sign (generate a signed URL)
By default, the access control list (ACL) of an object in an Object Storage Service (OSS) bucket is private. Only the object owner has permission to access the object. However, the object owner can run the sign command to generate and share a signed URL of the object with third-party users. A signed URL is generated using access credentials and authorizes third-party users to download or preview the object for a specified period.
-
Other users can access an object using its signed URL. This access is granted regardless of whether the object's ACL is public-read or private, or whether a bucket policy or RAM policy grants access to the user.
-
For ossutil 1.6.16 and later, you can use `ossutil` as the binary name in the command line. You do not need to update the binary name based on the operating system. For ossutil versions earlier than 1.6.16, you must specify a binary name that corresponds to the operating system. For more information, see ossutil command reference.
Command format
ossutil sign cloud_url
[--timeout <value>]
[--version-id <value>]
[--trafic-limit <value>]
[--disable-encode-slash]
[--payer <value>]
[--query-param <value>]The following table describes the parameters and options.
|
Configuration Item |
Description |
|
cloud_url |
The full path of the object in the OSS bucket. |
|
--timeout |
The expiration time of the signed URL, in seconds. Default value: 60. Important
The sum of the current UNIX timestamp and the expiration time cannot exceed 9223372036854775807. Otherwise, an overflow error occurs. For example, if the current UNIX timestamp is 1643341269, the maximum expiration time cannot exceed 9223372035211434538. |
|
--version-id |
The version ID of the object. This parameter applies only to objects in buckets where versioning is enabled or suspended. |
|
--trafic-limit |
The rate limit for HTTP access, in bit/s. The default value is 0, which indicates no limit. The value must be between 819200 and 838860800, which is equivalent to 100 KB/s to 100 MB/s. |
|
--disable-encode-slash |
Do not encode the forward slashes (/) in cloud_url. |
|
--payer |
The payment method for the request. To have the requester pay for the traffic and requests generated by accessing the resources, set this option to requester. |
|
--query-param |
The query parameters in the request. This parameter can be specified multiple times. For example, you can set this parameter for image processing. Supported parameters for --query-param include the following: x-oss-process, x-oss-traffic-limit, response-content-language, response-expires, response-cache-control, response-content-disposition, response-content-encoding, x-oss-ac-source-ip, x-oss-ac-subnet-mask, x-oss-ac-vpc-id, and x-oss-ac-forward-allow. For more information about the parameters, see Signature V1 and GetObject. Note
The --query-param parameter is supported only in ossutil 1.7.15 and later. |
Examples
-
Generate a signed URL for the object exampleobject.png in the examplebucket bucket. The default timeout period is 60 seconds.
ossutil sign oss://examplebucket/exampleobject.png -
Generate a signed URL for the object exampleobject.png in the examplebucket bucket and set the timeout period to 3600 seconds.
ossutil sign oss://examplebucket/exampleobject.png --timeout 3600 -
Generate a signed URL for the object exampleobject.png in the examplebucket bucket, set the timeout period to 7200 seconds, and limit the access speed to 100 MB/s.
ossutil sign oss://examplebucket/exampleobject.png --timeout 7200 --trafic-limit 838860800 -
Generate a signed URL for a specific version of the object exampleobject.jpg in the versioning-enabled bucket examplebucket, and set the timeout period to 1800 seconds.
ossutil sign oss://examplebucket/exampleobject.jpg --timeout 1800 --version-id CAEQARiBgID8rumR2hYiIGUyOTAyZGY2MzU5MjQ5ZjlhYzQzZjNlYTAyZDE3**** -
Generate a signed URL for a processed image. This command resizes the image object exampleobject.jpg in the examplebucket bucket to 100 × 100 pixels and rotates it 90 degrees.
ossutil sign oss://examplebucket/exampleobject.jpg --query-param x-oss-process:image/resize,m_fixed,w_100,h_100/rotate,90 -
Generate a signed URL for a processed image. This command resizes the image object exampleobject.jpg in the examplebucket bucket to 100 × 100 pixels, rotates it 90 degrees, and limits the access speed to 100 KB/s (819200 bit/s).
ossutil sign oss://examplebucket/exampleobject.jpg --query-param x-oss-process:image/resize,m_fixed,w_100,h_100/rotate,90 --query-param x-oss-traffic-limit:819200 -
If the command is successful, the output includes the time taken to generate the URL, the expiration time of the URL, and the signature. The following is a sample output:
https://examplebucket.ss-cn-hangzhou.aliyuncs.com/exampleobject.png?Expires=1608282224&OSSAccessKeyId=LTAI****************&Signature=jo4%**************************** 0.368676(s) elapsed
Common options
To access a bucket in a different region, use -e to specify the endpoint. To access a bucket owned by a different Alibaba Cloud account, use -i for the AccessKey ID and -k for the AccessKey secret.
For example, run the following command to generate a signed URL for the object exampletest.jpg and set the timeout period to 3600 seconds. The object is in the testbucket bucket, which is located in the China (Shanghai) region and belongs to another Alibaba Cloud account.
ossutil sign oss://testbucket/exampletest.jpg --timeout 3600 -e oss-cn-shanghai.aliyuncs.com -i yourAccessKeyID -k yourAccessKeySecret