How to manage file access permissions (PHP SDK V1) - Object Storage Service

This topic describes how to manage file access permissions.

Prerequisites

In this topic, the public endpoint of the China (Hangzhou) region is used. To access OSS from other Alibaba Cloud services in the same region, use an internal endpoint. For details about supported regions and endpoints, see Regions and endpoints.
In this topic, an OSSClient instance is created by using an OSS endpoint. If you want to create an OSSClient instance by using custom domain names or Security Token Service (STS), see Create an OSSClient instance.
To set file access permissions, you must have the oss:PutObjectAcl permission. To retrieve file access permissions, you must have the oss:GetObjectAcl permission. For more information, see Grant custom access policies to a RAM user.

Types of access control lists

Files have four types of access control lists (ACLs):

Access permissions	Description	Access permission value
Inherit from Bucket	The file inherits the access permissions of the bucket.	default
Private	The file owner and authorized users have read and write permissions for the file. Other users cannot access the file.	private
Public-read	The file owner and authorized users have read and write permissions for the file. Other users have only read permissions. Use this permission with caution.	public-read
Public-read-write	All users have read and write permissions for the file. Use this permission with caution.	public-read-write

File ACLs have a higher priority than bucket ACLs. For example, if a bucket is private but a file in the bucket is set to public-read-write, all users have read and write permissions on that file. If a file does not have an ACL configured, the file inherits the ACL of its bucket.

Set file access permissions

The following sample code provides an example on how to configure the ACL of an object:

<?php
if (is_file(__DIR__ . '/../autoload.php')) {
    require_once __DIR__ . '/../autoload.php';
}
if (is_file(__DIR__ . '/../vendor/autoload.php')) {
    require_once __DIR__ . '/../vendor/autoload.php';
}
use OSS\Credentials\EnvironmentVariableCredentialsProvider;
use OSS\OssClient;
use OSS\Core\OssException;

// Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
$provider = new EnvironmentVariableCredentialsProvider();
// The Endpoint is set to China (Hangzhou) in this example. Specify the actual Endpoint.
$endpoint = "http://oss-cn-hangzhou.aliyuncs.com";
$bucket= "yourBucketName";
$object = "yourObjectName";
// Set the file ACL to public-read. The default is to inherit the bucket's ACL.
$acl = "public-read";
try {
    $config = array(
        "provider" => $provider,
        "endpoint" => $endpoint,
        "signatureVersion" => OssClient::OSS_SIGNATURE_VERSION_V4,
        "region"=> "cn-hangzhou"
    );
    $ossClient = new OssClient($config);

    $ossClient->putObjectAcl($bucket, $object, $acl);
} catch (OssException $e) {
    printf(__FUNCTION__ . ": FAILED\n");
    printf($e->getMessage() . "\n");
    return;
}
print(__FUNCTION__ . ": OK" . "\n");

Get file access permissions

The following sample code provides an example on how to query the ACL of an object:

<?php
if (is_file(__DIR__ . '/../autoload.php')) {
    require_once __DIR__ . '/../autoload.php';
}
if (is_file(__DIR__ . '/../vendor/autoload.php')) {
    require_once __DIR__ . '/../vendor/autoload.php';
}
use OSS\Credentials\EnvironmentVariableCredentialsProvider;
use OSS\OssClient;
use OSS\Core\OssException;

// Obtain access credentials from environment variables. Before you run the sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are configured. 
$provider = new EnvironmentVariableCredentialsProvider();
// The Endpoint is set to China (Hangzhou) in this example. Specify the actual Endpoint.
$endpoint = "http://oss-cn-hangzhou.aliyuncs.com";
$bucket= "yourBucketName";
$object = "yourObjectName";
try {
    $config = array(
        "provider" => $provider,
        "endpoint" => $endpoint,
        "signatureVersion" => OssClient::OSS_SIGNATURE_VERSION_V4,
        "region"=> "cn-hangzhou"
    );
    $ossClient = new OssClient($config);

    $objectAcl = $ossClient->getObjectAcl($bucket, $object);
} catch (OssException $e) {
    printf(__FUNCTION__ . ": FAILED\n");
    printf($e->getMessage() . "\n");
    return;
}
print(__FUNCTION__ . ": OK" . "\n");
var_dump($objectAcl);