您可以通过 TOS SDK 提供的接口设置桶 ACL。权限设置可以通过请求头和请求体两种方式。

前提条件 #

• 配置桶 ACL 的账号必须是该桶的创建者，或拥有该桶 ACL 的写权限。
• 仅支持对主账号 ID 配置 ACL，不支持子账号。

桶 ACL 说明 #

示例代码 #

通过请求体设置 ACL 权限 #

// 导入 SDK, 当 TOS Node.JS SDK 版本小于 2.5.2 请把下方 TosClient 改成 TOS 导入
import { TosClient, TosClientError, TosServerError, GranteeType, PermissionType } from '@volcengine/tos-sdk';

// 创建客户端
const client = new TosClient({
  accessKeyId: process.env['TOS_ACCESS_KEY'],
  accessKeySecret: process.env['TOS_SECRET_KEY'],
  region: "Provide your region", // 填写 Bucket 所在地域。以华北2（北京)为例，则 "Provide your region" 填写为 cn-beijing。
  endpoint: "Provide your endpoint", // 填写域名地址
});

function handleError(error) {
  if (error instanceof TosClientError) {
    console.log('Client Err Msg:', error.message);
    console.log('Client Err Stack:', error.stack);
  } else if (error instanceof TosServerError) {
    console.log('Request ID:', error.requestId);
    console.log('Response Status Code:', error.statusCode);
    console.log('Response Header:', error.headers);
    console.log('Response Err Code:', error.code);
    console.log('Response Err Msg:', error.message);
  } else {
    console.log('unexpected exception, message: ', error);
  }
}

const bucketName = 'node-sdk-test-bucket';
async function main() {
  try {
    const { requestId: putAclRequestId } = await client.putBucketAcl({
      bucket: bucketName,
      aclBody: {
        Owner: {
          // 获取 Bucket Owner ID
          ID: 'ownerid',
        },
        Grants: [
          {
            Grantee: {
              ID: 'userId',
              Type: GranteeType.GranteeUser,
            },
            Permission: PermissionType.PermissionWrite,
          },
        ],
      },
    });
    console.log('putBucketAcl Request ID: ', putAclRequestId);

    const { data, requestId: getAclRequestId } = await client.getBucketAcl(bucketName);
    console.log('getBucketAcl Request ID: ', getAclRequestId);
    console.log('getBucketAcl Owner:', data.Owner);
    for (const grant of data.Grants) {
      // 授予者所拥有的 Bucket 权限
      console.log('Grant Permission:', grant.Permission);
      // 当 Type 为 CanonicalUser 时，表示权限授予者的 ID
      console.log('Grant Grantee ID', grant.Grantee.ID);
      // 权限被授予者的名称
      console.log('Grant Grantee DisplayName', grant.Grantee.DisplayName);
      // 被授权的用户组
      console.log('Grant Grantee Canned', grant.Grantee.Canned);
      // 权限授予者的类型
      console.log('Grant Grantee Type', grant.Grantee.Type);
    }
  } catch (error) {
    handleError(error);
  }
}

main();

通过请求头设置权限 #

// 导入 SDK, 当 TOS Node.JS SDK 版本小于 2.5.2 请把下方 TosClient 改成 TOS 导入
import { TosClient, TosClientError, TosServerError, ACLType } from '@volcengine/tos-sdk';

// 创建客户端
const client = new TosClient({
  accessKeyId: process.env['TOS_ACCESS_KEY'],
  accessKeySecret: process.env['TOS_SECRET_KEY'],
  region: "Provide your region", // 填写 Bucket 所在地域。以华北2（北京)为例，则 "Provide your region" 填写为 cn-beijing。
  endpoint: "Provide your endpoint", // 填写域名地址
});

function handleError(error) {
  if (error instanceof TosClientError) {
    console.log('Client Err Msg:', error.message);
    console.log('Client Err Stack:', error.stack);
  } else if (error instanceof TosServerError) {
    console.log('Request ID:', error.requestId);
    console.log('Response Status Code:', error.statusCode);
    console.log('Response Header:', error.headers);
    console.log('Response Err Code:', error.code);
    console.log('Response Err Msg:', error.message);
  } else {
    console.log('unexpected exception, message: ', error);
  }
}

const bucketName = 'node-sdk-test-bucket';
async function main() {
  try {
    const { requestId: putAclRequestId } = await client.putBucketAcl({
      bucket: bucketName,
      acl: ACLType.ACLPrivate,
    });
    console.log('putBucketAcl Request ID: ', putAclRequestId);
  } catch (error) {
    handleError(error);
  }
}

main();

获取存储桶权限 #

// 导入 SDK, 当 TOS Node.JS SDK 版本小于 2.5.2 请把下方 TosClient 改成 TOS 导入
import { TosClient, TosClientError, TosServerError } from '@volcengine/tos-sdk';

// 创建客户端
const client = new TosClient({
  accessKeyId: process.env['TOS_ACCESS_KEY'],
  accessKeySecret: process.env['TOS_SECRET_KEY'],
  region: "Provide your region", // 填写 Bucket 所在地域。以华北2（北京)为例，则 "Provide your region" 填写为 cn-beijing。
  endpoint: "Provide your endpoint", // 填写域名地址
});

function handleError(error) {
  if (error instanceof TosClientError) {
    console.log('Client Err Msg:', error.message);
    console.log('Client Err Stack:', error.stack);
  } else if (error instanceof TosServerError) {
    console.log('Request ID:', error.requestId);
    console.log('Response Status Code:', error.statusCode);
    console.log('Response Header:', error.headers);
    console.log('Response Err Code:', error.code);
    console.log('Response Err Msg:', error.message);
  } else {
    console.log('unexpected exception, message: ', error);
  }
}

const bucketName = 'node-sdk-test-bucket';
async function main() {
  try {
    const { data, requestId: getAclRequestId } = await client.getBucketAcl(bucketName);
    console.log('getBucketAcl Request ID: ', getAclRequestId);
    console.log('getBucketAcl Owner:', data.Owner);
    for (const grant of data.Grants) {
      // 授予者所拥有的 Bucket 权限
      console.log('Grant Permission:', grant.Permission);
      // 当 Type 为 CanonicalUser 时，表示权限授予者的 ID
      console.log('Grant Grantee ID', grant.Grantee.ID);
      // 权限被授予者的名称
      console.log('Grant Grantee DisplayName', grant.Grantee.DisplayName);
      // 被授权的用户组
      console.log('Grant Grantee Canned', grant.Grantee.Canned);
      // 权限授予者的类型
      console.log('Grant Grantee Type', grant.Grantee.Type);
    }
  } catch (error) {
    handleError(error);
  }
}

main();

相关文档 #

管理桶的权限，请参见桶 ACLs。