Obtain access credentials from environment variables. Before you run the sample code,
            // set the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables.
            let credentialsProvider = EnvironmentCredentialsProvider()

            // Configure the OSS client.
            let config = Configuration.default()
                .withRegion(region)
                .withCredentialsProvider(credentialsProvider)

            // Set the endpoint.
            if let endpoint = endpoint {
                config.withEndpoint(endpoint)
            }

            // Create an OSS client instance.
            let client = Client(config)

            // Set the bucket ACL.
            let result = try await client.putBucketAcl(
                PutBucketAclRequest(
                    bucket: bucket,
                    acl: acl
                )
            )

            print("result:\n\(result)")

        } catch {
            print("error: \(error)")
        }
    }
}

For the complete sample code, see GitHub sample.

Get a bucket ACL

The following example retrieves the ACL of a bucket using the GetBucketAcl API operation.

import AlibabaCloudOSS
import Foundation

@main
struct Main {
    static func main() async {
        do {
            // Specify the region where the bucket is located. Example: cn-hangzhou for China (Hangzhou).
            let region = "cn-hangzhou"
            // Specify the bucket name.
            let bucket = "yourBucketName"
            // Optional. Specify the endpoint. For China (Hangzhou), use https://oss-cn-hangzhou.aliyuncs.com.
            let endpoint: String? = nil

            // Obtain access credentials from environment variables. Before you run the sample code,
            // set the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables.
            let credentialsProvider = EnvironmentCredentialsProvider()

            // Configure the OSS client.
            let config = Configuration.default()
                .withRegion(region)
                .withCredentialsProvider(credentialsProvider)

            // Set the endpoint.
            if let endpoint = endpoint {
                config.withEndpoint(endpoint)
            }

            // Create an OSS client instance.
            let client = Client(config)

            // Get the bucket ACL.
            let result = try await client.getBucketAcl(
                GetBucketAclRequest(
                    bucket: bucket
                )
            )

            print("result:\n\(result)")
        } catch {
            print("error: \(error)")
        }
    }
}

For the complete sample code, see GitHub sample.

References

For more information about the PutBucketAcl API operation, see PutBucketAcl.
For more information about the GetBucketAcl API operation, see GetBucketAcl.