Overview
An access control list (ACL) is one of the resource-based access policy options that manages access to buckets and objects. An ACL can be used to grant read and write permissions to other root accounts and user groups.
Unlike an access policy, an ACL has the following limits on the management permissions:
- Permissions can only be granted to accounts of the cloud platform.
- Only supports five operation groups: Read Objects, Write to Objects, Read ACLs, Write to ACLs, and All Permissions.
- Additional conditions for the ACL rules to take effect are not supported.
- Explicit deny is not supported.
Control granularities supported by an ACL:
- Bucket
- Object key prefix
- Object
Control Elements of an ACL
When a bucket or an object is created, the root account to which the resources of the bucket or object belong owns all permissions to these resources, and the permissions cannot be modified or deleted. You can use an ACL to grant other cloud platform accounts the access permissions. The following is an example ACL for a bucket.
<AccessControlPolicy>
<Owner>
<ID>qcs::cam::uin/12345:uin/12345</ID>
<DisplayName>qcs::cam::uin/12345:uin/12345</DisplayName>
</Owner>
<AccessControlList>
<Grant>
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="RootAccount">
<ID>qcs::cam::uin/12345:uin/12345</ID>
<DisplayName>qcs::cam::uin/12345:uin/12345</DisplayName>
</Grantee>
<Permission>FULL_CONTROL</Permission>
</Grant>
<Grant>
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="RootAccount">
<ID>qcs::cam::uin/54321:uin/54321</ID>
<DisplayName>qcs::cam::anyone:anyone</DisplayName>
</Grantee>
<Permission>READ</Permission>
</Grant>
</AccessControlList>
</AccessControlPolicy>
The preceding ACL contains an Owner element that identifies the bucket owner who owns all permissions to the bucket, and the Grant element is used to grant anonymous read permission, which is expressed as READ permission of qcs::cam::anyone:anyone.
Grantees
Root Account
You can grant access permissions to other root accounts based on the definition of the principal in CAM, which is described as follows:
qcs::cam::uin/1238423:uin/1238423
Anonymous User
You can grant access permissions to anonymous users based on the definition of the principal in CAM, which is described as follows:
qcs::cam::anyone:anyone
Permission Operation Group
The following table describes the permission operation groups supported by an ACL.
| Operation Group | Bucket | Prefix | Object |
|---|---|---|---|
| READ | List and read objects in a bucket. | List and read objects in a directory. | Read the Object |
| WRITE | Create, overwrite, or delete any object in a bucket. | Create, overwrite, or delete any object in the directory. | Overwrite and Delete the Object |
| READ_ACP | Read the ACL of a bucket. | Read the ACL of a directory. | Read an object's ACL. |
| WRITE_ACP | Modify the ACL of a bucket. | Modify the ACL under a directory. | Modify the ACL of an object. |
| FULL_CONTROL | Any operation on buckets and objects. | Perform any operation on the object in the directory. | Perform any operation on the object. |
Standard ACL Description
COS supports a series of predefined authorizations, which are called standard ACLs. The following table describes the authorization meanings of standard ACLs.
Note:
A root account always has the FULL_CONTROL permission, which is not described in the following table.
| Standard ACL | Description |
|---|---|
| (Null) | This is the default policy. Others do not have permissions. The permissions for resources are inherited from the upper level. |
| private | Others do not have permissions. |
| public-read | The anonymous user group has the READ permission. |
| public-read-write | The anonymous user group has the READ and WRITE permissions, which are generally not recommended for buckets. |
ACL Examples
Setting an ACL for a Bucket
The following example grants another root account the read permission to a bucket.
Setting an ACL for an Object
The following example grants another root account the read permission to an object.