Object Storage Service:Access tracking

Usage notes

• In this topic, the public endpoint of the China (Hangzhou) region is used. If you want to access OSS from other Alibaba Cloud services in the same region as OSS, use an internal endpoint. For more information about OSS regions and endpoints, see Regions, endpoints and open ports.

• In this topic, access credentials are obtained from environment variables. For more information about how to configure access credentials, see Configure access credentials.

• In this topic, an OSSClient instance is created by using an OSS endpoint. If you want to create an OSSClient instance by using custom domain names or Security Token Service (STS), see Initialization.

• By default, an Alibaba Cloud account has the permissions to configure access tracking. If you want to use a RAM user or access credentials provided by Security Token Service (STS) to configure access tracking, make sure that you have the required permissions. For example:

  • To enable access tracking, you must have the oss:PutBucketAccessMonitor permission.

  • To query the access tracking status, you must have the oss:GetBucketAccessMonitor permission.

  For more information, see Attach a custom policy to a RAM user.

Enable access tracking

The following sample code provides an example on how to enable access tracking for a bucket named examplebucket:

# -*- coding: utf-8 -*-
import oss2
from oss2.credentials import EnvironmentVariableCredentialsProvider

# Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
auth = oss2.ProviderAuthV4(EnvironmentVariableCredentialsProvider())

# Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. 
endpoint = "https://oss-cn-hangzhou.aliyuncs.com"
# Specify the ID of the region that maps to the endpoint. Example: cn-hangzhou. This parameter is required if you use the signature algorithm V4.
region = "cn-hangzhou"

# Specify the name of the bucket.
bucket = oss2.Bucket(auth, endpoint, "examplebucket", region=region)

# Enable access tracking for the bucket. If you want to change the access tracking status of a bucket to Disabled after you enable access tracking for the bucket, make sure that the bucket does not have lifecycle rules that are configured based on the last access time. 
bucket.put_bucket_access_monitor("Enabled")

Query the access tracking status

The following code provides an example on how to query the access tracking status of a bucket named examplebucket:

# -*- coding: utf-8 -*-
import oss2
from oss2.credentials import EnvironmentVariableCredentialsProvider

# Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
auth = oss2.ProviderAuthV4(EnvironmentVariableCredentialsProvider())

# Specify the endpoint of the region in which the bucket is located. For example, if the bucket is located in the China (Hangzhou) region, set the endpoint to https://oss-cn-hangzhou.aliyuncs.com. 
endpoint = "https://oss-cn-hangzhou.aliyuncs.com"
# Specify the ID of the region that maps to the endpoint. Example: cn-hangzhou. This parameter is required if you use the signature algorithm V4.
region = "cn-hangzhou"

# Specify the name of the bucket.
bucket = oss2.Bucket(auth, endpoint, "examplebucket", region=region)

# Query the access tracking status of the bucket. 
result = bucket.get_bucket_access_monitor()

# Display the access tracking status of the bucket. 
print(result.access_monitor.status)

References

• For more information about lifecycle rules based on last access time, see Lifecycle rules based on the last access time.

• For more information about the API operation that you can call to enable access tracking, see PutBucketAccessMonitor.

• For more information about the API operation that you can call to query the access tracking status, see GetBucketAccessMonitor.