ACL - IDrive Cloud Developer Guide

Home > S3 Developer Guide > Operations > ACL

ACL

jQuery(document).attr(“title”, “Welcome to Sterling Kilgore | Results Beyond Words”);

The sample code in this section shows how to set ACL on a bucket my-bucket to manage access of that resource. The following is an example for IDrive Cloud’s Oregon (us-west-1) region.

IDrive Cloud allows users to set ACL on a bucket to manage access of that resource.

Whenever a resource is created using S3 APIs, by default, the creator of that resource becomes the owner of it and only the creator has access to this resource. The owner of the resource needs to set ACL to make it accessible to other users.

In IDrive Cloud every account has its own namespace for buckets unlike AWS where all accounts share a common namespace. This means, two different accounts can have the same bucket name e.g. account bob can have a bucket called images and another account alice too can have a bucket with the same name as images.

Due to this, ACLs in IDrive Cloud have a few differences compared to AWS:

In AWS a 12 digit Account ID is used to identify the Owner and Grantee of a resource, whereas in IDrive Cloud it is a combination of <account name>:<username>. Account name in IDrive Cloud is the same as root username.
Unlike AWS, a bucket created by one user in an account is not accessible, by default, by all other users. If this is desired, the bucket must be created via the IDrive Cloud console.
For accessing buckets/objects in the same account in IDrive Cloud, only the Access Key and Secret is sufficient. However, for accessing buckets/objects from a separate account, the Access Key ID must be appended by a semicolon (:) followed by the Account ID of the bucket owner.

In the sections below, we explain some of the scenarios for applying ACLs on the resources in IDrive Cloud.

Granting access to resources with in the same account

Bob has an account with IDrive Cloud with the username bob and Alice has a sub-account with username as alice. Bob needs to share a bucket named as images with Alice. Bob should use the following command to share the resource with Alice.


aws --profile bob s3api put-bucket-acl --bucket images --access-control-policy '{
   "Grants": [
      {
         "Grantee": {
            "ID": "bob:alice",
            "Type": "CanonicalUser"
         },
         "Permission": "FULL_CONTROL"
      }
   ],
   "Owner": {
      "ID": "bob:bob"
   }
}'

Executing the above commands will give Alice full control for the bucket images.

Note: Grantee ID is a combination of <account name> : <username>. In this case the account name is bob as Bob is the root user of this account and alice is the username of sub-account named Alice. Hence the Grantee ID is bob:alice.

Granting access to resources to a different account

Bob has an account with IDrive Cloud with the username bob and Alice is another account holder with username alice. Bob needs to share a bucket named images with Alice. Bob should use the following command to share the resource with Alice.


aws --profile bob s3api put-bucket-acl --bucket images --access-control-policy '{
   "Grants": [
      {
         "Grantee": {
            "ID": "alice:alice",
            "Type": "CanonicalUser"
         },
         "Permission": "FULL_CONTROL"
      }
   ],
   "Owner": {
      "ID": "bob:bob"
   }
}'

Executing the above commands will give Alice full control for the bucket images.

Note: Grantee ID is a combination of <account name> : <username>. Here the account name and username both are alice as Alice is a root user of account.

Alice needs to know Bob’s Account ID to access this resource and the same needs to be appended with the access key in the configuration as shown below.


aws_access_key_id = <ACCESS KEY>:<BOB’s ACCOUNT ID>

If Alice tries to access the bucket images without appending Bob’s account id, an error will be shown as below:


aws --profile alice s3api list-objects --bucket images

Error Message:


An error occurred (NoSuchBucket) when calling the ListObjectsV2 operation: The specified bucket does not exist.

Granting public access of a resource

Bob has an account with IDrive Cloud with username as bob and he wants to make the bucket images publicly available. Bob should use the following command to share the resource publicly.


aws --profile bob s3api put-bucket-acl --bucket images --acl public-read

Executing the above commands will make the bucket images available to all users.

Before accessing this resource user needs to know Bob’s account id and the same needs to be appended to the access key in the configuration as shown below.


aws_access_key_id = :

If another account user called Alice tries to access the bucket images without appending Bob’s Account ID, an error will be shown as below:


aws --profile alice s3api list-objects --bucket images

Error Message:


An error occurred (NoSuchBucket) when calling the ListObjectsV2 operation: The specified bucket does not exist.

Set ACL on a bucket using below commands and manage access of that resource.


#!/bin/python
import boto3

# Create an S3 client for IDrive Cloud
endpoint = "https://s3.us-west-1.idrivecloud.io"
client = boto3.client("s3", endpoint_url=endpoint)

# get bucket acl for bucket 'my-bucket'
response = client.get_bucket_acl(Bucket="my-bucket")
print(response)

# Granting access to resources with in the same account
response = client.put_bucket_acl(
    Bucket="my-bucket",
    AccessControlPolicy={
        "Grants": [
            {
                "Grantee": {"ID": "bob:alice", "Type": "CanonicalUser"},
                "Permission": "FULL_CONTROL",
            },
        ],
        "Owner": {"ID": "bob:bob"},
    },
)
print(response)

# Granting access to resources to a different account
response = client.put_bucket_acl(
    Bucket="my-bucket",
    AccessControlPolicy={
        "Grants": [
            {
                "Grantee": {"ID": "alice:alice", "Type": "CanonicalUser"},
                "Permission": "FULL_CONTROL",
            },
        ],
        "Owner": {"ID": "bob:bob"},
    },
)
print(response)

# Granting public access of a resource to all accounts
response = client.put_bucket_acl(Bucket="my-bucket", ACL="public-read")
print(response)

# Granting private access of a resource to owner only
response = client.put_bucket_acl(Bucket="my-bucket", ACL="private")
print(response)

Set ACL on a bucket using below commands and manage access of that resource.


const AWS = require('aws-sdk');

// Create an S3 client for IDrive Cloud
const endpoint = new AWS.Endpoint("s3.us-west-1.idrivecloud.io");
const s3 = new AWS.S3({
	endpoint: endpoint
});

// bucket params
var params = {
	Bucket: "my-bucket",
};

// get bucket acl for bucket with above params
s3.getBucketAcl(params, function(err, data) {
	if (err) {
		console.log("Error:", err);
	} else if (data) {
		console.log("Success:", data.Grants);
	}
});

// Granting access to resources with in the same account
var params = {
	Bucket: "my-bucket",
	AccessControlPolicy: {
		Grants: [{
			Grantee: {
				ID: "bob:alice",
				Type: "CanonicalUser"
			},
			Permission: "FULL_CONTROL"
		}, ],
		Owner: {
			ID: "bob:bob"
		}
	},
};

s3.putBucketAcl(params, function(err, data) {
	if (err) {
		console.log("Error:", err);
	} else {
		console.log("Success:", data);
	}
});

// Granting access to resources to a different account
var params = {
	Bucket: "my-bucket",
	AccessControlPolicy: {
		Grants: [{
			Grantee: {
				ID: "alice:alice",
				Type: "CanonicalUser"
			},
			Permission: "FULL_CONTROL"
		}, ],
		Owner: {
			ID: "bob:bob"
		}
	},
};

s3.putBucketAcl(params, function(err, data) {
	if (err) {
		console.log("Error:", err);
	} else {
		console.log("Success:", data);
	}
});

// Granting public access of a resource to all accounts
var params = {
	Bucket: "my-bucket",
	ACL: "public-read"
};

s3.putBucketAcl(params, function(err, data) {
	if (err) {
		console.log("Error:", err);
	} else {
		console.log("Success:", data);
	}
});

// Granting private access of a resource to owner only
var params = {
	Bucket: "my-bucket",
	ACL: "private"
};

s3.putBucketAcl(params, function(err, data) {
	if (err) {
		console.log("Error:", err);
	} else {
		console.log("Success:", data);
	}
});

Set ACL on a bucket using below commands and manage access of that resource. The following is an example using the Composer installation method. For other methods, change the "require" statement in the code below as per PHP usage instructions.


<?php

require "vendor/autoload.php";

use Aws\S3\S3Client;
use Aws\Exception\AwsException;

// Create an S3 client for IDrive Cloud
$profile_credentials = [
    "profile" => "default",
    "endpoint" => "https://s3.us-west-1.idrivecloud.io",
    "region" => "us-east-1",
    "version" => "latest",
    "use_path_style_endpoint" => true,
];
$s3 = S3Client::factory($profile_credentials);

$bucket = "my-bucket";

// get bucket acl for bucket
try {
    $result = $s3->getBucketAcl([
        "Bucket" => $bucket,
    ]);
    echo "Success: ";
    var_dump($result);
} catch (AwsException $e) {
    echo "Error: {$e->getMessage()}" . PHP_EOL;
}

// Granting access to resources with in the same account
$params = [
    "Bucket" => $bucket,
    "AccessControlPolicy" => [
        "Grants" => [
            [
                "Grantee" => [
                    "ID" => "bob:alice",
                    "Type" => "CanonicalUser",
                ],
                "Permission" => "FULL_CONTROL",
            ],
        ],
        "Owner" => [
            "ID" => "bob:bob",
        ],
    ],
];

try {
    $result = $s3->putBucketAcl($params);
    echo "Success: ";
    var_dump($result["@metadata"]);
} catch (AwsException $e) {
    echo "Error: {$e->getMessage()}" . PHP_EOL;
}

// Granting access to resources to a different account
$params = [
    "Bucket" => $bucket,
    "AccessControlPolicy" => [
        "Grants" => [
            [
                "Grantee" => [
                    "ID" => "alice:alice",
                    "Type" => "CanonicalUser",
                ],
                "Permission" => "FULL_CONTROL",
            ],
        ],
        "Owner" => [
            "ID" => "bob:bob",
        ],
    ],
];

try {
    $result = $s3->putBucketAcl($params);
    echo "Success: ";
    var_dump($result["@metadata"]);
} catch (AwsException $e) {
    echo "Error: {$e->getMessage()}" . PHP_EOL;
}

// Granting public access of a resource to all accounts
$params = [
    "Bucket" => $bucket,
    "ACL" => "public-read",
];

try {
    $result = $s3->putBucketAcl($params);
    echo "Success: ";
    var_dump($result["@metadata"]);
} catch (AwsException $e) {
    echo "Error: {$e->getMessage()}" . PHP_EOL;
}

// Granting private access of a resource to owner only
$params = [
    "Bucket" => $bucket,
    "ACL" => "private",
];

try {
    $result = $s3->putBucketAcl($params);
    echo "Success: ";
    var_dump($result["@metadata"]);
} catch (AwsException $e) {
    echo "Error: {$e->getMessage()}" . PHP_EOL;
}

Set ACL on a bucket using below commands and manage access of that resource.


require 'aws-sdk-s3'

# Create an S3 client for IDrive Cloud
endpoint = 'https://s3.us-west-1.idrivecloud.io'
client = Aws::S3::Client.new(region: 'us-east-1', endpoint: endpoint)

# get bucket acl for bucket 'my-bucket'
begin
  puts "Success: #{client.get_bucket_acl(bucket: 'my-bucket')}"
rescue StandardError => ex
  puts "Error: #{ex}"
end

# Granting access to resources with in the same account
begin
  response = client.put_bucket_acl(
    bucket: 'my-bucket',
    access_control_policy: {
      grants: [
        {
          grantee: {
            id: 'bob:alice',
            type: 'CanonicalUser'

          },
          permission: 'FULL_CONTROL'
        }
      ],
      owner: {
        id: 'bob:bob'
      }
    }
  )
  puts "Success: #{response}"
rescue StandardError => ex
  puts "Error: #{ex}"
end

# Granting access to resources to a different account
begin
  response = client.put_bucket_acl(
    bucket: 'my-bucket',
    access_control_policy: {
      grants: [
        {
          grantee: {
            id: 'alice:alice',
            type: 'CanonicalUser'

          },
          permission: 'FULL_CONTROL'
        }
      ],
      owner: {
        id: 'bob:bob'
      }
    }
  )
  puts "Success: #{response}"
rescue StandardError => ex
  puts "Error: #{ex}"
end

# Granting public access of a resource to all accounts
begin
  response = client.put_bucket_acl(
    bucket: 'my-bucket',
    acl: 'public-read'
  )
  puts "Success: #{response}"
rescue StandardError => ex
  puts "Error: #{ex}"
end

# Granting private access of a resource to owner only
begin
  response = client.put_bucket_acl(
    bucket: 'my-bucket',
    acl: 'private'
  )
  puts "Success: #{response}"
rescue StandardError => ex
  puts "Error: #{ex}"
end