Configuring a Bucket ACL
-By configuring ACL, you can authorize bucket and ACL permissions to the Owner, Anonymous User, Registered User, or Log Delivery User groups.
+You can configure a bucket ACL to grant permissions to the owner, anonymous users, registered users, or log delivery user groups.
Procedure
- Log in to OBS Browser.
- Click the blank area in the row of the bucket for which you want to set ACL permissions and click Configure Bucket ACL.
- Configure the ACL of the bucket and click Save. For details, see Figure 1.
- In the displayed dialog box, click Close to close the dialog box.
Managing Fragments
-Background Information
Data can be uploaded to OBS using multipart uploads. Fragments are generated, if a multipart upload fails because of the following reasons (included but not limited to):
+Background Information
Data can be uploaded to OBS using multipart uploads. There will be fragments generated, if a multipart upload fails because of the following causes (included but not limited to):
- The network is in poor conditions, and the connection to the OBS server is interrupted frequently.
- The upload task is manually suspended.
- The device is faulty.
- The device is powered off suddenly.
On OBS Console, storage used by fragments is charged. Clear fragments when they are not needed. If a file upload task fails, upload the file again.
Generated fragments take up storage space that is billable.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Fragments, select the fragment that you want to delete, and then click Delete on the right of the fragment.
You can also select multiple fragments and click Delete above fragment list to batch delete them.
- - Click Yes to confirm the deletion.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Fragments, select the fragment that you want to delete, and click Delete on the right.
You can also select multiple fragments and click Delete above the fragment list to batch delete them.
+ - Click Yes to confirm the deletion.
The logging function itself is offered for free, only the space occupied by log files is charged.
After logging is enabled, the log delivery user group will be automatically granted the permission to read the bucket ACL and write the bucket where logs are saved. If you manually disable such permissions, bucket logging fails.
OBS can record bucket access requests in logs for request analysis and log audit.
-Logs occupy some OBS storage space rented by users, causing extra fees. For this reason, OBS does not collect bucket access logs by default.
+Logs occupy the OBS storage that incurs costs, so OBS does not collect bucket access logs by default.
After logging is configured, you can view operation logs in the bucket that stores the logs in approximately fifteen minutes.
The following shows an example access log of the target bucket:
787f2f92b20943998a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43:42 +0000] xx.xx.xx.xx diff --git a/docs/obs/umn/en-us_topic_0045853584.html b/docs/obs/umn/en-us_topic_0045853584.html index 980bcbd8f..10bc8ec57 100644 --- a/docs/obs/umn/en-us_topic_0045853584.html +++ b/docs/obs/umn/en-us_topic_0045853584.html @@ -13,7 +13,7 @@-Parent topic: Permission Control+Parent topic: Permissions Control
Enable HTTPS
If this option is selected, all communication information is encrypted and transferred to OBS over HTTPS.
+If this option is selected, all communications information will be encrypted and then transferred to OBS over HTTPS.
Enable certificate verification
@@ -28,7 +28,7 @@Multipart Upload, Part Size (MB)
Objects whose size is larger than the specified part size (5 MB by default) are segmented and uploaded at the OBS background. The size of each part can be set in this dialog box. The value of Part Size (MB) can range from 5 MB to 5 GB.
+OBS uses multipart uploads by default. Objects larger than the specified part size (5 MB by default) will be uploaded using multipart upload in the background. You can adjust the size of each part as needed. The value of Part Size (MB) can range from 5 MB to 5 GB.
Multipart upload is used by default. Recommended settings of Part Size (MB) are as follows:
To maximize client performance, set Part Size (MB) based on the upload speed. You are advised to set the Part Size (MB) value larger than the maximum upload speed. For example, if the maximum upload speed is 10 MB/s, set Part Size (MB) to an integer greater than 10 MB. It is recommended that the part size be set to a value two to three times the maximum upload speed.
Enable proxy
If this option is selected, the Authentication option is displayed. Set the following parameters to access OBS through the proxy server:
+Selecting this option will display the Authentication option. By configuring the following parameters, you can access OBS through the proxy server:
- Address: domain name or IP address of the proxy server
- Port: port of the proxy server (default port is 8080)
Lifecycle Management Overview
Lifecycle management means periodically deleting objects in a bucket or transitioning between object storage classes by configuring rules.
- Some periodically uploaded files need only to be retained for one week or one month, and can be deleted once they have expired.
- Documents are seldom accessed after a certain period of time. These files need to be transitioned to Warm or Cold storage or be deleted.
- Periodically delete logs that are only meant to be retained for a specific period of time (a week or a month).
- Transition documents that are seldom accessed to the Warm or Cold storage class or delete them.
You can define lifecycle rules for identifying objects and manage lifecycles of the objects based on the rules.
-You can identify what objects in your bucket will be infrequently accessed, and then configure lifecycle rules to transition them to the Warm or Cold storage class to save storage costs. In short, transition basically means that the object storage class is altered without copying the object. You can also manually change the storage class of an object on the Objects page. For details, see Uploading an Object.
-Lifecycle rules have two key elements:
-- Configuration policy:
You can also specify the prefix of object names so that objects whose names have this prefix are restricted by the rules. You can configure a lifecycle rule for a bucket so that all objects in the bucket can be restricted by the lifecycle rule.
- - Time: You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Warm or Cold. Or you can specify an expiration time after which objects are automatically deleted.
- Transition to Warm: You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Warm.
- Transition to Cold: You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Cold.
- Expiration time: You can specify the number of days after which objects are automatically deleted or the day after which an object that matches with a rule is deleted.
You can define lifecycle rules for your scenarios similar to those mentioned above to better manage your objects.
+You can configure lifecycle rules for objects that will no longer be frequently accessed to transition them to the Warm or Cold storage class as needed. This can help reduce costs on storage. In short, transition basically means that the object storage class is altered without copying the object. You can also manually change the storage class of an object on the Objects page. For details, see Uploading an Object.
+Lifecycle rules have the following key elements:
+- Policy
You can specify an object name prefix to apply a lifecycle rule to a set of objects. You can also apply a lifecycle rule to the entire bucket (including the objects in it).
+ -
+
You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Warm or Cold, or are expired and then deleted.
+- Transition to Warm: This defines the number of days since the last object update after which objects meeting specified conditions are automatically transitioned to the Warm storage class.
- Transition to Cold: This defines the number of days since the last object update after which objects meeting specified conditions are automatically transitioned to the Cold storage class.
- Expiration time: This defines the number of days since the last object update after which objects meeting specified conditions are automatically expired and then deleted.
The previous number of days for objects to be transitioned to Warm is at least 30. If objects are configured to change to both Warm and Cold, the number of days for transition to Cold must be at least 30 days later than that for transition to Warm. For example, if the number of days for transition to Warm is 33, that for transition to Cold must be 63 at least. If only transition to Cold is enabled and transition to Warm is disabled, there is no limit on the number of days for transition. The expiration time must be greater than the two transition times.
+Objects can be transitioned to Warm at least 30 days after their last update. If you configure to transition objects first to Warm and then Cold, the objects must stay Warm at least 30 days before they can be transitioned to Cold. For example, if you configure to transition objects to Warm 33 days after their last update, the objects can be transitioned to Cold at least 63 days after their last update. If only transition to Cold is used, but transition to Warm is not, there is no limit on the number of days for transition. The number set for expiration time must be larger than that specified for any of the transition operations.
Procedure
- In the upper right corner of the OBS Console homepage, click Create Bucket. The Create Bucket page is displayed. For details, see Figure 1. - +
- Configure bucket parameters.
Table 1 Bucket parameters Parameter
Storage Class
Storage classes of a bucket. Different storage classes meet different requirements for storage performance and costs.
+- The Standard storage class is for storing a large number of hot files or small files that are frequently accessed (multiple times per month on average) and require quick retrieval.
- The Warm storage class is for storing data that is less frequently accessed (less than 12 times per year on average) and requires quick retrieval.
- The Cold storage class is for archiving data that is rarely accessed (once a year on average) and has no requirements for quick retrieval.
For details, see Storage Classes Overview.
- Click Create Now.
Related Operations
After the bucket is created, you can change its storage class by performing the following steps:
-- In the bucket list on OBS Console, select the target bucket and click Change Storage Class on the right.
- Select the desired storage class and click OK.
- Changing the storage class of a bucket does not change the storage class of existing objects in the bucket.
- An object inherits the bucket storage class by default, if no other storage class is specified for the object upon its upload. When the bucket storage class is changed, newly uploaded objects inherit the new bucket storage class by default.
- In the bucket list on OBS Console, select the target bucket and click Change Storage Class on the right.
- Select the desired storage class and click OK.
- Changing the storage class of a bucket does not change the storage class of existing objects in the bucket.
- If you do not specify a storage class for an object when uploading it, it inherits the bucket's storage class by default. After the bucket's storage class is changed, newly uploaded objects will inherit the new storage class of the bucket by default.
This section describes how to upload local files to OBS over the Internet. These files can be texts, images, videos, or any other type of files.
-Limitations and Constraints
- OBS Console allows you to upload files in a batch. Up to 100 files can be uploaded at a time, with the total size of no more than 5 GB. If the file size exceeds 5 GB, use OBS Browser or the multipart upload of OBS SDKs and APIs for upload.
- If versioning is disabled for your bucket and you upload a new file with the same name as the one you previously uploaded to your bucket, the new file automatically overwrites the previous file and does not retain its ACL information. If you upload a new folder using the same name that was used with a previous folder in the bucket, the two folders will be merged, and files in the new folder will overwrite namesake files in the previous folder.
- After versioning is enabled for your bucket, if the new file you upload has the same name as the one you previously uploaded to the bucket, a new file version will be added in the bucket. For details, see Versioning Overview.
Prerequisites
- At least one bucket has been created.
- If you want to classify files, you can create folders and upload files to different folders. For details about how to create a folder, see Creating a Folder
-Prerequisites
- At least one bucket has been created.
- If you want to classify files, you can create folders and upload files to different folders. For details, see Creating a Folder.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Go to the folder to which objects are uploaded. Click Upload Object. The Upload Object dialog box is displayed.
If the files that you want to upload to OBS are stored in Microsoft OneDrive, it is recommended that the names of these files contain a maximum of 32 characters to ensure compatibility.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Go to the folder where you want to upload files and click Upload Object. The Upload Object dialog box is displayed.
If the files that you want to upload to OBS are stored in Microsoft OneDrive, it is recommended that the names of these files contain a maximum of 32 characters to ensure compatibility.
Figure 1 Uploading objects-
- Select a storage class. If you do not specify a storage class, the object you upload inherits the default storage class of the bucket. -
An object can have a different storage class from its bucket. You can specify a storage class for an object when uploading it, or you can change the object storage class after the object is uploaded.
+- Select a storage class. If you do not specify a storage class, the objects you upload inherit the default storage class of the bucket.
- An object can have a different storage class from its bucket. You can specify a storage class for an object when uploading it, or you can change the object storage class after the object is uploaded.
- Add a file or folder to be uploaded by dragging it to the Upload Object area.
You can also click add file in the Upload Object area to select files.
+- In the Upload Object area, drag and drop the files or folders you want to upload.
You can also click add file in the Upload Object area to select files.
- (Optional) Select KMS encryption to encrypt the uploaded file. For details, see Uploading an Object in Server-Side Encryption Mode.
If the default encryption has been enabled for the bucket, uploaded objects are automatically encrypted.
- Click Upload.
Related Operations
When uploading an object, you can specify a storage class for it. After the object is uploaded, you can also change its storage class. The procedure is as follows:
+Related Operations
When uploading an object, you can specify a storage class for it. After the object is uploaded, you can also change its storage class by doing as follows:
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the target object and choose More > Change Storage Class on the right.
- Select the desired storage class and click OK.
- Objects can be changed from Standard to Warm or Cold storage class, or from Warm to Standard or Cold storage class, but objects in Cold storage class must be restored before being changed to Standard or Warm storage class. Changing from Warm or Cold to other storage classes incurs restore fees. Select an appropriate change option based on your actual needs.
- When the storage class is changed to Cold, the object restore status changes to Unrestored.
- You can also configure a lifecycle rule to change the storage class of an object. For details, see Configuring a Lifecycle Rule.
- + +
- After an object is changed to Cold, its restore status changes to Unrestored.
- You can also configure a lifecycle rule to change the storage class of an object. For details, see Configuring a Lifecycle Rule.
Follow-up Procedure
You can click Copy Path on the right of an object to copy its path.
-You can share the path with other users. Then they open the bucket where the object is stored and enter the path in the search box to find the object.
+You can share the path with others. Then they can open the bucket where the object is stored and enter the path in the search box above the object list to find the object.
diff --git a/docs/obs/umn/en-us_topic_0045853707.html b/docs/obs/umn/en-us_topic_0045853707.html index cd8f1df31..146cdf501 100644 --- a/docs/obs/umn/en-us_topic_0045853707.html +++ b/docs/obs/umn/en-us_topic_0045853707.html @@ -1,7 +1,7 @@Configuring a Bucket Policy
-A bucket policy defines the access control policy of resources (buckets and objects) in OBS.
+A bucket policy defines access control over resources (buckets and objects) in OBS.
Procedure
- Log in to OBS Browser.
- Click the blank area in the row of the bucket for which you want to configure a bucket policy and choose More > Configure Bucket Policy.
- In the Configure Bucket Policy dialog box, input required parameters.
The size of a bucket policy cannot exceed 20 KB.
Table 1 describes the parameters of bucket policies. All fields except the Effect field are optional.
@@ -59,8 +59,8 @@
- Select a storage class. If you do not specify a storage class, the objects you upload inherit the default storage class of the bucket.
Action/NotAction
OBS operations on which the bucket policy statement takes effect
-Either Action or NotAction must be selected to specify whether the bucket policy statement takes effect on the OBS operation.
+OBS actions which the bucket policy is applied to.
+Either Action or NotAction must be selected to specify whether the bucket policy applies to the OBS action.
Mandatory
Resource/NotResource
Objects on which the bucket policy statement takes effect
-Either Resource or NotResource must be selected to specify whether the bucket policy statement takes effect on the OBS resources.
+Either Resource or NotResource must be selected to specify whether the bucket policy applies to the OBS resources.
Mandatory
Managing Fragments
Background Information
Data can be uploaded to OBS using multipart uploads. Fragments are generated, if a multipart upload fails because of the following reasons (included but not limited to):
-- The network is in poor condition, and connection to the OBS server is frequently interrupted.
- The upload task is manually suspended.
- The device is faulty.
- The device is powered off suddenly.
- The network is in poor condition, and connection to the OBS server is frequently interrupted.
- The upload task is manually suspended.
- The device is faulty.
- The device is powered off suddenly.
If a file fails to be uploaded or the upload task is suspended, fragments are generated and stored in OBS. You can resume the upload through task management. After the resumable upload completes, the fragments will be cleared automatically.
You can also use the fragment management function to clear fragments. If you resume an upload task after clearing the fragments, the upload progress will be lost and the task needs to be re-uploaded.
The fragment storage in OBS is billed.
diff --git a/docs/obs/umn/en-us_topic_0045853737.html b/docs/obs/umn/en-us_topic_0045853737.html index 3ec141f7a..00b4216d4 100644 --- a/docs/obs/umn/en-us_topic_0045853737.html +++ b/docs/obs/umn/en-us_topic_0045853737.html @@ -3,7 +3,7 @@Adding External Buckets
OBS Browser supports the external bucket adding function.
Prerequisites
You have obtained the permissions to read and write the external bucket that you want to add.
-For example: Account A wants to add bucket testbucket of account B. Account B must authorize account A the permission to read bucket testbucket. If account A needs to upload object to bucket testbucket, account B needs to authorize account A the permission to write the bucket. Account A is the owner of the uploaded objects, and needs to authorize account B the permission to read and write the objects.
+For example: Account A wants to add bucket testbucket of account B. Account B must grant account A the permission to read bucket testbucket. If account A needs to upload object to bucket testbucket, account B needs to grant account A the permission to write the bucket. Account A is the owner of the uploaded objects, and needs to grant account B the permission to read and write the objects.
diff --git a/docs/obs/umn/en-us_topic_0045853744.html b/docs/obs/umn/en-us_topic_0045853744.html index 8ba442dd3..9499b0376 100644 --- a/docs/obs/umn/en-us_topic_0045853744.html +++ b/docs/obs/umn/en-us_topic_0045853744.html @@ -1,11 +1,11 @@ An external bucket (version 3.0 or later) can be added only when its standard bucket policy is set to Public Read and Write.
If the standard bucket policy of an external bucket is set to Public Read and Write upon its creation, you need to manually change the standard bucket policy to Private and then change it back to Public Read and Write again, so that it can be added.
Configuring Logging
-After logging is enabled for a bucket, OBS automatically converts bucket logs into objects following the naming rules and writes the objects into a target bucket.
-Prerequisites
The log delivery user group has been assigned the Write and ACL View permissions for the target bucket. For details, see Configuring a Bucket ACL.
+After logging is enabled for a bucket, OBS automatically converts the bucket's logs into objects in a fixed naming format and then writes these objects into a destination bucket.
+-Prerequisites
The log delivery user group has the write and ACL view permissions for the destination bucket. For details, see Configuring a Bucket ACL.
Procedure
- Log in to OBS Browser.
- Click the blank area in the row of the bucket for which you want to configure logging and choose More > Configure Logging.
- Select Enable. See Figure 1. -
- Select an existing bucket where you want to store log files. Log delivery users of the selected bucket will be automatically assigned with the permission to read the bucket ACL and write logs to the bucket.
- Enter a prefix for the Log File Name Prefix.
After logging is enabled, generated logs are named in the following format:
+Procedure
- Log in to OBS Browser.
- Click the blank area in the row of the bucket for which you want to configure logging and choose More > Configure Logging.
- Select Enable. See Figure 1. +
- Select an existing bucket where you want to store log files. Log delivery users of the selected bucket will be automatically granted the permissions to read the bucket ACL and write logs to the bucket.
- Enter a prefix for the Log File Name Prefix.
After logging is enabled, generated logs are named in the following format:
<Log File Name Prefix>YYYY-mm-DD-HH-MM-SS-<UniqueString>
- <Log File Name Prefix> is the shared prefix of log file names.
- YYYY-mm-DD-HH-MM-SS indicates when the log is generated.
- <UniqueString> indicates a character string generated by OBS.
On OBS Console, if the configured <Log File Name Prefix> ends with a slash (/), logs generated in the bucket are stored in the <Log File Name Prefix> folder in the bucket, facilitating the management of log files.
diff --git a/docs/obs/umn/en-us_topic_0045853745.html b/docs/obs/umn/en-us_topic_0045853745.html index cf8b94305..341ed925c 100644 --- a/docs/obs/umn/en-us_topic_0045853745.html +++ b/docs/obs/umn/en-us_topic_0045853745.html @@ -2,12 +2,12 @@Bucket Policies and Object Policies
-Bucket Owner and Object Owner
The owner of a bucket is the account that created the bucket. If the bucket is created by an IAM user under the account, the bucket owner is the account instead of the IAM user.
-The owner of an object is the account that uploads the object, who may not be the owner of the bucket to which the object belongs. For example, account B is granted the permission to access a bucket of account A, and account B uploads a file to the bucket. In that case, instead of the bucket owner account A, account B is the owner of the object.
+The owner of an object is the account that uploads the object, who may not be the owner of the bucket to which the object belongs. For example, account B is granted the permission to access a bucket of account A, and account B uploads a file to the bucket. In that case, instead of the bucket owner account A, account B is the owner of the object.
Bucket Policy
A bucket policy is attached to a bucket and objects in the bucket. By leveraging bucket policies, the owner of a bucket can grant IAM users or other accounts the permissions to operate the bucket and objects in the bucket.
-Bucket Policy Application Scenarios:
+-Bucket Policies
A bucket policy is attached to a bucket and objects in the bucket. By leveraging bucket policies, the owner of a bucket can grant IAM users or other accounts the permissions to operate the bucket and objects in the bucket.
+Application Scenarios
- If no IAM policies are used for access control and you want to grant other accounts the permissions to access your OBS resources, you can use bucket policies.
- You can configure bucket policies to grant IAM users different access permissions on buckets.
- You can also use bucket policies to grant other accounts the permissions to access your buckets.
Standard Bucket Policies:
+Standard Bucket Policies
There are three options for standard bucket policies.
- Private: No access beyond the bucket ACL settings is granted.
- Public Read: Anyone can read objects in the bucket.
- Public Read and Write: Anyone can read, write, or delete objects in the bucket.
After a bucket is created, the default bucket policy is Private. Only the bucket owner has the full control permissions over the bucket. To ensure data security, it is recommended that you do not use the Public Read or Public Read and Write policies.
@@ -73,13 +73,14 @@- For buckets whose version is 3.0, the default permissions of Public Read and Public Read and Write are updated to solve the problem where external buckets fail to be added to OBS Browser due to insufficient permissions.
- Added the ListBucket permission to the Public Read policy.
- Added the ListBucket permission to the Public Read and Write policy.
- If you want to add an external bucket to OBS Browser, manually update the configuration of standard bucket policies.
Custom Bucket Policy:
+Custom Bucket Policies
The following three modes are provided to facilitate quick configuration:
- Read-only: With the Read-only mode, you only need to specify the Principal (authorized users). Then the authorized users have the read permission for the bucket and objects in the bucket, and can perform all GET operations on these resources.
- Read and write: With the Read and write mode, you only need to specify the Principal (authorized users). Then the authorized users have the full control permissions for the bucket and objects in the bucket, and can perform any operation on these resources.
- Customized: With the Customized mode, you can define the specific operation permissions that you want to grant to users and accounts by configuring the Effect, Principal, Resources, Actions, and Conditions parameters.
On OBS Console, when you use a custom bucket policy to grant other users the permissions to operate resources in a bucket, you also need to grant these users the bucket read permission ListBucket (leaving the resource name blank indicates that the policy takes effect on the entire bucket). Otherwise, the users may have no permission to access the bucket from OBS Console.
Object Policy
Object policies apply to objects in a bucket. A bucket policy is applicable to a set of objects (with the same object name prefix) or to all objects (specified by an asterisk *) in the bucket. To configure an object policy, select an object, and then configure a policy for it.
+Object Policies
Object policies apply to objects in a bucket. A bucket policy is applicable to a set of objects (with the same object name prefix) or to all objects (specified by an asterisk *) in the bucket. To configure an object policy, select an object, and then configure a policy for it.
+diff --git a/docs/obs/umn/en-us_topic_0045853755.html b/docs/obs/umn/en-us_topic_0045853755.html index a3bf516b9..4caed73ff 100644 --- a/docs/obs/umn/en-us_topic_0045853755.html +++ b/docs/obs/umn/en-us_topic_0045853755.html @@ -1,25 +1,25 @@Configuring Static Website Hosting
-This section describes how to configure static website hosting for buckets and use bucket domain names to access static websites.
-The static website hosting takes effect within two minutes after its configuration is complete.
-Prerequisites
Web page files of the static website have been uploaded to a bucket.
+You can configure static website hosting for a bucket and then use the bucket's domain name to access static websites hosted in the bucket.
+The configuration of static website hosting takes two minutes at most to take effect.
+-Prerequisites
Web page files required for static website hosting have been uploaded to the specified bucket.
The static website files hosted in the bucket are accessible to anonymous users.
-If the web page files are in the Cold storage class, restore them first. For more information, see Restoring Objects from the Cold Storage.
+Static web page files in the Cold storage class have been restored. For more information, see Restoring Objects from the Cold Storage.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- (Optional) If the static website files in the bucket are not accessible to anonymous users, perform this step. If the static website files are already accessible to anonymous users, skip this step.
Grant the read permission for static website files to anonymous users. For details, see Granting Object Access Permissions to Anonymous Users.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- (Optional) If the static website files in the bucket are not accessible to anonymous users, perform this step. If they are already accessible to everyone, skip this step.
Grant the read permission for static website files to anonymous users. For details, see Granting Anonymous Users Permission to Access Objects.
If the bucket contains only static website files, configure the Public Read policy for the bucket so that all files in it can be accessed publicly.
- Choose Permissions > Bucket Policies.
- In the Standard Bucket Policies area, select the Public Read policy for the bucket.
- Click Public Read. For details, see Figure 1. In the confirmation dialog box that is displayed, click Yes.
- In the right Basic Configurations area, click Static Website Hosting. The Static Website Hosting page is displayed.
Alternatively, you can choose Basic Configurations > Static Website Hosting from the navigation pane on the left.
- - Click Configure Static Website Hosting. The Configure Static Website Hosting dialog box is displayed.
- Enable it by turning on the status switch.
- Set the hosting type to the current bucket. For details, see Figure 2. +
- In the Basic Configurations area, click Static Website Hosting. The Static Website Hosting page is displayed.
Alternatively, you can choose Basic Configurations > Static Website Hosting from the navigation pane on the left.
+ - Click Configure Static Website Hosting. The Configure Static Website Hosting dialog box is displayed.
- Enable Status.
- Set the hosting type to the current bucket. For details, see Figure 2. -
- Set the values of the homepage and 404 error page.
-
- Home Page: specifies the default homepage of the static website. When OBS Console is used to configure static website hosting, only HTML web pages are supported. When are used to configure static website hosting, OBS does not have such a restriction but the Content-Type of objects must be specified.
OBS only allows files such as index.html in the root directory of a bucket to function as the default homepage. Do not set the default homepage with a multi-level directory structure (for example, /page/index.html).
- - 404 Error Page: specifies the error page returned when an error occurs during static website access. When OBS Console is used to configure static website hosting, only HTML, JPG, PNG, BMP, and WEBP files under the root directory are supported. When APIs are used to configure static website hosting, OBS does not have such a restriction but the Content-Type of objects must be specified.
- Home Page: specifies the default homepage of the static website. When OBS Console is used to configure static website hosting, only HTML web pages are supported. When are used to configure static website hosting, OBS does not have such a restriction but the Content-Type of objects must be specified.
- Optional: In Redirection Rules, configure redirection rules. Requests that comply with the redirection rules are redirected to the specific host or page.
A redirection rule is compiled in the JSON or XML format. Each rule contains a Condition and a Redirect. The parameters are described as follows:
+ - Configure the homepage and 404 error page.
+
- Home Page: specifies the default homepage of the static website. When OBS Console is used to configure static website hosting, only HTML web pages are supported. When APIs are used to configure static website hosting, OBS does not have such a restriction, but the object Content-Type must be specified.
OBS only allows files such as index.html in the root directory of a bucket to function as the default homepage. Do not set the default homepage with a multi-level directory structure (for example, /page/index.html).
+ - 404 Error Page: specifies the error page returned when an error occurs during static website access. When OBS Console is used to configure static website hosting, only HTML, JPG, PNG, BMP, and WebP files under the root directory are supported. When APIs are used to configure static website hosting, OBS does not have such a restriction, but the object Content-Type must be specified.
- Home Page: specifies the default homepage of the static website. When OBS Console is used to configure static website hosting, only HTML web pages are supported. When APIs are used to configure static website hosting, OBS does not have such a restriction, but the object Content-Type must be specified.
- Optional: In Redirection Rules, configure redirection rules. Requests that comply with the redirection rules are redirected to the specific host or page.
A redirection rule is compiled in the JSON or XML format. Each rule contains a Condition and a Redirect. The parameters are described in Table 1.
--Table 1 Parameter description Container
+-Table 1 Parameter description Container
Key
Protocol
Protocol used for redirection The value can be http or https. If this parameter is not specified, the default value http is used.
+Protocol used for redirecting requests. The value can be http or https. If this parameter is not specified, the default value http is used.
HostName
@@ -55,12 +55,14 @@ReplaceKeyPrefixWith
Object name prefix on which the redirection rule takes effect
+The object name prefix used in the redirection request. OBS replaces the value of KeyPrefixEquals with the value you specified here for ReplaceKeyPrefixWith.
+For example, to redirect requests for docs (objects in the docs directory) to documents (objects in the documents directory), set KeyPrefixEquals to docs under Condition and ReplaceKeyPrefixWith to documents under Redirect. This way, requests for object docs/a.html will be redirected to documents/a.html.
ReplaceKeyWith
Object name on which the redirection rule takes effect
+The object name used in the redirection request. OBS replaces the entire object name in the request with the value you specified here for ReplaceKeyWith.
+For example, to redirect requests for all objects in the docs directory to documents/error.html, set KeyPrefixEquals to docs under Condition and ReplaceKeyWith to documents/error.html under Redirect. This way, requests for both objects docs/a.html and docs/b.html will be redirected to documents/error.html.
HttpRedirectCode
diff --git a/docs/obs/umn/en-us_topic_0045853756.html b/docs/obs/umn/en-us_topic_0045853756.html index e44fd3a2e..2bb871c7a 100644 --- a/docs/obs/umn/en-us_topic_0045853756.html +++ b/docs/obs/umn/en-us_topic_0045853756.html @@ -9,15 +9,17 @@-Background Information
Object Deletion with Versioning Enabled
When versioning is enabled for a bucket, OBS works slightly different when deleting different objects.
- Deleting a file or folder: The file or folder is not permanently deleted, but is retained in the Deleted Objects list and marked with the Delete Marker. In Deleted Objects, click the object name. On the Versions tab, you can see that the latest object version has the delete marker.
- To permanently delete the file or folder, delete it again from the Deleted Objects list. For details, see Procedure.
- To recover the deleted file, undelete it from the Deleted Objects list. For details, see Undeleting an Object.
- Deleting an object version: The version will be permanently deleted. If the deleted version is the latest one, the next latest version becomes the latest version.
- Deleting an object version: The version will be permanently deleted and cannot be recovered. If the deleted version is the latest one, the next latest version becomes the latest version.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file or folder you want to delete, and choose More > Delete on the right.
You can select multiple files or folders and click Delete above the object list to batch delete them.
- - Click Yes to confirm the deletion.
- If versioning is enabled for the bucket, delete the deleted files or folders again from the Deleted Objects list to permanently delete them.
- Click Deleted Objects.
- In the Operation column of the file or folder to be deleted, click Permanently Delete.
You can also select multiple files or folders and click Permanently Delete above the object list to batch delete them.
+-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file or folder you want to delete and choose More > Delete on the right.
You can select multiple files or folders and click Delete above the object list to batch delete them.
+ - Click Yes to confirm the deletion.+
If you delete an object from a bucket with versioning enabled, the object is not permanently deleted but retained in the Deleted Objects list. All versions of the object are still kept in the bucket and are billed for storage. If you need to permanently delete the object, see the following steps.
+ - If versioning is enabled for the bucket, delete the files or folders again from the Deleted Objects list to permanently delete them.
- Click Deleted Objects.
- In the Operation column of the file or folder to be deleted, click Permanently Delete.
You can also select multiple files or folders and click Permanently Delete above the object list to batch delete them.
Related Operations
When versioning is enabled, files in the Deleted Objects list also have multiple versions. Note the following points when deleting different versions of files:+- Deleting a version with the Delete Marker actually recovers this version instead of permanently deleting it. For details, see Undeleting an Object.
- Deleting a version without the Delete Marker permanently deletes this version. This version will not be recovered even if the object is recovered later.
Related Operations
When versioning is enabled, files in the Deleted Objects list also have multiple versions. Note the following points when deleting different versions of files:
+- Deleting a version with the Delete Marker actually recovers this version instead of permanently deleting it. For details, see Undeleting an Object.
- Deleting a version without the Delete Marker permanently deletes this version. This version will not be recovered even if the object is recovered later.
diff --git a/docs/obs/umn/en-us_topic_0045853764.html b/docs/obs/umn/en-us_topic_0045853764.html index 0153f1a9d..59f86657e 100644 --- a/docs/obs/umn/en-us_topic_0045853764.html +++ b/docs/obs/umn/en-us_topic_0045853764.html @@ -3,18 +3,18 @@Managing Accounts
Account names on OBS Browser are used to distinguish one from another, which are irrelevant to the registered cloud service account. An OBS Browser account has one pair of AK and SK, but a pair of AK and SK can be used by multiple OBS Browser accounts. A maximum of 10 accounts can be added to OBS Browser.
OBS Browser uses the AK and SK for identity authentication. AKs and SKs are the access keys created by on the management console (on My Credential page) by cloud service accounts and IAM users. For details, see Creating Access Keys (AK and SK).
-- AKs and SKs are required for logging in to OBS Browser to access OBS resources.
- Once an AK and SK are entered, IAM receives the AK and SK, finds the cloud service account or IAM user that own the pair of AK and SK, and checks which OBS permissions the account or IAM user has.
- Then IAM authorizes the user who tries to log in to OBS Browser the OBS permissions accordingly.
- The user can access OBS resources through OBS Browser.
Add an Account
- Log in to OBS Browser.
- In the upper right corner of OBS Browser, click the account name, and select Manage Account.
- In the Manage Account dialog box that is displayed, click Add Account.
- In the Add Account dialog box, enter the account information.
The account information includes the following parameters:
-- Account name: The account name is used only to uniquely identify an account and can be different from the OBS account registered with the cloud services. The account name cannot exceed 50 characters.
- Service: OBS Browser can connect to OBS or Other object storage services.
- When accessing OBS, select OBS. For details, see Figure 1. -
- When connecting to other object storage services, select Other object storage services. For details, see Figure 2.Specify Server Address. You can enter the IP address or domain name in the following format: server IP address or domain name:server port (the protocol port of HTTPS is 443 and that of HTTP is 80). The HTTPS server is used by default. If you want to use the HTTP server, click
in the upper right corner and click System Configuration. In the System Configuration dialog box that is displayed, deselect Enable HTTPS.
+- AKs and SKs are required for logging in to OBS Browser to access OBS resources.
- Once an AK and SK are entered, IAM receives the AK and SK, finds the cloud service account or IAM user that owns the pair of AK and SK, and checks which OBS permissions the account or IAM user has.
- Then IAM grants the user who tries to log in to OBS Browser the OBS permissions accordingly.
- The user can access OBS resources through OBS Browser.
-Adding an Account
- Log in to OBS Browser.
- In the upper right corner of OBS Browser, click the account name, and select Manage Account.
- In the Manage Account dialog box that is displayed, click Add Account.
- In the Add Account dialog box, enter the account information.
The following parameters need to be configured:
+- Account name: The account name is used only to uniquely identify an account and can be different from the OBS account registered with the cloud services. The account name cannot exceed 50 characters.
- Service: OBS Browser can connect to OBS or Other object storage services.
- When connecting OBS Browser to OBS, select OBS. For details, see Figure 1. +
- When connecting OBS Browser to any other object storage service, select Other object storage services. For details, see Figure 2.Specify Server Address. You can enter the IP address or domain name in the following format: server IP address or domain name:server port (the protocol port of HTTPS is 443 and that of HTTP is 80). The HTTPS server is used by default. If you want to use the HTTP server, click in the upper right corner and click System Configuration. In the System Configuration dialog box that is displayed, deselect Enable HTTPS.
- AK and SK: Enter the AK and SK created on the My Credential page after you register with a cloud service. For details about how to obtain AKs and SKs, see Creating Access Keys (AK and SK).
- Remember my secret access key is selected by default. If you do not select Remember my secret access key, you must input the secret access key each time you log in to OBS Browser.
- AK and SK: Enter the AK and SK created on the My Credential page after you register with a cloud service. For details about how to obtain AKs and SKs, see Creating Access Keys (AK and SK).
- Remember my secret access key is selected by default. If you do not select Remember my secret access key, you must input the secret access key each time you log in to OBS Browser.
- Click OK.
After saving the account information, you can click the account name in the upper corner of the page and the newly added account is displayed in the account name drop-down list. You can click the desired account to switch to that account from the current login account.
Edit an Account
- Log in to OBS Browser.
- In the upper right corner of OBS Browser, click the account name, and select Manage Account.
- Click Edit in the row where the desired account resides.
- Modify account information as required.
- Click OK to save the modification.
Editing an Account
- Log in to OBS Browser.
- In the upper right corner of OBS Browser, click the account name, and select Manage Account.
- Click Edit in the row where the desired account resides.
- Modify account information as required.
- Click OK to save the modification.
diff --git a/docs/obs/umn/en-us_topic_0045853821.html b/docs/obs/umn/en-us_topic_0045853821.html index 81639f351..494bee7da 100644 --- a/docs/obs/umn/en-us_topic_0045853821.html +++ b/docs/obs/umn/en-us_topic_0045853821.html @@ -4,16 +4,16 @@Deleting an Account
- Log in to OBS Browser.
- In the upper right corner of OBS Browser, click the account name, and select Manage Account.
- Click Delete in the row where the desired account resides.
- Click OK and the account is deleted.
-Prerequisites
You are the object owner or you have the permission to write the object ACL.
An object owner is the account that uploads the object, but may not be the owner of the bucket that stores the object. For example, account B is granted the permission to access a bucket of account A, and account B uploads a file to the bucket. In that case, account B, instead of the bucket owner account A, is the owner of the object. By default, account A is not allowed to access this object and cannot read or modify the object ACL.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click the object to be operated.
- On the Object ACL tab, click Edit to set ACL permissions of the Owner, Registered User, and Anonymous User for the target object.
If the object is encrypted, the ACL permission cannot be configured for registered users and anonymous users.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click the object to be operated.
- On the Object ACL tab page, click Edit to grant the owner, registered user, and anonymous user ACL permissions for the object.-
ACL permissions for encrypted objects cannot be granted to registered users or anonymous users.
- Click Add to apply specific ACL permissions to an account, as shown in Figure 1.
Enter an account ID or account name and set ACL permissions for the account. You can obtain the account ID or account name from the My Credentials page. The account ID and account name correspond to the Domain ID and Domain Name respectively on the My Credentials page.
+ - Click Add to apply specific ACL permissions to an account, as shown in Figure 1.
Enter an account ID or account name and specify ACL permissions for the account. You can obtain the account ID or account name from the My Credentials page. The account ID and account name correspond to the Domain ID and Domain Name respectively on the My Credentials page.
- Click Save.
diff --git a/docs/obs/umn/en-us_topic_0045853854.html b/docs/obs/umn/en-us_topic_0045853854.html index 732092779..e33bc05bb 100644 --- a/docs/obs/umn/en-us_topic_0045853854.html +++ b/docs/obs/umn/en-us_topic_0045853854.html @@ -4,22 +4,22 @@-Parent topic: Permission Control+Parent topic: Permissions ControlYou can configure a lifecycle management rule for a bucket, and applicable objects in the bucket will be managed by the rule.
Procedure
- Log in to OBS Browser.
- Click the blank area in the row of the bucket for which you want to configure a lifecycle rule and choose More > Configure Lifecycle Rule.
- In the Configure Lifecycle Rule dialog box, click Create. The dialog box in Figure 1 is displayed.
- Configure a lifecycle rule.Basic Information:
- Status:
Select Enable to enable the lifecycle rule.
- - Rule Name:
Identify lifecycle rules. The Rule Name contains a maximum of 255 characters.
- - Applies To: Can be set to Object name prefix or Bucket.
- Object name prefix: Objects that have the specified prefix will be managed by the lifecycle rule. The prefix cannot start with a slash (/), cannot have consecutive slashes (/), and cannot contain the following special characters: \:*?"<>|
- Bucket: All objects in the bucket will be managed by the lifecycle rule.
- Rule Name:
It identifies a lifecycle rule. A rule name can contain a maximum of 255 characters.
+ - Applies To: Can be set to Object name prefix or Bucket.
- Object name prefix: Objects with this specified prefix will be managed by the lifecycle rule. The prefix cannot start with a slash (/) or contain two consecutive slashes (//), and cannot contain the following special characters: \:*?"<>|
- Bucket: All objects in the bucket will be managed by the lifecycle rule.
- When Object name prefix is selected and the specified prefix and the prefix of an existing lifecycle rule overlap, OBS regards the two rules as one and disables the one to be configured. For example, if a rule with prefix abc exists in the system, another rule whose prefix starts with abc cannot be configured.
- If a lifecycle rule whose Applies To is set to Object name prefix has been configured, you cannot configure a lifecycle rule whose Applies To is set to Bucket.
- If a lifecycle rule has been configured for the entire bucket, no more rules that apply to object name prefix can be added.
- If the specified prefix is overlapping with the prefix set in an existing lifecycle rule, OBS regards these two rules as one and forbids you to configure the one you are configuring. For example, if there is already a rule with prefix abc in OBS, you cannot configure another rule whose prefix starts with abc.
- If there is already a lifecycle rule based on an object prefix, you are not allowed to configure another rule that is applied to the entire bucket.
- If a lifecycle rule has been configured for the entire bucket, no more rules that apply to object name prefix can be added.
Current Version or Historical Version:
- - Current Version and Historical Version are two concepts for Versioning. If Versioning is enabled, uploading objects with the same name to the same path generates different versions. The object uploaded lastly is called Current Version, and the object uploaded previously is called Historical Version.
- You can configure either the Current Version or Historical Version, or both of them.
- - Current Version and Historical Version are two concepts for versioning. If versioning is enabled for a bucket, uploading objects with the same name to the bucket creates different object versions. The last uploaded object is called the current version, while those previously uploaded are called historical versions.
- You can configure either the Current Version or Historical Version, or both of them.
- Transition to Warm: You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Warm. This number must be at least 30.
- Transition to Cold: You can specify the number of days after which objects that have been last updated and meet specified conditions are automatically transitioned to Cold. If you configure to transition objects first to Warm and then Cold, the objects must stay Warm at least 30 days before they can be transitioned to Cold. If only transition to Cold is used, but transition to Warm is not, there is no limit on the number of days for transition.
- Object deletion upon expiration: You can specify the number of days after which objects that have been last updated and meet the specified conditions are automatically deleted. The expiration time must be greater than the two transition times.
- Transition to Warm: After this number of days since the last update, objects meeting specified conditions will be transitioned to Warm. This number must be at least 30.
- Transition to Cold: After this number of days since the last update, objects meeting specified conditions will be transitioned to Cold. If you configure to transition objects first to Warm and then Cold, the objects must stay Warm at least 30 days before they can be transitioned to Cold. If only transition to Cold is used, but transition to Warm is not, there is no limit on the number of days for transition.
- Delete Objects After (Days): After this number of days since the last update, objects meeting certain conditions will be expired and then deleted. This number must be larger than that specified for any of the transition operations.
For example, on January 7, 2015, you saved the following files in OBS:-- log/test1.log
- log/test2.log
- doc/example.doc
- doc/good.txt
On January 10, 2015, you saved the following files:- log/clientlog.log
- log/serverlog.log
- doc/work.doc
- doc/travel.txt
On January 10, 2015, you saved another four files:-- log/clientlog.log
- log/serverlog.log
- doc/work.doc
- doc/travel.txt
On January 10, 2015, you set the expiration time of objects prefixed with log to one day later, you may encounter the following situations:
-- Objects log/test1.log and log/test2.log uploaded on January 7, 2015 may be deleted after the last system scan. The deletion may happen on January 10, 2015 or January 11, 2015, depending on the time of the last system scan.
- Objects log/clientlog.log and log/serverlog.log uploaded on January 10, 2015 are usually deleted on January 11, 2015 or January 12, 2015, depending on the time of the last system scan. If the objects have been stored for more than one day at the time of the last system scan, the objects are deleted upon the scan. Or, they are deleted at the next system scan or later whenever their storage duration meets the specified expiration time requirement.
On January 10, 2015, you set the objects prefixed with log to expire one day later. You might encounter the following situations:
+- Objects log/test1.log and log/test2.log uploaded on January 7, 2015 might be deleted after the last system scan. The deletion could happen on January 10, 2015 or January 11, 2015, depending on the time of the last system scan.
- Objects log/clientlog.log and log/serverlog.log uploaded on January 10, 2015 might be deleted on January 11, 2015 or January 12, 2015, depending on whether they have been stored for over one day (since their last update) when the system scan happened.
On the day of operation, you can set the objects with the name prefix log to be transitioned to Warm 30 days later, transitioned to Cold 60 days later, and deleted 100 days later, then OBS will transition log/clientlog.log, log/serverlog.log, log/test1.log, and log/test2.log to Warm when their storage duration exceeds 30 days, transition them to Cold when their storage duration exceeds 60 days, and delete them when their storage duration exceeds 100 days, respectively.
diff --git a/docs/obs/umn/en-us_topic_0045853860.html b/docs/obs/umn/en-us_topic_0045853860.html index c5adf170f..e568b0b01 100644 --- a/docs/obs/umn/en-us_topic_0045853860.html +++ b/docs/obs/umn/en-us_topic_0045853860.html @@ -7,7 +7,7 @@ In theory, it takes 24 hours at most to execute a lifecycle rule. Because OBS calculates the lifecycle of an object from the next 00:00 (UTC time) after the object is uploaded, there may be a delay in transitioning objects between storage classes and deleting expired objects. Generally, the delay does not exceed 48 hours. If you make changes to an existing lifecycle rule, the rule will take effect again.
- In the Add CORS Rule dialog box that is displayed, enter CORS rules.
Figure 1 Adding a CORS rule
Table 1 describes parameters in CORS rules.
-- - When versioning is enabled for a bucket, you can set metadata for objects which are Latest Version, but cannot set metadata for objects which are Historical Version.
- You cannot set object metadata for a Cold object.
- When versioning is enabled for a bucket, you can set metadata for objects which are Latest Version, but cannot set metadata for objects which are Historical Version.
- Metadata cannot be configured for Cold objects.
diff --git a/docs/obs/umn/en-us_topic_0050937852.html b/docs/obs/umn/en-us_topic_0050937852.html index 23d77fef8..110dc2d6c 100644 --- a/docs/obs/umn/en-us_topic_0050937852.html +++ b/docs/obs/umn/en-us_topic_0050937852.html @@ -3,7 +3,7 @@Storage Classes Overview
OBS supports tiered storage classes at the bucket level and object level.
OBS provides the following storage classes: Standard, Warm, and Cold.
-Different storage classes meet different requirements for storage performance and costs.- The Standard storage class features low access latency and high throughput. It is therefore suitable for storing a massive number of hot files (frequently accessed every month) or small files (less than 1 MB). The application scenarios include big data analytics, mobile apps, hot videos, and social apps.
- The Warm storage class is ideal for storing data that is semi-frequently accessed (less than 12 times a year), with requirements for quick response. The application scenarios include file synchronization, file sharing, and enterprise backup.
- The Cold storage class is suitable for archiving data that is rarely-accessed (averagely once a year). The application scenarios include data archiving and long-term data backups. The Cold storage class is secure, durable, and inexpensive, and can be used to replace tape libraries. To keep cost low, it may take hours to restore data from the Cold storage class.
These storage classes can meet different needs for storage performance and costs.- Standard: The Standard storage class features low latency and high throughput. It is therefore good for storing frequently (multiple times per month) accessed files or small files (less than 1 MB). Its application scenarios include big data analytics, mobile apps, hot videos, and social apps.
- Warm: The Warm storage class is for storing data that is infrequently (less than 12 times per year) accessed, but when needed, the access has to be fast. It can be used for file synchronization, file sharing, enterprise backups, and many other scenarios.
- Cold: The Cold storage class is ideal for storing data that is rarely (once per year) accessed. Its application scenarios include data archive and long-term backups. The Cold storage class is secure, durable, and inexpensive, and can be used to replace tape libraries. To keep cost low, it may take hours to restore data from the Cold storage class.
Bucket Storage Classes vs. Object Storage Classes
When an object is uploaded, it inherits the storage class of the bucket by default, but you can change the default storage class when you upload the object.
Changing the storage class of a bucket does not change the storage classes of existing objects in the bucket, but newly uploaded objects will inherit the new storage class.
@@ -21,11 +21,11 @@ - Status:
Feature
Top-notch performance, highly reliable and available
+Top-notch performance, high reliability and availability
Reliable, inexpensive, and real-time storage access
+Reliable, inexpensive storage with real-time access
Long-term storage for archived data at a very low cost
+Long-term storage for Cold data at a low cost
Application scenarios
@@ -37,9 +37,22 @@Archive, medical image storage, video material storage, and replacement of tape libraries
Minimum storage duration
+Minimum measurement unita
+NOTE:a: Minimum measurement unit refers to a minimum billable object size. For example, a 32 KB Standard object will be billed as if it were 64 KB.
+Not required
+64 KB
+64 KB
+64 KB
+Minimum storage durationb
+NOTE:+b: Minimum storage duration refers to a minimum billable storage duration. For example, an Infrequent Access object deleted when it was stored for 20 days will be billed for a full 30 days.
+N/A
30 days
This section describes how to use CORS in HTML5 to implement cross-origin access.
-Prerequisites
Static website hosting has been configured. For details, see Configuring Static Website Hosting.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- On the right of the Overview page, click CORS Rules in the Basic Configurations area. The CORS Rules page is displayed.
Alternatively, you can choose Basic Configurations > CORS Rules in the navigation pane.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the Basic Configurations area, click CORS Rules. The CORS Rules page is displayed.
Alternatively, you can choose Basic Configurations > CORS Rules in the navigation pane.
- Click Create. The Create CORS Rule dialog box is displayed. See Figure 1 for details.@@ -19,8 +19,8 @@
A bucket can have a maximum of 100 CORS rules configured.
Allowed Origin
Mandatory
-Requests from this origin can access the bucket.
-Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character (*) at most. Example:
+Specifies the origins from which requests can access the bucket.
+Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character (*) at most. An example is given as follows:
http://rds.example.com https://*.vbs.example.com
Allowed Method
Mandatory
-Specifies the acceptable operation type of buckets and objects.
+Specifies the allowed request methods for buckets and objects.
The methods include Get, Post, Put, Delete, and Head.
Allowed Header
Optional
-Specifies the allowed header of cross-origin requests.
-Only CORS requests matching the allowed header are valid.
+Specifies the allowed headers in cross-origin requests.
+Only CORS requests matching the allowed headers are valid.
You can enter multiple allowed headers (one per line) and each line can contain one wildcard character (*) at most. Spaces and special characters including &:< are not allowed.
Exposed Header
Optional
-Specifies the exposed header in CORS responses, providing additional information for clients.
+Specifies the exposed headers in CORS responses, providing additional information for clients.
By default, a browser can access only headers Content-Length and Content-Type. If the browser wants to access other headers, you need to configure those headers in this parameter.
You can enter multiple exposed headers (one per line). Spaces and special characters including *&:< are not allowed.
- Click OK.
Message "The CORS rule created successfully." is displayed. The configuration of CORS takes effect within two minutes.
+- Click OK.
Message "The CORS rule created successfully." is displayed. The CORS configuration takes effect within two minutes.
After CORS is successfully configured, only the addresses specified in Allowed Origin can access a bucket in OBS using the methods specified in Allowed Method. For example, you can configure CORS parameters for bucket testbucket as follows:
- Allowed Origin: https://www.example.com
- Allowed Method: GET
- Allowed Header: *
- Exposed Header: *
- Cache Duration (s): 100
By doing so, OBS only allows GET requests from https://www.example.com to access bucket testbucket, without restrictions on request headers. The client can cache CORS responses for 100 seconds.
diff --git a/docs/obs/umn/en-us_topic_0066088957.html b/docs/obs/umn/en-us_topic_0066088957.html index 773dd20e1..fa2634db3 100644 --- a/docs/obs/umn/en-us_topic_0066088957.html +++ b/docs/obs/umn/en-us_topic_0066088957.html @@ -2,13 +2,13 @@Configuring Redirection
You can redirect all requests for a bucket to another bucket or URL by configuring redirection rules.
-Prerequisites
Web page files of the static website have been uploaded to a bucket.
+-Prerequisites
Web page files required for static website hosting have been uploaded to the specified bucket.
The static website files hosted in the bucket are accessible to anonymous users.
-If the web page files are in the Cold storage class, restore them first. For more information, see Restoring Objects from the Cold Storage.
+Static web page files in the Cold storage class have been restored. For more information, see Restoring Objects from the Cold Storage.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the right Basic Configurations area, click Static Website Hosting. The Static Website Hosting page is displayed.
Alternatively, you can choose Basic Configurations > Static Website Hosting from the navigation pane on the left.
- - Click Configure Static Website Hosting. The Configure Static Website Hosting dialog box is displayed.
- Enable it by turning on the status switch.
- Set Hosting By to Redirection. See Figure 1 for details. Enter a bucket access domain name or URL in the text box of Redirect To. -
- Click OK.
- In the bucket list, click the bucket to which requests for the static website are redirected.
- (Optional) If the static website files in the bucket are not accessible to anonymous users, perform this step. If the static website files are already accessible to anonymous users, skip this step.
Grant the read permission for static website files to anonymous users. For details, see Granting Object Access Permissions to Anonymous Users.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the Basic Configurations area, click Static Website Hosting. The Static Website Hosting page is displayed.
Alternatively, you can choose Basic Configurations > Static Website Hosting from the navigation pane on the left.
+ - Click Configure Static Website Hosting. The Configure Static Website Hosting dialog box is displayed.
- Enable Status.
- Set Hosting By to Redirection, as shown in Figure 1. In the text box of Redirect To, enter the bucket's access domain name or URL. +
- Click OK.
- In the bucket list, click the bucket to which requests for the static website are redirected.
- (Optional) If the static website files in the bucket are not accessible to anonymous users, perform this step. If they are already accessible to everyone, skip this step.
Grant the read permission for static website files to anonymous users. For details, see Granting Anonymous Users Permission to Access Objects.
If the bucket contains only static website files, configure the Public Read policy for the bucket so that all files in it can be accessed publicly.
- Choose Permissions > Bucket Policies.
- In the Standard Bucket Policies area, select the Public Read policy for the bucket.
- Click Public Read. For details, see Figure 2. In the confirmation dialog box that is displayed, click Yes.
This topic describes how to configure an SMN-enabled event notification rule on OBS Console.
-Background Information
For details, see SMN-Enabled Event Notifications.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the right Basic Configurations area, click Event Notification. The Event Notification page is displayed.
Alternatively, you can choose Basic Configurations > Event Notification in the navigation pane.
+-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the Basic Configurations area, click Event Notification. The Event Notification page is displayed.
Alternatively, you can choose Basic Configurations > Event Notification in the navigation pane.
- Click Create. The Create Event Notification dialog box is displayed. See Figure 1 for details.
- Configure event notification parameters, as described in Table 1.-
Table 1 Event notification parameters Parameter
diff --git a/docs/obs/umn/en-us_topic_0066088967.html b/docs/obs/umn/en-us_topic_0066088967.html index 2d3282b84..bf21f389d 100644 --- a/docs/obs/umn/en-us_topic_0066088967.html +++ b/docs/obs/umn/en-us_topic_0066088967.html @@ -15,13 +15,13 @@Specific User
You can grant accounts access permissions to a bucket or an object using ACLs. Once a specific account is granted the access permissions, all IAM users who have OBS resource permissions under this account can have the same access permissions to operate the bucket or object.
-If you need to grant different access permissions to different IAM users, configure bucket policies. For details, see Granting an IAM User with the Operation Permissions for a Specified Bucket.
+If you need to grant different access permissions to different IAM users, configure bucket policies. For details, see Granting an IAM User Permissions to Operate a Specific Bucket.
Owner
The owner of a bucket is the account that created the bucket. The bucket owner has all bucket access permissions by default. The read and write permissions for the bucket ACL are permanently available to the bucket owner, and cannot be modified.
-The owner of an object is the account that uploaded the object, who may not be the owner of the bucket to which the object belongs. The object owner has the read access to the object, as well as the read and write access to the object ACL, and such access permissions cannot be modified.
+The owner of an object is the account that uploads the object, who may not be the owner of the bucket to which the object belongs. The object owner has the read access to the object, as well as the read and write access to the object ACL, and such access permissions cannot be modified.
NOTICE:Do not modify the bucket owner's read and write access permissions for the bucket.
READ
Allows a grantee to obtain the list of objects in and the metadata of a bucket.
+Used to obtain the list of objects in a bucket and the bucket metadata.
WRITE
Allows a grantee to upload, overwrite, and delete any object in a bucket.
+Used to upload, overwrite, and delete any object in a bucket.
Access to ACL
READ_ACP
Allows a grantee to obtain the ACL of a bucket.
+Used to obtain the ACL of a bucket.
The bucket owner has this permission permanently by default.
WRITE_ACP
Allows a grantee to update the ACL of a bucket.
+Used to update the ACL of a bucket.
The bucket owner has this permission permanently by default.
READ
Allows a grantee to obtain the content and metadata of an object.
+Used to obtain the content and metadata of an object.
Access to ACL
READ_ACP
Allows a grantee to obtain the ACL of an object.
+Used to obtain the ACL of an object.
The object owner has this permission permanently by default.
WRITE_ACP
Allows a grantee to update the ACL of an object.
+Used to update the ACL of an object.
The object owner has this permission permanently by default.
Bucket ACL Application Scenarios
ACLs control the read and write permissions for accounts and groups. ACL permission granularity is not as fine as bucket policies and IAM policies. Generally, it is recommended that you use IAM policies and bucket policies for access control.
-It is recommended that you use bucket ACLs in the following scenarios:
-- Grant the log delivery user with the write access to the target bucket, so that access logs can be delivered to the target bucket.
- Grant an account with the read and write access to a bucket, so that data in the bucket can be shared or the bucket can be mounted.
You can configure bucket ACLs to:
+- Grant the log delivery user write access to the target bucket that stores access logs.
- Grant an account read and write access to a bucket, so that data in the bucket can be shared or the bucket can be mounted.
Object ACL Application Scenarios
ACLs control the read and write permissions for accounts and groups. ACL permission granularity is not as fine as bucket policies and IAM policies. Generally, it is recommended that you use IAM policies and bucket policies for access control.
It is recommended that you use object ACLs in the following scenarios:
diff --git a/docs/obs/umn/en-us_topic_0066176932.html b/docs/obs/umn/en-us_topic_0066176932.html index 97b288388..15506295c 100644 --- a/docs/obs/umn/en-us_topic_0066176932.html +++ b/docs/obs/umn/en-us_topic_0066176932.html @@ -6,11 +6,11 @@@@ -20,7 +20,7 @@Background Information
Object Deletion with Versioning Enabled
When versioning is enabled for a bucket, OBS works slightly different when deleting different objects.
- Deleting a file or folder: The file or folder is not permanently deleted, but is retained in the Deleted Objects list and marked with the Delete Marker.
- To permanently delete the file or folder, delete it again from the Deleted Objects list. For details, see Deleting an Object or Folder.
- To recover the deleted file, undelete it from the Deleted Objects list. For details, see Procedure.
- Deleting an object version: The version will be permanently deleted. If the deleted version is the latest one, the next latest version becomes the latest version.
- Deleting an object version: The version will be permanently deleted and cannot be recovered. If the deleted version is the latest one, the next latest version becomes the latest version.
Object Recovery with Versioning Enabled
When a bucket has the versioning function enabled, deleting a file from the Objects list does not permanently delete it. The deleted file will be retained with the Delete Marker in the Deleted Objects list. You can recover the deleted file using the Undelete operation.
Note the following points when you undelete objects:
-- Only deleted files but not folders can be undeleted.
After you undelete a deleted file, the file is recovered and will appear in the Objects list. Then you can perform basic operations on the file as you normally do on other objects. If the file was stored in a folder before the deletion, it will be recovered to its original path after you undelete it.
+- Only files can be undeleted but not folders.
After you undelete a deleted file, the file is recovered and will appear in the Objects list. Then you can perform basic operations on the file as you normally do on other objects. If the file was stored in a folder before the deletion, it will be recovered to its original path after you undelete it.
- Deleted files in the Deleted Objects also keep multiple versions. When deleting different versions of files, note the following points:
- If you delete a version with the Delete Marker, it actually recovers this version instead of permanently deleting it. For details, see Related Operations.
- If you delete a version without the Delete Marker, that version is permanently deleted. This version will not be recovered, even if the object is recovered later.
- A deleted object must have at least one version without the Delete Marker in the Deleted Objects list. Otherwise, the object cannot be undeleted.
- Only files can be undeleted but not folders.
diff --git a/docs/obs/umn/obs_03_0002.html b/docs/obs/umn/obs_03_0002.html index a47ac8a8d..4a03af424 100644 --- a/docs/obs/umn/obs_03_0002.html +++ b/docs/obs/umn/obs_03_0002.html @@ -11,7 +11,7 @@Related Operations
Recover a file by deleting its version with the Delete Marker:
-- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Deleted Objects.
- Click the deleted file that you want to recover. The file information is displayed.
- On the Versions tab, view all versions of the file.
- If you delete a version with the Delete Marker, the file is recovered and retained in the Objects list.
- If you delete a version without the Delete Marker, that version is permanently deleted.
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Deleted Objects.
- Click the deleted file that you want to recover. The file information is displayed.
- On the Versions tab, view all versions of the file.
- If you delete a version with the Delete Marker, the file will be recovered and retained in the Objects list.
- If you delete a version without the Delete Marker, that version will be permanently deleted.
Application Scenarios
- The same OBS resources need to be accessed in different locations. To minimize the access latency, you can use cross-region replication to create object copies in the nearest region.
- Due to business reasons, you need to migrate OBS data to the data center in another region.
- To ensure data security and availability, you need to create explicit backups for all data written to OBS in the data center of another region. Therefore, secure backup data is available if the source data is damaged irrevocably.
diff --git a/docs/obs/umn/obs_03_0003.html b/docs/obs/umn/obs_03_0003.html index a4b7faa52..f81706a8c 100644 --- a/docs/obs/umn/obs_03_0003.html +++ b/docs/obs/umn/obs_03_0003.html @@ -1,7 +1,7 @@Limitations and Constraints
Cross-region replication has the following limitations and constraints:
-- Currently, only buckets of version 3.0 support cross-region replication. To check the bucket version, go to the Overview page of the bucket on OBS Console. Then you can view the bucket version in the Basic Information area.
- Objects cannot be copied to the destination bucket if they are uploaded before cross-region replication is enabled.
- The source bucket and the destination bucket must belong to different regions separately. Data cannot be copied between buckets in the same region.
- Objects of the Cold storage class in the source bucket cannot be copied to the destination bucket through the cross-region replication function.
- If the region where the destination bucket resides does not support the storage classes, object copies will be stored in the standard storage class.
- The versioning status of the source bucket must be the same as that of the destination bucket.
- Objects in a source bucket can be copied to only one destination bucket, and cannot be copied again from the destination bucket to another bucket. For example, bucket A and bucket B are in two different regions. You can copy data from bucket A to bucket B or the other way round. However, data copies in either bucket A or bucket B cannot be replicated anymore.
- Object deletion actions made on the source bucket are usually not synchronized to the destination bucket when synchronous deletion of objects is disabled. The object deletion synchronization will happen only when both the source and destination buckets have versioning enabled and you delete an object from the source bucket without specifying a version.
When synchronous deletion of objects is enabled, object deletion actions made on the source bucket will be synchronized to the destination bucket. Deleting an object from the source bucket also deletes the object from the destination bucket.
+- Currently, only buckets of version 3.0 support cross-region replication. To check the bucket version, go to the Overview page of the bucket on OBS Console. Then you can view the bucket version in the Basic Information area.
- The source bucket and the destination bucket must belong to different regions separately. Data cannot be copied between buckets in the same region.
- Objects of the Cold storage class in the source bucket cannot be copied to the destination bucket through the cross-region replication function.
- If the region where the destination bucket resides does not support the storage classes, object copies will be stored in the standard storage class.
- The versioning status of the source bucket must be the same as that of the destination bucket.
- Objects in a source bucket can be copied to only one destination bucket, and cannot be copied again from the destination bucket to another bucket. For example, bucket A and bucket B are in two different regions. You can copy data from bucket A to bucket B or the other way round. However, data copies in either bucket A or bucket B cannot be replicated anymore.
- Object deletion actions made on the source bucket are usually not synchronized to the destination bucket when synchronous deletion of objects is disabled. The object deletion synchronization will happen only when both the source and destination buckets have versioning enabled and you delete an object from the source bucket without specifying a version.
When synchronous deletion of objects is enabled, object deletion actions made on the source bucket will be synchronized to the destination bucket. Deleting an object from the source bucket also deletes the object from the destination bucket.
- If you change the versioning status of the destination bucket when cross-region replication is enabled, the replication of objects will fail. If you want to change the versioning status of the source bucket, disable the cross-region replication first, and then make the change.
- Ensure that owners of the source and destination buckets have the read and write permissions to the two buckets. Otherwise, data cannot be synchronized. If the system does not have the permissions to read the source bucket or write the destination bucket due to read/write permission errors, objects cannot be copied successfully, and such replication will not be resumed even if the permission error is rectified.
- For a source bucket, you can create only one cross-region replication rule that applies to the whole bucket for replication of all objects in the bucket. However, you can create a maximum of 100 cross-region replication rules based on object prefixes for the replication of objects that match the prefixes.
- OBS currently only supports the replication between one source bucket and one destination bucket. Replication from one source bucket to multiple destination buckets is not supported. The destination bucket can be modified. However, modifying the destination bucket will change the destination bucket of all existing rules.
- If you delete the OBS agency when the cross-region replication is enabled, the replication will be in the FAILED status.
- Do not delete, overwrite object replicas in the destination bucket, or modify their ACLs, which may cause inconsistency of latest object versions or permission control settings between the destination bucket and the source bucket.
- After a replication with Synchronize Existing Objects enabled is complete, if the replication policy keeps unchanged, any ACL changes of source objects will be synchronized to object copies. However, ACL changes of source historical objects will not be synchronized to the copies of historical objects.
Configuring Cross-Region Replication
-Currently, OBS allows you to configure a cross-region replication rule for copying all objects from a source bucket to a destination bucket or multiple cross-region replication rules that match prefixes.
+To replicate objects from a source bucket to a destination bucket in a different region, you can configure a single cross-region replication rule that is applied to all objects in the bucket, or you can configure multiple rules that are applied to a set of objects by specifying a prefix.
A cross-region replication rule may not take effect immediately upon its configuration. Accordingly, the objects that this rule is applied to may not be replicated immediately after the rule is configured.
Prerequisites
The source bucket version is 3.0 or later, and cross-region replication is available in the region of the source bucket.
@@ -15,20 +15,20 @@Status
Indicates whether to enable or disable the replication rule. The versioning status of the source bucket must be the same as that of the destination bucket.
+Indicates whether the rule is enabled or disabled after being created. The versioning status of the source and destination buckets must keep the same.
Source bucket
Replicate
Indicates objects on which the rule takes effect.
-- All objects: The rule applies to all objects in the bucket.
- Match by prefix: The rule applies only to objects with the preset prefix.
Indicates the objects the rule will apply to.
+- All objects: The rule applies to all objects in the bucket.
- Match by prefix: The rule applies only to objects with the specified prefix.
Prefix
- If you want to apply the rule to objects by prefix, you must set a value no longer than 1024 characters for Prefix.
- When Match by prefix is selected and the specified prefix overlaps with the prefix of an existing rule, OBS regards the two rules as one and the new one cannot be configured successfully. For example, if a rule with prefix abc exists in the system, another rule whose prefix starts with abc cannot be configured.
- To copy a folder, end the prefix with a slash (/), for example, imgs/.
- To apply the rule to objects with the specified prefix, you must set Prefix to a value no longer than 1,024 characters.
- If the specified prefix overlaps with the prefix of an existing rule, OBS regards these two rules as one and the new rule cannot be configured. For example, if there is already a rule with prefix abc in OBS, you cannot configure another rule whose prefix starts with abc.
- To copy a folder, end the prefix with a slash (/), for example, imgs/.
Synchronize Existing Objects
@@ -44,9 +44,9 @@Replicate KMS encrypted objects
OBS will try to copy KMS encrypted objects no matter whether this option is selected or not.
-- If this option is selected, only the IAM agencies that have the KMS Administrator permissions at both the source and destination ends are displayed in the drop-down list of IAM Agency in this dialog box.
- If this option is not selected, only the IAM agencies that do not have the KMS Administrator permission at either the source or destination end are displayed in the drop-down list of IAM Agency in this dialog box.
If KMS is not available in the destination region or the agency does not have the KMS Administrator permissions in the source and destination regions, KMS encrypted objects in the source bucket will fail to be replicated to the destination bucket, and the object replication status will be FAILED.
-After a KMS-encrypted object in the source bucket is replicated to the destination bucket, the key for encrypting the object copy changes to the default key obs/default of the region where the destination bucket is located.
+- If this option is selected, only the IAM agencies that have the KMS Administrator permission at both the source and destination ends are displayed in the drop-down list of IAM Agency in the Create Cross-Region Replication Rule dialog box.
- If this option is not selected, only the IAM agencies that do not have the KMS Administrator permission at either the source or destination end are displayed in the drop-down list of IAM Agency in the Create Cross-Region Replication Rule dialog box.
If KMS is not available in the destination region or the agency does not have the KMS Administrator permission in the source and destination regions, KMS encrypted objects will fail to be replicated to the destination bucket, and the object replication status will be failed.
+After a KMS-encrypted object is replicated to the destination bucket, the key for encrypting the object copy changes to the default key obs/default of the destination region.
Destination bucket
@@ -63,7 +63,7 @@Change storage class for replicated objects
By default, this option is not selected, indicating that the storage class of object copies is the same as that of objects in the source bucket. If you need to change the storage class of objects copies, select this parameter, then you can specify a storage class.
+By default, this option is not selected, indicating that the storage class of object copies is the same as that of the source objects. If you need to change the storage class of objects copies, select this parameter, then you can specify a storage class.
Permissions
@@ -73,7 +73,7 @@Delegates OBS to operate your resources, so that OBS can use this agency to implement cross-region replication.
If there is no IAM agency available, click Create IAM agencies to create one. If you have already created IAM agencies, select one from the drop-down list.
NOTE:Requirements:
-The IAM agency must be of OBS. The OBS project must have the OBS FullAccess permissions. If Replicate KMS encrypted objects is selected, you also need the KMS Administrator permissions in the regions where the source and destination buckets are located.
+The IAM agency must be of OBS. The OBS project must have the OBS FullAccess permissions. If Replicate KMS encrypted objects is selected, you also need the KMS Administrator permission in the regions where the source and destination buckets are located.
Monitoring OBS
-Scenarios
You may send PUT and GET requests continuously when using OBS, which generates upload and download traffic. You may also receive error responses from the server. Cloud Eye can perform automatic and real-time monitoring over your buckets. It triggers alarms and notifications upon operations to help you understand your bucket access requests, traffic, and error responses in a timely manner.
+-Scenarios
In the use of OBS, you may send PUT and GET requests that generate upload and download traffic, or receive error responses from the server. To learn the requests, traffic, and error responses in a timely manner, you can use Cloud Eye to perform automatic and real-time monitoring over your buckets.
You do not need to separately subscribe to Cloud Eye. It starts automatically once you create a resource (a bucket, for example) in OBS. For more information about Cloud Eye, see Cloud Eye User Guide.
Figure 1 Cloud Eye monitoring
Setting Alarm Rules
In addition to the automatic and real-time monitoring, you can configure alarm rules in Cloud Eye to send alarm notifications when specified situation occurs.
+Setting Alarm Rules
In addition to automatic and real-time monitoring, you can configure alarm rules in Cloud Eye to receive alarm notifications when specified events happen.
For details, see Creating Alarm Rules in Cloud Eye User Guide.
Viewing OBS Monitoring Metrics
Cloud Eye monitors OBS monitoring metrics in real time. You can view detailed monitoring statistics of each metric on the console of Cloud Eye.
diff --git a/docs/obs/umn/obs_03_0010.html b/docs/obs/umn/obs_03_0010.html index 9ef085c5e..8c7d86f0f 100644 --- a/docs/obs/umn/obs_03_0010.html +++ b/docs/obs/umn/obs_03_0010.html @@ -81,7 +81,7 @@First Byte Download Delay
Specifies the average time from receiving a GET, HEAD, or OPTIONS request to the time that the system starts to respond in a measurement period.
-Unit: millisecond
+Unit: ms
≥ 0 ms
Storage Classes Overview
OBS supports tiered storage classes at the bucket level and object level.
OBS provides the following storage classes: Standard, Warm, and Cold.
-Different storage classes meet different requirements for storage performance and costs.- The Standard storage class features low access latency and high throughput. It is therefore suitable for storing a massive number of hot files (frequently accessed every month) or small files (less than 1 MB). The application scenarios include big data analytics, mobile apps, hot videos, and social apps.
- The Warm storage class is ideal for storing data that is semi-frequently accessed (less than 12 times a year), with requirements for quick response. The application scenarios include file synchronization, file sharing, and enterprise backup.
- The Cold storage class is suitable for archiving data that is rarely-accessed (averagely once a year). The application scenarios include data archiving and long-term data backups. The Cold storage class is secure, durable, and inexpensive, and can be used to replace tape libraries. To keep cost low, it may take hours to restore data from the Cold storage class.
These storage classes can meet different needs for storage performance and costs.- Standard: The Standard storage class features low latency and high throughput. It is therefore good for storing frequently (multiple times per month) accessed files or small files (less than 1 MB). Its application scenarios include big data analytics, mobile apps, hot videos, and social apps.
- Warm: The Warm storage class is for storing data that is infrequently (less than 12 times per year) accessed, but when needed, the access has to be fast. It can be used for file synchronization, file sharing, enterprise backups, and many other scenarios.
- Cold: The Cold storage class is ideal for storing data that is rarely (once per year) accessed. Its application scenarios include data archive and long-term backups. The Cold storage class is secure, durable, and inexpensive, and can be used to replace tape libraries. To keep cost low, it may take hours to restore data from the Cold storage class.
Bucket Storage Classes vs. Object Storage Classes
When an object is uploaded, it inherits the storage class of the bucket by default, but you can change the default storage class when you upload the object.
Changing the storage class of a bucket does not change the storage classes of existing objects in the bucket, but newly uploaded objects will inherit the new storage class.
@@ -21,11 +21,11 @@Feature
Top-notch performance, highly reliable and available
+Top-notch performance, high reliability and availability
Reliable, inexpensive, and real-time storage access
+Reliable, inexpensive storage with real-time access
Long-term storage for archived data at a very low cost
+Long-term storage for Cold data at a low cost
Application scenarios
@@ -37,9 +37,22 @@Archive, medical image storage, video material storage, and replacement of tape libraries
Minimum storage duration
+Minimum measurement unita
+NOTE:a: Minimum measurement unit refers to a minimum billable object size. For example, a 32 KB Standard object will be billed as if it were 64 KB.
+Not required
+64 KB
+64 KB
+64 KB
+Minimum storage durationb
+NOTE:+b: Minimum storage duration refers to a minimum billable storage duration. For example, an Infrequent Access object deleted when it was stored for 20 days will be billed for a full 30 days.
+N/A
30 days
Management
Deleting the CORS configuration a Bucket
+Deleting the CORS configuration of a bucket
bucket
deleteBucketWebsite
Management
-Deleting bucket data
-bucket
-deleteBucketdata
-Management
Creating a bucket
diff --git a/docs/obs/umn/obs_03_0024.html b/docs/obs/umn/obs_03_0024.html index f17b83d40..38b29b938 100644 --- a/docs/obs/umn/obs_03_0024.html +++ b/docs/obs/umn/obs_03_0024.html @@ -6,7 +6,7 @@Procedure
- Log in to OBS Browser.
- Click the bucket to which the file or folder will be uploaded.
- Click Upload. The Upload Object dialog box is displayed. For details, see Figure 1.
You can select either files or folders to upload. For details, see 4 and 5.
- - Click Select File. The local file browser dialog box is displayed. Select the file that you want to upload and click Open.
You can upload a maximum of 500 files or folders at a time.
+ - Click Select File. The local file browser dialog box is displayed. Select the file that you want to upload and click Open.
You can upload a maximum of 500 files or folders at a time.
If the files that you want to upload to OBS are stored in Microsoft OneDrive, it is recommended that the names of these files contain a maximum of 32 characters to ensure compatibility.
- Click Select Folder, select a folder, and click OK.
- Select a storage class. If no storage class is selected, the object inherits the bucket storage class by default.
- Click OK to upload the file or folder.
Configuring a User-Defined Domain Name
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Domain Name Mgmt.
- Click Bind User Domain Name. In the displayed dialog box, enter the domain name to configure, as shown in Figure 1.
The suffix of a user-defined domain name can contain 2 to 6 uppercase or lowercase letters.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Domain Name Mgmt.
- Click Bind User Domain Name. In the displayed dialog box, enter the domain name to configure, as shown in Figure 1.
The suffix of a user-defined domain name can contain 2 to 6 uppercase or lowercase letters.
- Click OK.
- Configure a CNAME record on the DNS, and map the user-defined domain name (for example, example.com) to the domain name of the bucket.
The CNAME configuration varies depending on DNS providers. For details, contact your DNS provider.
Configuring User Permissions
-If your cloud service account does not need individual IAM users, then you may skip this section. Your permissions to use OBS functions are not affected.
-If IAM users are required, you need to grant them access permissions on OBS, because OBS is separately deployed from other cloud resources.
+If IAM users are required, you need to grant them access permissions for OBS, because OBS is separately deployed from other cloud resources.
Process
Figure 1 Process of granting an IAM user the OBS permissions
Procedure
- Log in to the management console with your account.
- On the top menu bar, choose Service List > Management & Deployment > Identity and Access Management. The IAM console is displayed.
- Create a user group and assign OBS permissions to it.A user group is a collection of users. By assigning permissions to a user group, you assign permissions to the users in this group. After you create an IAM user, add it to one or more user groups, so that it can inherit the permissions from the groups.
- In the navigation pane, choose User Groups. The User Groups page is displayed.
- Click Create User Group.
- Enter a user group name and click OK.
The user group is displayed in the user group list once the creation is complete.
@@ -11,39 +11,7 @@
- Create a user.
- In the navigation pane, choose Users. The Users page is displayed.
- Click Create User.
- Set user information and click Next.
--
-Table 1 User parameters Parameter
-Description
-Username
-The user name for logging in to the cloud service.
-Credential Type
-- Password: Used for accessing cloud services using the console or development tools.
- Access key: Used for logging to the cloud service using development tools. This credential type is more secure, and is recommended if the user does not need to use the console.
User Groups
-You can add a user to one or more user groups. Then the user will inherit the permissions granted to these user groups. The default user group admin has the administrator permissions and all of the permissions required to use all cloud resources.
-Description
-(Optional) Brief description about the user.
- - Select a type for password generation, set the email address and mobile number, and click OK.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
+- Create an IAM user. For details, see section "Creating an IAM User" in the Identity and Access Management User Guide.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
diff --git a/docs/obs/umn/obs_03_0037.html b/docs/obs/umn/obs_03_0037.html index 1a2d38329..275fedda5 100644 --- a/docs/obs/umn/obs_03_0037.html +++ b/docs/obs/umn/obs_03_0037.html @@ -2,7 +2,7 @@Creating an IAM Agency
diff --git a/docs/obs/umn/obs_03_0045.html b/docs/obs/umn/obs_03_0045.html index e0bb58202..5104c88d4 100644 --- a/docs/obs/umn/obs_03_0045.html +++ b/docs/obs/umn/obs_03_0045.html @@ -5,7 +5,7 @@To use some OBS features, you need to use IAM agencies to grant required permissions to OBS for processing your data.
-diff --git a/docs/obs/umn/obs_03_0038.html b/docs/obs/umn/obs_03_0038.html index 562b3bce3..a3b512ed9 100644 --- a/docs/obs/umn/obs_03_0038.html +++ b/docs/obs/umn/obs_03_0038.html @@ -11,7 +11,7 @@Creating an Agency for Cross-Region Replication
- In the Create Cross-Region Replication Rule dialog box on OBS Console, click Create IAM agencies to jump to the Agencies page on the IAM console.
- Click Create Agency to create an agency.
- Enter an agency name.
- Select Cloud service for the Agency Type.
- Select Object Storage Service (OBS) for Cloud Service.
- Set a validity period.
- In the Permissions area, select Project View, locate Global service [Global], and click Modify Permissions in the Operation column. The Modify Permissions window is displayed.
- Click Select Policy/Role in the Operation column of the row where Global service [Global] is displayed. Search for Tenant Administrator and check the box next to it, and click OK.
- (Optional) If Replicate KMS encrypted objects is selected when configuring the cross-region replication rule, the KMS Administrator policy set must be configured in the regions where the source bucket and destination bucket are located.
- Click Modify Permissions in the row of the region where the source/destination bucket resides. The Modify Permissions dialog box is displayed.
- Click Select Policy/Role in the row of the region where the source/destination bucket resides. The Select Policy/Role dialog box is displayed.
- Search for KMS and check the box next to the KMS Administrator policy set.
- Click OK.
Creating an Agency for Cross-Region Replication
- In the Create Cross-Region Replication Rule dialog box on OBS Console, click Create IAM agencies to jump to the Agencies page on the IAM console.
- Click Create Agency.
- Enter an agency name.
- Select Cloud service for the Agency Type.
- Select Object Storage Service (OBS) for Cloud Service.
- Set a validity period.
- In the Permissions area, select Project View, locate Global service [Global], and click Modify Permissions in the Operation column. The Modify Permissions window is displayed.
- Click Select Policy/Role in the Operation column of the row where Global service [Global] is displayed. Search for Tenant Administrator and check the box next to it, and click OK.
- (Optional) If Replicate KMS encrypted objects is selected when configuring the cross-region replication rule, the KMS Administrator policy set must be configured in the regions where the source bucket and destination bucket are located.
- Click Modify Permissions in the row of the region where the source/destination bucket resides. The Modify Permissions dialog box is displayed.
- Click Select Policy/Role in the row of the region where the source/destination bucket resides. The Select Policy/Role dialog box is displayed.
- Search for KMS and check the box next to the KMS Administrator policy set.
- Click OK.
- Click OK to complete the agency creation.
You can use Identity and Access Management (IAM) to manage OBS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.
You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use OBS resources but prevent them from being able to delete resources or perform any high-risk operations.
If your account does not require individual IAM users for permissions management, skip this section.
-IAM is offered for free. You pay only for the resources in your account. For more information about IAM, see section "Service Overview" in the Identity and Access Management User Guide.
+IAM is a free service. You only pay for the resources in your account. For more information about IAM, see section "Service Overview" in the Identity and Access Management User Guide.
OBS Permissions
By default, new IAM users do not have any permissions assigned. You can assign permissions to these users by adding them to one or more groups and attaching policies to the groups. IAM provides preset system policies that define common permissions for different services, such as full control access and read-only. You can directly use these preset policies.
OBS is a global service deployed and accessed without specifying any physical region. OBS permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.
RBAC policy: An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all the required permissions, including permissions for accessing and managing that service. RBAC policies do not support operation-specific permission control.
@@ -724,7 +724,7 @@
diff --git a/docs/obs/umn/obs_03_0046.html b/docs/obs/umn/obs_03_0046.html index ceee70618..95a0750f9 100644 --- a/docs/obs/umn/obs_03_0046.html +++ b/docs/obs/umn/obs_03_0046.html @@ -8,11 +8,11 @@Managing OBS Resource Permissions
Access to OBS buckets and objects can be controlled by IAM user permissions, bucket policies, and ACLs.
+OBS Resource Permissions Management
Access to OBS buckets and objects can be controlled by IAM user permissions, bucket policies, and ACLs.
For more information, see Overview.
The temporary authentication information contains the AccessKeyId, Expires, x-obs-security-token, and Signature parameters. AccessKeyId, x-obs-security-token, and Signature are used for authentication. The Expires parameter specifies the validity period of the authentication.
After an object is shared on OBS Console, the system will generate a URL that contains the temporary authentication information, valid for five minutes since its generation by default. Each time you change the validity period of a URL, OBS obtains the authentication information again to generate a new URL for sharing, which takes effect since the time when the validity period is changed.
Limitations and Constraints
- An object shared from OBS Console can be valid for one minute to 18 hours. If you need a longer validity period for a shared object, use the client tool OBS Browser+ that supports a validity period from one minute to 30 days. Or, you can configure a bucket policy or object policy to grant the access permissions of an object to other users permanently.
- Only buckets of version 3.0 support file sharing. You can view the bucket version in the Basic Information area on the Overview page of a bucket.
- Encrypted objects cannot be shared.
- To share a cold object, restore it first.
Limitations and Constraints
- An object shared from OBS Console can be valid for one minute to 18 hours. If you need a longer validity period, use OBS Browser+ that allows a validity period from one minute to 30 days. Or, you can configure a bucket policy or object policy to grant other users access to the object permanently.
- Only buckets of version 3.0 support object sharing. You can view the bucket version in the Basic Information area on the Overview page of a bucket.
- Encrypted objects cannot be shared.
- To share a cold object, restore it first.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Locate the file to be shared and click Share in the Operation column.
Once the Share File dialog box is opened, the URL is effective and valid for five minutes by default. If you change the validity period, the authentication information in the URL changes accordingly, and the URL's new validity period starts upon the change.
Figure 1 Sharing a file-
- Operate the URL as follows:
- Click Open URL to preview the file on a new page or directly download it to your default download path.
- Click Copy Link to share the link to others for them to access this file using a browser.
- Click Copy Path to share the file path to users who have access permissions to the bucket. The users then can search for the file by pasting the shared path to the search box of the bucket.
- Operate the URL as follows:
- Click Open URL to preview the file on a new page or directly download it to your default download path.
- Click Copy Link to share the link to others for them to access this file using a browser.
- Click Copy Path to share the file path to users who have access to the bucket. The users then can search for the file by pasting the shared path to the search box of the bucket.
Within the URL validity period, anyone who has the URL can access the file.
diff --git a/docs/obs/umn/obs_03_0049.html b/docs/obs/umn/obs_03_0049.html index d50c5a960..47cdac307 100644 --- a/docs/obs/umn/obs_03_0049.html +++ b/docs/obs/umn/obs_03_0049.html @@ -1,8 +1,8 @@-Parent topic: Permission Control+Parent topic: Permissions ControlPrincipals
-The principals indicate the users which the bucket policies apply to. These users can be accounts, federated users or federated user groups, and IAM users. Target users can be specified in either of the following ways:
-- Include: The policy takes effect on specified users.
- Exclude: The policy takes effect on all users except the specified ones.
The principals indicate the users bucket policies apply to. These users can be accounts, federated users or federated user groups, and IAM users. Target users can be specified in either of the following ways:
+- Include: The policy applies to specified users.
- Exclude: The policy applies to users except the specified ones.
Cloud Service User
- IAM users in the current account
With Principal set to Current account, you can select one or more IAM users under this account, so the bucket policy applies to the selected IAM users.
- Other account
When the Principal is set to Other account, you can enter the ID of other accounts. If you want to apply the bucket policy to IAM users under that account, you need to enter the user IDs, and use commas (,) to separate one from another.
An authorized user can go to the My Credential page to obtain the domain ID and user ID after login.
diff --git a/docs/obs/umn/obs_03_0051.html b/docs/obs/umn/obs_03_0051.html index 6fdf0d761..43a78d044 100644 --- a/docs/obs/umn/obs_03_0051.html +++ b/docs/obs/umn/obs_03_0051.html @@ -3,7 +3,7 @@Actions
Actions are related to resources. When the resource is the current bucket, bucket-related actions should be configured in a bucket policy. When objects are specified as resources, object-related actions should be configured in a bucket policy.
Actions can be specified in either of the following ways:
-- Include: The policy takes effect on specified actions.
- Exclude: The policy takes effect on all actions except the specified ones.
- Include: The bucket policy applies to specified actions.
- Exclude: The bucket policy applies to actions except the specified ones.
diff --git a/docs/obs/umn/obs_03_0075.html b/docs/obs/umn/obs_03_0075.html index aba22a04f..021578247 100644 --- a/docs/obs/umn/obs_03_0075.html +++ b/docs/obs/umn/obs_03_0075.html @@ -21,7 +21,7 @@Actions Related to Buckets
diff --git a/docs/obs/umn/obs_03_0074.html b/docs/obs/umn/obs_03_0074.html index cdc536417..792afd7ec 100644 --- a/docs/obs/umn/obs_03_0074.html +++ b/docs/obs/umn/obs_03_0074.html @@ -17,7 +17,7 @@Table 1 Actions related to buckets Type
Allow you to manage objects, including uploads, multipart uploads, downloads, storage class change, restore of Cold objects, and deletion.
+Allow you to manage objects, including uploading (multipart uploads included), downloading, and deleting objects, as well as changing object storage classes and restoring Cold objects.
Encrypts data on servers to enhance security of data stored on OBS.
+Encrypts objects on the server side to enhance security of objects stored on OBS.
@@ -62,7 +62,7 @@ Controls OBS access permissions through IAM policies, bucket/object policies, and bucket/object access control lists (ACLs).
+Controls access to OBS using IAM policies, bucket/object policies, and bucket/object access control lists (ACLs).
@@ -72,33 +72,33 @@ Implements object replication across regions under the same account. By configuring cross-region replication rules, you can enable OBS to automatically and asynchronously copy data from a source bucket to a destination bucket in another region.
-Therefore, cross-region replication provides the capability for data disaster recovery across regions, catering to your needs for off-site data backup.
+Implements object replication across regions under the same account. A cross-region replication rule enables OBS to automatically, asynchronously copy data from a source bucket in one region to a destination bucket in a different region.
+This provides disaster recovery across regions, catering to your needs for remote backup.
Identifies and classifies buckets in OBS.
+Help you identify and classify buckets in OBS.
Supports the hosting of static website content in buckets, and supports redirection of bucket access requests to specific hosts.
+Supports the hosting of static websites in buckets and the redirection of access requests for buckets.
Binds your website domain names to bucket domain names. This function applies to the following scenario: migrating files from a website to OBS without modifying the code of the web page, and keeping the link of the website unchanged.
+Enables you to bind your website domain name to a bucket domain name. If you want to migrate files from your website to OBS while keeping the website address unchanged, you can use this function.
Provides URL validation to prevent object links of OBS from being stolen by other websites.
+Prevents object links in OBS from being stolen by other websites.
Allows a web client in one origin to interact with resources in another one. CORS is a browser-standard mechanism defined by the World Wide Web Consortium (W3C). For general web page requests, website scripts and contents in one origin cannot interact with those in another because of Same Origin Policies (SOPs).
+Allows a web client in one origin to interact with resources in another one. Cross origin resource sharing (CORS) is a browser-standard mechanism defined by the World Wide Web Consortium (W3C). For general web page requests, website scripts and contents in one origin cannot interact with those in another because of Same Origin Policies (SOPs).
@@ -106,6 +106,11 @@ Lets the requester pay for data transfer and API calls associated with accessing resources in the bucket and you (the bucket owner) pay for only data storage in the bucket.
+ +Periodically provides CSV files that list object information in the bucket and delivers the CSV files to the specified bucket.
+-Parent topic: Permission Control+Parent topic: Permissions ControlIndicates the user that the object policy applies to.
-- Include: The policy takes effect on specified users.
- Exclude: The policy takes effect on all users except the specified ones.
- Include: The policy applies to specified users.
- Exclude: The policy applies to users except the specified ones.
Resources
@@ -29,7 +29,7 @@Include or Exclude
Resources on which the object policy takes effect.
-- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
- Include: The bucket policy applies to specified OBS resources.
- Exclude: The bucket policy applies to OBS resources except the specified ones.
Specifies users on whom this object policy takes effect, including cloud service users and federated users. A cloud service user is the one who accesses the cloud services through registration with the cloud services. A federated user is the one who accesses the cloud services through federated identity authentication.
-- Include: The policy takes effect on specified users.
- Exclude: The policy takes effect on all users except the specified ones.
- Include: The policy applies to specified users.
- Exclude: The policy applies to users except the specified ones.
Resources
@@ -67,7 +67,7 @@- Include or Exclude
Resources on which the object policy takes effect.
-- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
- Include: The bucket policy applies to specified OBS resources.
- Exclude: The bucket policy applies to OBS resources except the specified ones.
Actions
@@ -75,7 +75,7 @@- Include or Exclude
- For details about the actions, see Actions Related to Objects.
Operation stated in the object policy.
-- Include: The policy takes effect on specified actions.
- Exclude: The policy takes effect on all actions except the specified ones.
- Include: The bucket policy applies to specified actions.
- Exclude: The bucket policy applies to actions except the specified ones.
Conditions
@@ -88,13 +88,13 @@ - Deleting a file or folder: The file or folder is not permanently deleted, but is retained in the Deleted Objects list and marked with the Delete Marker. In Deleted Objects, click the object name. On the Versions tab, you can see that the latest object version has the delete marker.
- Click OK.
After the object policy is configured successfully, it is displayed in the list under Custom Bucket Policies.
+ - Click OK.
After the object policy is configured successfully, it is displayed in the list under Custom Bucket Policies in the Bucket Policies tab on the Permissions page.
diff --git a/docs/obs/umn/obs_03_0080.html b/docs/obs/umn/obs_03_0080.html index b903c7176..a9f921c26 100644 --- a/docs/obs/umn/obs_03_0080.html +++ b/docs/obs/umn/obs_03_0080.html @@ -1,9 +1,9 @@ --Parent topic: Permission Control+Parent topic: Permissions ControlGranting an IAM User with the Operation Permissions for a Specified Bucket
+Granting an IAM User Permissions to Operate a Specific Bucket
Create an IAM user under in an account. The IAM user has no permission to any resource before it is added to any user group. The bucket owner (root account) or other accounts and IAM users, who have the permission to set bucket policies, can configure bucket policies to grant the bucket operation permissions to IAM users.
The following is an example about how to grant an IAM user the bucket access and object upload permissions.
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters listed in the table below to grant an IAM user the permission to access the bucket (listing objects in the bucket).
+
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters listed in the table below to grant an IAM user the permission to access the bucket (to list objects in the bucket).-
Table 1 Parameters for granting permission to access a bucket Parameter
Value
@@ -38,7 +38,7 @@ - Click OK.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters in the table below to grant an IAM user the permission to upload objects to a bucket.
Before authorizing the IAM user with the permission to operate objects, ensure that the user has the permission to access the bucket.
+- Click OK.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters in the table below to grant an IAM user the permission to upload objects to a bucket.
Before granting this permission to a user, ensure that the user has the permission to access the bucket.
Table 2 Parameters for granting permission to upload objects Parameter
@@ -70,7 +70,7 @@Actions
- Include
- PutObject
NOTE:In this example, only the permission to upload objects is granted. You can select multiple actions and granting other operation permissions to the IAM user The asterisk (*) indicates all operations.
+NOTE:In this example, only the permission to upload objects is granted. You can also select other object actions to grant corresponding permissions if needed. The asterisk (*) indicates all actions.
For details about the supported actions, see Actions.
Granting Other Accounts with the Operation Permissions for a Specified Bucket
+Granting Other Accounts Permissions to Operate a Specific Bucket
The bucket owner (root account) or other accounts and IAM users, who have the permission to set bucket policies, can configure bucket policies to grant the bucket operation permissions to other accounts or IAM users under other accounts.
-The following is an example about how to authorize other accounts with the bucket access and object upload permissions.
- To grant permissions to IAM users under other accounts, you need to configure a bucket policy and also IAM policies.
-- Configure a bucket policy to allow IAM users to access the bucket.
- Configure IAM policies for the account to which the authorized IAM user belongs, to allow the IAM user to access the bucket.
The following is an example about how to grant other accounts bucket access and object upload permissions.
+- To grant permissions to IAM users under other accounts, you need to configure both bucket policies and IAM policies.
+- Configure a bucket policy to allow IAM users to access the bucket.
- Configure IAM policies for the account where authorized IAM users belong, to allow the IAM users to access the bucket.
Only permissions that are allowed by both the bucket policy and IAM policies can take effect.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Set the following parameters to authorize another account with the permission to access the bucket:
-
Table 1 Parameters for granting permission to access a bucket Parameter
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure the parameters listed in the table below to grant other accounts bucket access permission.
+
-Table 1 Parameters for granting bucket access permission Parameter
Value
- Click OK.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Set the following parameters to authorize another account with the permission to upload objects:
Before authorizing the user with the permission to operate objects, ensure that the user has the permission to access the bucket.
+- Click OK.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure the parameters listed in the table below to grant other accounts the object upload permission:
Before granting this permission to a user, ensure that the user has the permission to access the bucket.
Table 2 Parameters for granting permission to upload objects Parameter
diff --git a/docs/obs/umn/obs_03_0082.html b/docs/obs/umn/obs_03_0082.html new file mode 100644 index 000000000..5dcfeb04a --- /dev/null +++ b/docs/obs/umn/obs_03_0082.html @@ -0,0 +1,17 @@ + + +Bucket Inventories
+ ++ + ++ diff --git a/docs/obs/umn/obs_03_0083.html b/docs/obs/umn/obs_03_0083.html new file mode 100644 index 000000000..5415af2ec --- /dev/null +++ b/docs/obs/umn/obs_03_0083.html @@ -0,0 +1,16 @@ + + +++Parent topic: OBS Console Operation Guide+Bucket Inventory Overview
++The bucket inventory function periodically generates lists of metadata information of objects in a bucket. Inventories help you better understand object statuses in the bucket.
+An inventory is a CSV file. Inventory files are automatically uploaded to the specified bucket.
+You specify that inventories are generated for objects with the same object name prefix. You can also determine the inventory generation interval and whether to list all object versions in the inventory file. The object metadata you specify in the inventory include the file size, last modification time, storage class, ETag, multipart upload, encryption status, and replication status.
++Limitations and Constraints
- A bucket can have a maximum of 10 inventory rules.
- The source bucket (for which a bucket inventory rule is configured) and the target bucket (where the generated inventory files are stored) must belong to the same account.
- The source bucket and the target bucket must be in the same region.
- Inventory files must be in the CSV format.
- OBS can generate inventory files for all objects in a bucket or a group of objects whose names begin with the same prefix.
- If a bucket has multiple inventory rules, overlaps between the inventory rules are not allowed.
- If a bucket already has an inventory rule for the entire bucket, new inventory rules that filter objects by prefixes cannot be created. If you need an inventory rule that covers only a subset of objects in the bucket, delete the inventory rule configured for the entire bucket.
- If an inventory rule that filters objects by a specified prefix already exists, you cannot create an inventory rule for the entire bucket. To create an inventory rule for the entire bucket, make sure that the bucket has no other inventory rules that filter objects by specified prefixes.
- If a bucket already has an inventory rule that filters objects by the object name prefix ab, the filter of a new inventory rule cannot start with a or ab. Or, you can delete the existing inventory rule and create a new one that filters objects according to your needs.
- Bucket inventory files can be encrypted only in the SSE-KMS mode.
- Default encryption cannot be enabled for the target bucket configured for storing inventory files.
++ diff --git a/docs/obs/umn/obs_03_0084.html b/docs/obs/umn/obs_03_0084.html new file mode 100644 index 000000000..bd157b4dd --- /dev/null +++ b/docs/obs/umn/obs_03_0084.html @@ -0,0 +1,88 @@ + + +++Parent topic: Bucket Inventories+Configuring a Bucket Inventory
+++Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, click Inventories. The inventory list is displayed.
- Click Create. The Create Inventory dialog box is displayed.
- Configure required parameters.
+
+
+Table 1 Parameters for configuring a bucket inventory Parameter
+Description
+Inventory Name
+Name of a bucket inventory
+Filter
+Filter of an inventory. You can enter an object name prefix for OBS to create an inventory for objects with the specified prefix.
+Currently, only a prefix can be used as a filter. If the filter is not specified, the inventory covers all objects in the bucket.
+If a bucket has multiple inventories, their filters cannot overlap with each other.
+Save Inventory Files To
+Select a bucket (destination bucket) for saving generated inventory files. This bucket must be in the same region as the source bucket.
+Inventory File Name Prefix
+Prefix of the inventory file path.
+An inventory file will be saved in the following path: Inventory file name prefix/Source bucket name/Inventory name/Date and time/files/.
+If this parameter is not specified, OBS automatically adds BucketInventory as the prefix to inventory file's path.
+Frequency
+How frequently inventory files are generated. It can be set to Daily or Weekly.
+Status
+Inventory status. You can enable or disable the generation of inventories.
+ - Click Next to go to the Configure Report page.
- Configure the report.
+
+
+Table 2 Report related parameters Parameter
+Description
+Inventory Format
+Inventory files can only be saved in CSV format.
+Object Versions
+Object versions that you want to list in an inventory file. It can be set to Current version only or Include all versions.
+Optional Fields
+Object information fields that can be contained in an inventory file, including Size, Last modified date, Storage class, ETag, Multipart upload, Encryption status, and Replication status.
+Send Notification
+If there is a new inventory file generated, a notification will be sent to the email address or mobile number specified in the SMN topic.
+If you enable the notification function, an SMN event notification rule will be created in the bucket where inventory files are stored. You can view details about the rule on the Event Notification page of the bucket. If you disable the notification function or modify the SMN topic, the SMN event notification rule will also be deleted or modified.
+ - Click Next to confirm the bucket policy.
OBS then automatically creates a bucket policy on the destination bucket to grant OBS permission to write inventory files to the bucket.
+ - Click OK.
++ diff --git a/docs/obs/umn/obs_03_0086.html b/docs/obs/umn/obs_03_0086.html index 821c8f1df..4d6b16e2b 100644 --- a/docs/obs/umn/obs_03_0086.html +++ b/docs/obs/umn/obs_03_0086.html @@ -1,6 +1,6 @@ -++Parent topic: Bucket Inventories+Permission Control
+Permissions Control
-
diff --git a/docs/obs/umn/obs_03_0088.html b/docs/obs/umn/obs_03_0088.html
index 2e13b15fe..7c30101e1 100644
--- a/docs/obs/umn/obs_03_0088.html
+++ b/docs/obs/umn/obs_03_0088.html
@@ -1,13 +1,13 @@
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the right Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
- Select Enable.
Key obs/default is selected by default for KMS encryption. You can also click Create KMS Key to switch to the KMS management console and create a customer master key. Then go back to OBS Console and select the key from the drop-down list.
+OBS allows you to configure default encryption for a bucket. After the default encryption is enabled for the bucket, objects uploaded to this bucket are automatically encrypted using the specified KMS key, making data storage more secure.
+You can enable default encryption when creating a bucket (see Creating a Bucket), or enable or disable default encryption after the bucket is created.
+OBS only encrypts the objects uploaded after the default encryption is enabled for the bucket, and does not encrypt those uploaded before. After you disable a bucket's default encryption, the encryption status of existing objects keeps unchanged, and you can separately encrypt objects when uploading them to the bucket.
+-Enabling Default Encryption for a Bucket
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
- Select Enable.
Key obs/default is selected by default for KMS encryption. You can also click Create KMS Key to switch to the KMS management console and create a customer master key. Then go back to OBS Console and select the key from the drop-down list.
- Click OK.
Disabling Default Encryption for a Bucket
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the right Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
- Select Disable.
- Click OK.
Disabling Default Encryption for a Bucket
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the Basic Configurations area, click Default Encryption. The Default Encryption dialog box is displayed.
- Select Disable.
- Click OK.
diff --git a/docs/obs/umn/obs_03_0096.html b/docs/obs/umn/obs_03_0096.html index ff49efb74..f1ad61d83 100644 --- a/docs/obs/umn/obs_03_0096.html +++ b/docs/obs/umn/obs_03_0096.html @@ -1,7 +1,7 @@ -Authorizing Folder Access Permissions to Anonymous Users
-If all objects in a folder need to be accessible to anonymous users, you can configure a bucket policy or an object policy to grant anonymous users the permission to access the folder. In this example, a bucket policy is used. If you want to use an object policy to authorize the permission, select the target folder and configure the object policy directly. Parameters are the same as those in the bucket policy.
+Granting Anonymous Users Permission to Access Folders
+If all objects in a folder need to be accessible to anonymous users, you can configure a bucket policy or an object policy to grant anonymous users the permission to access the folder. In this example, a bucket policy is used. If you want to use an object policy to grant permission, select the target folder and configure an object policy. Parameters in both types of policies are the same.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters according to the following table, so that you can grant anonymous users the permission to access the folder and objects in it:
Table 1 Parameters for granting permission to access a bucket Parameter
- Click OK.
-Verification
- After the permission is successfully configured, select an object in the folder and click the object name to view its details. The object link (URL) is displayed on the details page. Share the URL over the Internet, so that all users can access or download the object through the Internet.
- An anonymous user can use the URL to access the object in a browser.
Verification
- After the permission is successfully configured, select an object in the folder and click the object name to view its details. The object link (URL) is displayed on the details page. Share the URL over the Internet, so that all users can access or download the object through the Internet.
- Use the URL to access the object in a browser. An anonymous user can access the object.
diff --git a/docs/obs/umn/obs_03_0100.html b/docs/obs/umn/obs_03_0100.html index c98899a7c..1585dcd06 100644 --- a/docs/obs/umn/obs_03_0100.html +++ b/docs/obs/umn/obs_03_0100.html @@ -1,6 +1,6 @@ -diff --git a/docs/obs/umn/obs_03_0110.html b/docs/obs/umn/obs_03_0110.html index c4facce20..c8b46d5f4 100644 --- a/docs/obs/umn/obs_03_0110.html +++ b/docs/obs/umn/obs_03_0110.html @@ -5,7 +5,7 @@What Are Factors that Affect the Upload and Download Speed of OBS?
+What Are the Factors That Affect Upload and Download Speed of OBS?
diff --git a/docs/obs/umn/obs_03_0109.html b/docs/obs/umn/obs_03_0109.html index 09b2ca031..425c3c27c 100644 --- a/docs/obs/umn/obs_03_0109.html +++ b/docs/obs/umn/obs_03_0109.html @@ -17,7 +17,7 @@The OBS upload and download speed may be affected by:
- Upper limit of the read/write bandwidth allowed by a single account
- Disk I/O, NICs, and resources consumed by other processes
-Parent topic: Permission Control+Parent topic: Permissions ControlIAM policies define the actions that can be performed on your cloud resources. In other words, IAM policies specify what actions are allowed or denied.
IAM policies with OBS permissions take effect on all OBS buckets and objects. To grant an IAM user the permission to operate OBS resources, you need to assign one or more OBS permission sets to the user group to which the user belongs.
For details about OBS permissions controlled by IAM policies, see Permissions Management.
-IAM policies Application Scenarios
IAM policies are used to authorize IAM users under an account.
+IAM policies Application Scenarios
IAM policies are used to authorize IAM users under an account.
- Controlling permissions to cloud resources as a whole under an account
- Controlling permissions to all OBS buckets and objects under an account
Policy Structure and Syntax
A policy consists of a version and statements. Each policy can have multiple statements.
@@ -40,21 +40,21 @@ ] } -Table 1 Policy syntax parameters Parameter
+Table 1 Policy syntax parameters Parameter
Description
+Description
Version
+Version
The version number of a policy.- 1.0: RBAC policies. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.
- 1.1: Fine-grained policies. A fine-grained policy consists of API-based permissions for operations on specific resource types. Fine-grained policies, as the name suggests, allow for more fine-grained control than RBAC policies. Users with such fine-grained permissions can only perform authorized operations on specific services.
The version number of a policy.- 1.0: RBAC policies. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.
- 1.1: Fine-grained policies. A fine-grained policy consists of API-based permissions for operations on specific resource types. Fine-grained policies, as the name suggests, allow for more fine-grained control than RBAC policies. Users with such fine-grained permissions can only perform authorized operations on specific services.
Statement
+Statement
Permissions defined by a policy, including Effect and Action.
+Permissions defined by a policy, including Effect and Action.
- Effect
The valid values for Effect are Allow and Deny. System policies contain only Allow statements. For custom policies containing both Allow and Deny statements, the Deny statements take precedence.
- Action
Permissions of specific operations on resources in the format of Service name:Resource type:Operation. A policy can contain one or more permissions. The wildcard (*) is allowed to indicate all of the services, resource types, or operations depending on its location in the action. OBS has two resource types: bucket and object.
Authentication of IAM policies
The authentication of IAM policies starts from the Deny statements. The following figure shows the authentication logic for resource access.
Figure 2 Authentication logic-
diff --git a/docs/obs/umn/obs_03_0114.html b/docs/obs/umn/obs_03_0114.html index d9f71a073..2f5c6c4da 100644 --- a/docs/obs/umn/obs_03_0114.html +++ b/docs/obs/umn/obs_03_0114.html @@ -1,7 +1,7 @@The actions in each policy bear the OR relationship.
+ The actions in each policy are in the OR relationship.
- A user accesses the system and makes an operation request.
- The system evaluates all the permission policies assigned to the user.
- In these policies, the system looks for explicit deny permissions. If the system finds an explicit deny that applies, it returns a decision of Deny, and the authentication ends.
- If no explicit deny is found, the system looks for allow permissions that would apply to the request. If the system finds an explicit allow permission that applies, it returns a decision of Allow, and the authentication ends.
- If no explicit allow permission is found, IAM returns a decision of Deny, and the authentication ends.
How Does Authorization Work When Multiple Access Control Mechanisms Co-Exist?
-Based on the least-privilege principle, decisions default to deny, and an explicit deny statement always takes precedence over an allow statement. For example, IAM policies grant a user the access to an object, a bucket policy denies the user's access to that object, and there is no ACL. Then access will be denied.
+Based on the principle of least privilege, the default access control result is always deny, and an explicit deny statement always take precedence over an allow statement. Suppose that IAM policies grant a user the access to an object, a bucket policy denies the user's access to that object, and there is no ACL. Then user's access to the object will be denied.
If no method specifies an allow statement, then the request will be denied by default. Only if no method specifies a deny statement and one or more methods specify an allow statement, will the request be allowed. For example, if a bucket has multiple bucket policies with allow statements, the adding of a new bucket policy with an allow statement will simply add the allowed permissions to the bucket, but the adding of a new bucket policy with a deny statement will result in a re-arrangement of the permissions. The deny statement will take precedence over allowed statements, even the denied permissions are allowed in other bucket policies.
Figure 1 Authorization process
Figure 2 is a matrix of the IAM policies, bucket policies, and ACLs (allow and deny effects).
diff --git a/docs/obs/umn/obs_03_0115.html b/docs/obs/umn/obs_03_0115.html index d9e48f0e8..526103153 100644 --- a/docs/obs/umn/obs_03_0115.html +++ b/docs/obs/umn/obs_03_0115.html @@ -1,11 +1,11 @@Effect
-A bucket policy can either allow or deny the access requests that match the configuration.
+A bucket policy can either allow or deny requests.
- Allow: The policy allows the matched requests.
- Deny: The policy denies the matched requests.
When a bucket policy contains both the allow and deny effects, the deny effect prevails. The following figure shows the judgment process.
Figure 1 Determining a bucket policy when the allow and deny statements conflict-
- A user initiates an access request.
- OBS preferentially searches for deny (explicit deny) effects from bucket policies. If a deny statement is found, OBS directly rejects the access. The access request ends.
- If there is no deny statement, OBS searches for allow statements.
- If an allow statement is found, OBS allows the access.
- If no allow statement is found, OBS rejects the access. The access request ends.
- A user initiates an access request.
- OBS preferentially searches for bucket policies that have the deny (explicit deny) effect. If a deny statement is found, OBS directly rejects the access. The access request ends.
- If there is no deny statement, OBS searches for allow statements.
- If an allow statement is found, OBS allows the access.
- If no allow statement is found, OBS rejects the access. The access request ends.
- If an error occurs during the judgment, an error message is generated and returned to the user who initiates the access request.
diff --git a/docs/obs/umn/obs_03_0118.html b/docs/obs/umn/obs_03_0118.html index 8e1ec2044..c9b7e8a9f 100644 --- a/docs/obs/umn/obs_03_0118.html +++ b/docs/obs/umn/obs_03_0118.html @@ -1,13 +1,13 @@Resources
-The resource can be the current entire bucket, an object, or a set of objects in the bucket.
+The resources a bucket policy is applied to can be the current entire bucket or objects in the bucket.
Resources can be specified in either of the following ways:
-- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
Specifying Bucket Resources
To specify the current bucket as the resource, keep the resource text box empty. When configuring actions for the policy, select bucket related actions.
+- Include: The bucket policy applies to specified OBS resources.
- Exclude: The bucket policy applies to OBS resources except the specified ones.
-Applying a Bucket Policy to a Bucket
To specify the current bucket as the resource, keep the resource text box empty. When configuring actions for the policy, select bucket related actions.
Specifying Object Resources
When objects in the bucket are specified as the resources, actions configured in the bucket policy must be object related actions. The following are examples of how to specify objects as resources.
-- For an object, enter the object name (including its folder name if any). For example, if the specified resource is the example.jpg file in the imgs-folder folder in the bucket, enter the following content in the resource text box:
imgs-folder/example.jpg
+Applying a Bucket Policy to Specified Objects
To apply the bucket policy to specified objects in a bucket, object-related actions must be configured in the policy. The configuration format is as follows:
+- For an object, enter the object name (including its folder name if any). If you want to specify the example.jpg file in the imgs-folder folder in the bucket, enter the following content in the resource text box:
imgs-folder/example.jpg
- For an object set, the wildcard asterisk (*) should be used. The asterisk * indicates an empty string or any combination of multiple characters. The format rules are as follows:
- Use only one asterisk (*) to indicate all objects in a bucket.
- Use Object name prefix* to indicate objects starting with this prefix in a bucket. For example,
imgs*
- Use *Object name suffix to indicate objects ending with this suffix in a bucket. For example,
*.jpg
diff --git a/docs/obs/umn/obs_03_0120.html b/docs/obs/umn/obs_03_0120.html index e2017dc22..a00cf233b 100644 --- a/docs/obs/umn/obs_03_0120.html +++ b/docs/obs/umn/obs_03_0120.html @@ -1,7 +1,7 @@Conditions
-In addition to the effect, principal, resources, and actions, you can also specify the conditions under which the bucket policy takes effect. A bucket policy takes effect only when its condition expressions match values contained in the request. Conditions is an optional parameter. You can determine whether to use this parameter based on service requirements.
+In addition to effect, principals, resources, and actions, you can specify conditions for a bucket policy. A bucket policy takes effect only when its condition expressions match values contained in the request. Conditions is an optional parameter. You can determine whether to use this parameter based on service requirements.
For example, if account A needs to be granted with full control permissions for an object uploaded by account B in bucket example, you can specify that the upload request must contain the acl key and set the policy effect to Allow for account A. The complete condition expression is as follows:
Condition Operator
@@ -218,38 +218,28 @@ListBucket
+ListBucket
prefix
Type: String. Lists objects that begin with the specified prefix.
If prefix, delimiter, and max-keys are configured, the key-value pair meeting the conditions must be specified in the List operation for the bucket policy to take effect.
+If prefix, delimiter, and max-keys are configured, the key-value pair meeting the conditions must be specified in the List operation for the bucket policy to take effect.
For example, if a bucket policy (with the conditional operator set to NumericEquals, the key to max-keys, and the value to 100) that allows anonymous users to read data is configured for a bucket, the anonymous users must add ?max-keys=100 to the end of the bucket domain name for listing objects. The listed objects are the first 100 objects in alphabetic order.
delimiter
-Type: String. Groups objects in a bucket.
-max-keys
Type: Numeric. Sets the maximum number of objects. Returned objects are listed in alphabetic order.
ListBucketVersions
+ListBucketVersions
prefix
Type: String. Lists multi-version objects whose name starts with the specified prefix.
delimiter
-Type: String. String used to group multi-version objects in a bucket
-max-keys
Type: Numeric. Sets the maximum number of objects. Returned objects are listed in alphabetic order.
@@ -288,7 +278,7 @@Type: String. Specifies names of the source bucket and the source object. Format: /bucketname/keyname
metadatadirective
+metadata-directive
Type: String. Specifies whether to copy the metadata from the source object or replace with the metadata in the request. Values: COPY|REPLACE
Configuring Fine-Grained Policies
Custom policies can be created to supplement the system-defined policies of OBS.
For details, see Creating a Custom Policy. The following provides examples of common OBS custom policies.
-Example Custom Policies
- Example 1: Grant all OBS permissions to users.This policy allows users to perform any operation on OBS.
{ +-Example Custom Policies
- Example 1: Grant users all OBS permissions. -
- Example 2: Grant all OBS Console permissions to users.
This policy allows users to perform all operations on OBS Console.
+ - Example 2: Grant users all OBS Console permissions.
This policy allows users to perform all operations on OBS Console.
When a user logs in to OBS Console, the user may access resources of other services such as audit information in CTS. Therefore, in addition to the OBS permissions in example 1, you also need to configure the access permissions to other services. You need to configure the Tenant Guest permission for the global project and regional projects based on the services and regions that you use.-{ "Version": "1.1", "Statement": [ @@ -28,7 +28,7 @@ ] } - Example 3: Grant the read-only permission on a bucket to users (any directory).This policy allows users to list and download all objects in bucket obs-example.
{ +- Example 3: Grant users the read-only permission for all directories in a bucket. -
- Example 4: Grant the read-only permission on a bucket to users (specified directory).
This policy allows users to download objects in only the my-project/ directory of bucket obs-example. Objects in other directories can be listed but cannot be downloaded.{ +- Example 4: Grant users the read-only permission for a specified directory in a bucket. -
- Example 5: Grant the read and write permissions on a bucket to users (specified directory).
This policy allows users to list, download, upload, and delete objects in the my-project directory of bucket obs-example.diff --git a/docs/obs/umn/obs_03_0122.html b/docs/obs/umn/obs_03_0122.html index 4dca8a4de..78962560f 100644 --- a/docs/obs/umn/obs_03_0122.html +++ b/docs/obs/umn/obs_03_0122.html @@ -9,39 +9,7 @@{ +- Example 5: Grant users the read/write permissions for a specified directory in a bucket. -
- Example 6: Grant all permissions on a bucket to users.
This policy allows users to perform any operation on bucket obs-example.{ +- Example 6: Grant users all permissions for a bucket. -
- Example 7: Deny permissions to users to upload objects.
A deny policy must be used together with other policies. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
+- Example 7: Grant users the permission to deny object upload.
A deny policy must be used together with other policies. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
If you grant the system policy OBS OperateAccess to a user but do not want the user to have the object upload permission (which is also a permission allowed by OBS OperateAccess), you can create a custom policy besides the OBS OperateAccess policy, to deny the user's upload permission. According to the authorization principle, the policy with the deny statement takes precedence, so that the user can perform all operations allowed by OBS OperateAccess, except uploading objects. The following is an example of a deny policy:
-{ - "Version": "1.1", - "Statement": [ - { - "Effect": "Deny", - "Action": [ - "obs:object:PutObject" - ], - } - ] - }+{ + "Version": "1.1", + "Statement": [ + { + "Effect": "Deny", + "Action": [ + "obs:object:PutObject" + ] + } + ] +}
- Create a user.
- In the navigation pane, choose Users. The Users page is displayed.
- Click Create User.
- Set user information and click Next.
--
-Table 1 User parameters Parameter
-Description
-Username
-The user name for logging in to the cloud service.
-Credential Type
-- Password: Used for accessing cloud services using the console or development tools.
- Access key: Used for logging to the cloud service using development tools. This credential type is more secure, and is recommended if the user does not need to use the console.
User Groups
-You can add a user to one or more user groups. Then the user will inherit the permissions granted to these user groups. The default user group admin has the administrator permissions and all of the permissions required to use all cloud resources.
-Description
-(Optional) Brief description about the user.
- - Select a type for password generation, set the email address and mobile number, and click OK.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
+- Create an IAM user. For details, see section "Creating an IAM User" in the Identity and Access Management User Guide.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
diff --git a/docs/obs/umn/obs_03_0123.html b/docs/obs/umn/obs_03_0123.html index f8b507b5d..b6b70237e 100644 --- a/docs/obs/umn/obs_03_0123.html +++ b/docs/obs/umn/obs_03_0123.html @@ -8,31 +8,32 @@ Only one bucket policy mode can be configured at a time.
- For the read-only and read and write modes, enter information about the authorized user in the following format and click OK.
Figure 1 Parameter settings of a custom bucket policy in the read-only or read and write mode+ -
Table 1 Parameters in bucket policies Parameter
+Table 1 Parameters in bucket policies Parameter
Value
+Value
Description
+Description
Principal
+Principal
- Include or Exclude
- Cloud service user, Federated user
- If you select Federated user, you can specify the user to be an Identity provider or a User group.
- Include or Exclude
- Cloud service user, Federated user
- If you select Federated user, you can specify the user to be an Identity provider or a User group.
Specifies users on whom this bucket policy takes effect, including cloud service users and federated users. A cloud service user is the one who accesses the cloud services through registration with the cloud services. A federated user is the one who accesses the cloud services through federated identity authentication.
-- Include: The policy takes effect on specified users.
- Exclude: The policy takes effect on all users except the specified ones.
Specifies users on whom this bucket policy takes effect, including cloud service users and federated users. A cloud service user is the one who accesses the cloud services through registration with the cloud services. A federated user is the one who accesses the cloud services through federated identity authentication.
+- Include: The policy takes effect on specified users.
- Exclude: The policy takes effect on all users except the specified ones.
Resources
+Resources
- Include or Exclude
- Input format:
+
Indicates the resource that a bucket policy applies to. With the read-only mode and read and write mode, the policy can only apply to objects.
+Indicates the resource that a bucket policy applies to. With the read-only mode and read and write mode, the policy can only apply to objects.
- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
- For the customized mode, set parameters based on the site requirements and click OK.
Figure 2 Parameter settings of a custom bucket policy in the customized mode-
Table 2 lists the meaning of each parameter. -Table 2 Parameters in bucket policies Parameter
+Table 2 describes each parameter. +Table 2 Parameters for configuring a custom bucket policy Parameter
Value
Effect
Allow or Deny
+Allow or Deny
Effect of a bucket policy.
-- Allow: The policy allows the matched requests.
- Deny: The policy denies the matched requests.
- Allow: The policy allows the matched requests.
- Deny: The policy denies the matched requests.
Principal
@@ -68,30 +69,30 @@Resources
- Include or Exclude
- Resource input format:
-
Object set: Object name prefix*, *Object name suffix, or *
+Indicates the resource that a bucket policy applies to.
-- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
- Include: The policy takes effect on the specified OBS resources.
- Exclude: The policy takes effect on all OBS resources except the specified ones.
Relationship between resource types and actions:
- When a resource is an object or an object set, only the actions related to the object can be configured.
- When the resource is a bucket, only the actions related to the bucket can be configured.
Actions
- Include or Exclude
- For details, see Actions.
- Include or Exclude
- For details, see Actions.
Operations stated in the bucket policy.
-- Include: The policy takes effect on specified actions.
- Exclude: The policy takes effect on all actions except the specified ones.
- Include: The policy takes effect on specified actions.
- Exclude: The policy takes effect on all actions except the specified ones.
Conditions
+ Conditions for the policy statement to take effect.
+Conditions under which the bucket policy takes effect
diff --git a/docs/obs/umn/obs_03_0130.html b/docs/obs/umn/obs_03_0130.html index f1c27dd3f..34facd0e9 100644 --- a/docs/obs/umn/obs_03_0130.html +++ b/docs/obs/umn/obs_03_0130.html @@ -1,9 +1,9 @@ --
-
- Granting an IAM User with the Operation Permissions for a Specified Bucket
+ - Granting an IAM User Permissions to Operate a Specific Bucket
- - Granting Other Accounts with the Operation Permissions for a Specified Bucket
+ - Granting Other Accounts Permissions to Operate a Specific Bucket
- - Restricting Bucket Access to a Specified Address
+ - Restricting Access to a Bucket for Specific Addresses
- - Configuring the Start Time and End Time of Access to Objects in a Bucket
+ - Limiting the Time When Objects in a Bucket Are Accessible
- - Granting Object Access Permissions to Anonymous Users
+ - Granting Anonymous Users Permission to Access Objects
- - Authorizing Folder Access Permissions to Anonymous Users
+ - Granting Anonymous Users Permission to Access Folders
-Parent topic: Permission Control+Parent topic: Permissions ControlRestricting Bucket Access to a Specified Address
-You can configure a bucket policy to authorize a specified address the permission to access the bucket. This example shows how to deny a client access whose source IP address is within the range of 114.115.1.0/24.
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure the parameters according to the following table:
-
Table 1 Parameters for granting permission to access a bucket Parameter
+Restricting Access to a Bucket for Specific Addresses
+You can configure a bucket policy to restrict access to a bucket for specific addresses. This example describes how to deny access from clients whose IP address is in the range of 114.115.1.0/24 to a bucket.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters listed in the table below.
+
Table 1 Restricting access to a bucket for specific addresses Parameter
Value
Conditions
- Conditional Operator: IpAddress
- Key: SourceIP
- Value: 114.115.1.0/24
- Conditional Operator: IpAddress
- Key: SourceIP
- Value: 114.115.1.0/24
- Click OK.
-Verification
Initiate an access request from an IP address within the range of 114.115.1.0/24. The access is denied. Initiate an access request from an IP address outside the range of 114.115.1.0/24. The access is allowed.
+Verification
Initiate an access request from an IP address in the range of 114.115.1.0/24. The access is denied. Initiate an access request from an IP address beyond the range of 114.115.1.0/24. The access is allowed.
diff --git a/docs/obs/umn/obs_03_0131.html b/docs/obs/umn/obs_03_0131.html index 5da9ff9cf..ecdcc59bc 100644 --- a/docs/obs/umn/obs_03_0131.html +++ b/docs/obs/umn/obs_03_0131.html @@ -1,8 +1,8 @@ -Configuring the Start Time and End Time of Access to Objects in a Bucket
+Limiting the Time When Objects in a Bucket Are Accessible
You can configure the bucket policy to limit the time when objects in a bucket are accessible. In the following example, the access time window is from 2019-03-26T12:00:00Z to 2019-03-26T15:00:00Z.
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure the parameters according to the following table:
+
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- Choose Bucket Policies > Custom Bucket Policies.
- Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.
- Configure parameters listed in the table below.
Table 1 Parameters for granting permission to access a bucket Parameter
Value
@@ -27,14 +27,14 @@Resources
- Include
- Set the resource name to *, indicating all resources in the bucket.
NOTE:In this example, the policy configures permissions only for resources in the bucket. If you need to configure permissions for the entire bucket (for example, the permission to list objects in the bucket), you need to create another custom bucket policy for the entire bucket.
+NOTE:This example only grants permissions for resources in the bucket. If you also want to grant permission for the bucket (for example, the permission to list objects in the bucket), create another custom bucket policy.
Actions
- Include
- Select * as the action name, which indicates all action permissions.
NOTE:Selecting all action permissions may cause resources to be deleted. To avoid this risk, you are advised to set the action name to Get*, indicating all read permissions.
+NOTE:Selecting * may cause resources to be deleted. To avoid this risk, select Get* that indicates all read permissions.
Granting Object Access Permissions to Anonymous Users
+Granting Anonymous Users Permission to Access Objects
An enterprise stores a large volume of map data in OBS, and offers the data for public query. This enterprise sets a read permission for anonymous users, and provides the data URLs on the Internet. Then all users can read or download the data through the URLs.
-Procedure
- Log in to OBS Console and click Create Bucket to create a bucket.
- In the bucket list, click the name of the newly created bucket. On the page that is displayed, click Objects in the pane on the left, and upload the map data as an object to the new bucket.
- Click the object to be operated and click Object ACL.
- Under Object ACL > Public Permissions > Anonymous User, click Edit to set Access to Object to Read, as shown in Figure 1.
+
Procedure
- Log in to OBS Console and click Create Bucket to create a bucket.
- In the bucket list, click the name of the newly created bucket. On the displayed object management page, upload the map data to the new bucket. The map data is stored as an object.
- Click the object name. The object details page is displayed.
- Under Object ACL > Public Permissions, click Edit to grant the object read permission for anonymous users, as shown in Figure 1.
- Click Save to save the permission setting.
Verification
- Click the object. Its URL is displayed under Link. Share the URL over the Internet, so that all users can access or download the object through the Internet.
- An anonymous user can view the object by copying the URL of the object to the web browser.
Principal
- Include
- Other account: Enter the account ID. If you want to authorize the permissions all users, enter *.
NOTE:The account ID and user ID can be obtained on the My Credentials page of the account or user to be authorized. Account ID corresponds to Domain ID on the My Credential page. If you authorize the permission to only an account, you do not need to enter user IDs. If you want to authorize the permission to an IAM user, you need to enter the account ID and user ID. You can authorize the permission to multiple IAM users. Use commas (,) to separate the user IDs.
+- Include
- Other account: Enter the account ID. If you want to grant the permissions to all users, enter *.
NOTE:The account ID and user ID can be obtained on the My Credentials page of the account or user to be authorized. Account ID corresponds to Domain ID on the My Credential page. If you grant the permission to only an account, you do not need to enter user IDs. If you want to grant the permission to an IAM user, you need to enter the account ID and user ID. You can grant the permission to multiple IAM users. Use commas (,) to separate the user IDs.
Policy Mode
Customized
+Customized
Effect
Allow
+Allow
Principal
@@ -64,12 +64,12 @@Resources
- Include
- Resource name: *
- Include
- Resource name: *
Actions
- Include
- GetObject
- GetObjectVersion
- PutObject
- DeleteObject
- DeleteObjectVersion
- Include
- GetObject
- GetObjectVersion
- PutObject
- DeleteObject
- DeleteObjectVersion
Configuring a Custom Bucket Policy (Coding Mode)
You can configure a custom bucket policy by coding. The size of a custom bucket policy cannot exceed 20 KB.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Permissions.
- On the Bucket Policies tab page, configure a custom bucket policy according to your needs.
On the right of Custom Bucket Policies, select Coding mode to configure the policy in the coding mode.
- - The following is an example policy edited in JSON:
{ + - Edit the bucket policy. Below gives a bucket policy example in JSON:
{ "Statement":[ { "Action":[ @@ -30,7 +30,7 @@ ] }-Table 1 Parameter description Parameter
+-Table 1 Parameters for creating a bucket policy in JSON Parameter
Description
Principal
Authorized users on whom the bucket policy takes effect. You can obtain the user ID on the My Credential page by logging in to the console as the user to be authorized. Principal format:
-- "domain/account ID" (when the principal is an account)
- "domain/account ID:user/User ID" (when the principal is a user under an account)
NOTE:For Account ID, enter the Domain ID that can be found on the My Credential page.
+Users the bucket policy is applied to. You can obtain the user ID on the My Credentials page by logging in to the console as the user to be authorized. Principals should be configured as follows:
+- domain/Account ID (indicating that the principal is an account)
- domain/Account ID:user/User ID (indicating that the principal is a user under an account)
NOTE:Account ID is the Domain ID that you can find on the My Credentials page.
Resource
Resources on which the bucket policy takes effect. For details, see Resources.
+Resources the bucket policy is applied to. For details, see Resources.
- Click Save.
+- Click Save.
diff --git a/docs/obs/umn/obs_03_0144.html b/docs/obs/umn/obs_03_0144.html index f885798f1..b253be44f 100644 --- a/docs/obs/umn/obs_03_0144.html +++ b/docs/obs/umn/obs_03_0144.html @@ -11,7 +11,7 @@diff --git a/docs/obs/umn/obs_03_0150.html b/docs/obs/umn/obs_03_0150.html index 688a315e2..c1844b609 100644 --- a/docs/obs/umn/obs_03_0150.html +++ b/docs/obs/umn/obs_03_0150.html @@ -1,7 +1,7 @@-Parent topic: Permission Control+Parent topic: Permissions ControlParallel File System
-Parallel File System (PFS), a sub-product of OBS, is a high-performance file system, with access latency in milliseconds. PFS can support a bandwidth performance up to the TB/s level and supports millions of IOPS, which makes it ideal for processing high-performance computing (HPC) workloads.
+diff --git a/docs/obs/umn/obs_03_0201.html b/docs/obs/umn/obs_03_0201.html index 1ac485b31..412574b70 100644 --- a/docs/obs/umn/obs_03_0201.html +++ b/docs/obs/umn/obs_03_0201.html @@ -1,7 +1,7 @@Parallel File System (PFS) is a high-performance semantic file system provided by OBS. It features access latency in milliseconds, TB/s-level bandwidth, and millions of IOPS, which makes it ideal for processing high-performance computing (HPC) workloads.
For details about PFS, see the Parallel File System Feature Guide.
Advantages
-Comparison Between OBS and On-Premises Storage Servers
In this information era, it becomes increasingly difficult for conventional on-premises storage servers to deal with the fast growing data of enterprises. Table 1 compares OBS with on-premises storage servers.
+-Comparison Between OBS and On-Premises Storage Servers
In this information era, it becomes increasingly difficult for conventional on-premises storage servers to deal with the fast-growing data of enterprises. Table 1 compares OBS with on-premises storage servers.
Table 1 Comparison between OBS and on-premises storage servers Item
Security
OBS uses HTTPS and SSL protocols and encrypts data during uploads. To keep data transmission and access safe, OBS uses access key IDs (AKs) and secret access keys (SKs) to authenticate user identities and adopts IAM policies, bucket policies, access control lists (ACLs), and uniform resource locator (URL) validation.
+OBS uses HTTPS and SSL protocols and encrypts data during uploads. To keep data in transit and at rest safe, OBS uses access key IDs (AKs) and secret access keys (SKs) to authenticate user identities and adopts a range of approaches including IAM policies, bucket policies, access control lists (ACLs), and uniform resource locator (URL) validation.
The owner and users are exposed to security risks from cyber attacks, technical vulnerabilities, and accidental operations.
OBS Advantages
- Data durability and service continuity: OBS supports access of hundreds of millions of users.
- Multi-level protection and authorization management: Measures, including versioning, server-side encryption, URL validation, virtual private cloud (VPC)-based network isolation, access log audit, and fine-grained access control are provided to keep data secure and trusted.
- 100-billion level objects, 10-million level concurrency: With intelligent scheduling and response, optimized data access paths, and technologies such as event notifications, transmission acceleration, and big data vertical optimization, you can store hundreds of billions of objects in OBS, and still experience smooth concurrency, ultra-high bandwidth, and low latency.
- Easy use and management: OBS provides standard REST APIs, SDKs in different programming languages, and data migration tools, like OBS Browser, to help you quickly move your workloads to cloud. Storage resources are linearly, infinitely scalable, without compromising performance. You do not have to plan storage capacity beforehand or worry expansion or reduction.
OBS Advantages
- Data durability and service continuity: OBS supports access of hundreds of millions of users.
- Multi-level protection and authorization management: Measures, including versioning, server-side encryption, URL validation, virtual private cloud (VPC)-based network isolation, access log audit, and fine-grained access control are provided to keep data secure and trusted.
- Highly concurrent access for hundreds of billions of objects: With intelligent scheduling and response, optimized access paths, and technologies such as transmission acceleration, event notifications, and big data vertical optimization, you can store hundreds of billions of objects in OBS and still experience smooth concurrent access with ultra-high bandwidth and low latency.
- Easy use and management: OBS provides standard REST APIs, SDKs in different programming languages, and data migration tools, like OBS Browser, to help you quickly move your workloads to cloud. Storage resources are linearly, infinitely scalable, without compromising performance. You do not have to plan storage capacity beforehand or worry about expansion or reduction.
diff --git a/docs/obs/umn/obs_03_0204.html b/docs/obs/umn/obs_03_0204.html index 16d8484fb..4c3709791 100644 --- a/docs/obs/umn/obs_03_0204.html +++ b/docs/obs/umn/obs_03_0204.html @@ -2,64 +2,64 @@Related Services
-Table 1 Related services Function
+Table 1 Related services Function
Related Service
+Related Service
Reference
+Reference
IAM provides the following functions:
+IAM provides the following functions:
- User identity authentication
- IAM user permission control
- IAM agency configuration
Identity and Access Management (IAM)
+Identity and Access Management (IAM)
+ Cloud Eye monitors OBS buckets, to collect statistics about the upload traffic, download traffic, the number of GET and PUT requests, the average Time to First Byte (TTFB) of GET requests, and the number of 4xx and 5xx errors.
+Cloud Eye monitors OBS buckets, to collect statistics about the upload traffic, download traffic, the number of GET and PUT requests, the average Time to First Byte (TTFB) of GET requests, and the number of 4xx and 5xx errors.
Cloud Eye
+Cloud Eye
+ CTS collects records of operations on OBS resources, facilitating querying, audits, and backtracking.
+CTS collects records of operations on OBS resources, facilitating querying, audits, and backtracking.
Cloud Trace Service (CTS)
+Cloud Trace Service (CTS)
+ SMN sends OBS related alarms and event notifications, and triggers workflows.
+SMN sends OBS related alarms and event notifications, and triggers workflows.
Simple Message Notification (SMN)
+Simple Message Notification (SMN)
+ Tags are used to label and classify buckets in OBS.
+Tags are used to label and classify buckets in OBS.
Tag Management Service (TMS)
+Tag Management Service (TMS)
+ KMS encrypts files uploaded to the OBS.
+KMS encrypts files uploaded to the OBS.
Key Management Service (KMS)
+Key Management Service (KMS)
+ DNS resolves domain names configured for static website hosting in OBS.
+DNS resolves domain names configured for static website hosting in OBS.
Domain Name Service (DNS)
+Domain Name Service (DNS)
Using a User-Defined Domain Name to Configure Static Website Hosting
+Using a User-Defined Domain Name to Configure Static Website Hosting
Buckets
Buckets are containers for storing objects. OBS provides flat storage in the form of buckets and objects. Unlike the conventional multi-layer directory structure of file systems, all objects in a bucket are stored at the same logical layer.
Each bucket has its own attributes, such as access permissions, storage class, and the region. You can specify access permissions, storage class, and regions when creating buckets. You can also configure advanced attributes to meet storage requirements in different scenarios.
-OBS provides the following storage classes for buckets: Standard, Warm, and Cold. With diverse storage classes, OBS caters to both storage performance and cost requirements. When creating a bucket, you can specify a storage class for the bucket. The storage class of a bucket can be changed as needed.
+OBS provides the following storage classes for buckets: Standard, Warm, and Cold. With support for these storage classes, OBS caters to diverse storage performance and cost requirements. When creating a bucket, you can specify a storage class for it, which can be changed later.
Each bucket name in OBS is globally unique and cannot be changed after the bucket has been created. The region where a bucket resides cannot be changed once the bucket is created. When you create a bucket, OBS creates a default access control list (ACL) that grants users permissions (such as read and write permissions) on the bucket. Only authorized users can perform operations such as creating, deleting, viewing, and configuring buckets.
An account (including all IAM users under this account) can create a maximum of 100 buckets and parallel file systems. However, there is no restriction on the number and total size of objects in a bucket.
OBS adopts the REST architectural style, and is based on HTTP and HTTPS. You can use URLs to locate resources.
diff --git a/docs/obs/umn/obs_03_0300.html b/docs/obs/umn/obs_03_0300.html index ced3f0e08..ba4b67fe1 100644 --- a/docs/obs/umn/obs_03_0300.html +++ b/docs/obs/umn/obs_03_0300.html @@ -20,7 +20,9 @@- Object Metadata
-
- Permission Control
+- Bucket Inventories
+
+- Permissions Control
- Versioning
diff --git a/docs/obs/umn/obs_03_0301.html b/docs/obs/umn/obs_03_0301.html index f0c7f9048..97de139ed 100644 --- a/docs/obs/umn/obs_03_0301.html +++ b/docs/obs/umn/obs_03_0301.html @@ -1,7 +1,7 @@
Restrictions
-Table 1 lists the web browser versions supported by OBS Console.
+Table 1 lists the web browser versions compatible with OBS Console.
Table 1 Supported web browser versions Web Browser
Configuring User Permissions
-If your cloud service account does not need individual IAM users, then you may skip this section. Your permissions to use OBS functions are not affected.
-If IAM users are required, you need to grant them access permissions on OBS, because OBS is separately deployed from other cloud resources.
+If IAM users are required, you need to grant them access permissions for OBS, because OBS is separately deployed from other cloud resources.
Process
Figure 1 Process of granting an IAM user the OBS permissionsProcedure
- Log in to the management console with your account.
- On the top menu bar, choose Service List > Management & Deployment > Identity and Access Management. The IAM console is displayed.
- Create a user group and assign OBS permissions to it.A user group is a collection of users. By assigning permissions to a user group, you assign permissions to the users in this group. After you create an IAM user, add it to one or more user groups, so that it can inherit the permissions from the groups.
- In the navigation pane, choose User Groups. The User Groups page is displayed.
- Click Create User Group.
- Enter a user group name and click OK.
The user group is displayed in the user group list once the creation is complete.
@@ -11,39 +11,7 @@
- Create a user.
- In the navigation pane, choose Users. The Users page is displayed.
- Click Create User.
- Set user information and click Next.
--
-Table 1 User parameters Parameter
-Description
-Username
-The user name for logging in to the cloud service.
-Credential Type
-- Password: Used for accessing cloud services using the console or development tools.
- Access key: Used for logging to the cloud service using development tools. This credential type is more secure, and is recommended if the user does not need to use the console.
User Groups
-You can add a user to one or more user groups. Then the user will inherit the permissions granted to these user groups. The default user group admin has the administrator permissions and all of the permissions required to use all cloud resources.
-Description
-(Optional) Brief description about the user.
- - Select a type for password generation, set the email address and mobile number, and click OK.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
+- Create an IAM user. For details, see section "Creating an IAM User" in the Identity and Access Management User Guide.
- Use the created IAM user to log in to OBS Console and verify the user permissions.
diff --git a/docs/obs/umn/obs_03_0306.html b/docs/obs/umn/obs_03_0306.html index 05511368d..29093781d 100644 --- a/docs/obs/umn/obs_03_0306.html +++ b/docs/obs/umn/obs_03_0306.html @@ -6,7 +6,7 @@Procedure
- In the upper right corner of the OBS Console homepage, click Create Bucket. The Create Bucket page is displayed. For details, see Figure 1. - +
- Configure bucket parameters.
Table 1 Bucket parameters Parameter
Storage Class
Storage classes of a bucket. Different storage classes meet different requirements for storage performance and costs.
+- The Standard storage class is for storing a large number of hot files or small files that are frequently accessed (multiple times per month on average) and require quick retrieval.
- The Warm storage class is for storing data that is less frequently accessed (less than 12 times per year on average) and requires quick retrieval.
- The Cold storage class is for archiving data that is rarely accessed (once a year on average) and has no requirements for quick retrieval.
For details, see Storage Classes Overview.
If versioning is disabled for your bucket and you upload a new file with the same name as the one you previously uploaded to your bucket, the new file automatically overwrites the previous file and does not retain its ACL information. If you upload a new folder using the same name that was used with a previous folder in the bucket, the two folders will be merged, and files in the new folder will overwrite namesake files in the previous folder.
After versioning is enabled for your bucket, if the new file you upload has the same name as the one you previously uploaded to the bucket, a new file version will be added in the bucket. For details about versioning, see Versioning Overview.
-Prerequisites
- At least one bucket has been created.
- If you want to classify files, you can create folders and upload files to different folders. For details about how to create a folder, see Creating a Folder
-Prerequisites
- At least one bucket has been created.
- If you want to classify files, you can create folders and upload files to different folders. For details, see Creating a Folder.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Go to the folder to which objects are uploaded. Click Upload Object. The Upload Object dialog box is displayed.
If the files that you want to upload to OBS are stored in Microsoft OneDrive, it is recommended that the names of these files contain a maximum of 32 characters to ensure compatibility.
+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Go to the folder where you want to upload files and click Upload Object. The Upload Object dialog box is displayed.
If the files that you want to upload to OBS are stored in Microsoft OneDrive, it is recommended that the names of these files contain a maximum of 32 characters to ensure compatibility.
Figure 1 Uploading objects- - Select a storage class. If you do not specify a storage class, the object you upload inherits the default storage class of the bucket.
An object can have a different storage class from its bucket. You can specify a storage class for an object when uploading it, or you can change the object storage class after the object is uploaded.
+- Select a storage class. If you do not specify a storage class, the objects you upload inherit the default storage class of the bucket.
- An object can have a different storage class from its bucket. You can specify a storage class for an object when uploading it, or you can change the object storage class after the object is uploaded.
- Add a file or folder to be uploaded by dragging it to the Upload Object area.
You can also click add file in the Upload Object area to select files.
+- In the Upload Object area, drag and drop the files or folders you want to upload.
You can also click add file in the Upload Object area to select files.
- (Optional) Select KMS encryption to encrypt the uploaded file. For details, see Uploading an Object in Server-Side Encryption Mode.
If the default encryption has been enabled for the bucket, uploaded objects are automatically encrypted.
- Click Upload.
diff --git a/docs/obs/umn/obs_03_0308.html b/docs/obs/umn/obs_03_0308.html index cbb6386d3..bc455023c 100644 --- a/docs/obs/umn/obs_03_0308.html +++ b/docs/obs/umn/obs_03_0308.html @@ -4,7 +4,7 @@You can download files from OBS Console to your local computer.
-Limitations and Constraints
Objects in the Cold storage class can be downloaded only when they are in the Restored state.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the files you want to download, and then click Download or More > Download As to download the files. -
In the Download As dialog box, right-click the object and choose Copy Link Address from the shortcut menu to obtain the object's download address.
+diff --git a/docs/obs/umn/obs_03_0309.html b/docs/obs/umn/obs_03_0309.html index dd4d70043..5a4a79701 100644 --- a/docs/obs/umn/obs_03_0309.html +++ b/docs/obs/umn/obs_03_0309.html @@ -2,9 +2,8 @@Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file you want to download, and click Download or choose More > Download As on the right.
In the Download As dialog box, right-click the object and choose Copy Link Address from the shortcut menu to obtain the object's download address.
Deleting an Object
You can delete unnecessary files one by one or in a batch on OBS Console to save space and money.
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file you want to delete, and choose More > Delete on the right.
You can select multiple files and click Delete above the file list to batch delete the files.
- - Click Yes to confirm the deletion.
The object deletion task is displayed in the Task Management window.
-
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file you want to delete, and choose More > Delete on the right.
You can select multiple files and click Delete above the file list to batch delete them.
+ - Click Yes to confirm the deletion.
diff --git a/docs/obs/umn/obs_03_0310.html b/docs/obs/umn/obs_03_0310.html index dd23eaeaf..7f66fb491 100644 --- a/docs/obs/umn/obs_03_0310.html +++ b/docs/obs/umn/obs_03_0310.html @@ -6,9 +6,9 @@Important Notes
In big data scenarios, parallel file systems usually have deep directory levels and each directory has a large number of files. In such case, deleting directories from parallel file systems may fail due to timeout. To address this problem, you are advised to configure a lifecycle rule for directories so that they can be deleted in background based on the preset lifecycle rule.
- A bucket can only be deleted by the bucket owner.
Procedure
- In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.
The name of a deleted bucket can be reused for another bucket or a parallel file system at least 30 minutes after the deletion.
+Procedure
- In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.-
The name of a deleted bucket can be reused for another bucket or parallel file system at least 30 minutes after the deletion.
- Click Yes to confirm the deletion.
- Click Yes to confirm the deletion.
diff --git a/docs/obs/umn/obs_03_0312.html b/docs/obs/umn/obs_03_0312.html index 4aabd3dc1..ecbc06430 100644 --- a/docs/obs/umn/obs_03_0312.html +++ b/docs/obs/umn/obs_03_0312.html @@ -67,7 +67,7 @@ - In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.
- Select a storage class. If you do not specify a storage class, the objects you upload inherit the default storage class of the bucket.
Access Domain Name
OBS assigns each bucket with a default domain name. A domain name is the address of a bucket on the Internet. It can be used to access a bucket over the Internet. It is applicable to cloud application development and data sharing scenarios.
+OBS assigns each bucket with a default domain name. A domain name is the address of a bucket on the Internet. It can be used to access a bucket over the Internet in scenarios such as cloud application development and data sharing.
Structure: BucketName.Endpoint
Searching for a Bucket
You can search for a bucket by characters contained in its name.
-- Currently, searching for buckets by tag is not supported.
+ Currently, bucket search by tag is not supported.
Procedure
- In the search box in the upper right corner of the OBS Console homepage, enter characters contained in the name of the bucket you want to search for.
- Click
.Buckets that meet the search criteria are displayed in the bucket list.
For example, if you want to search for buckets whose names contain test, you only need to enter test in the search box and click
diff --git a/docs/obs/umn/obs_03_0314.html b/docs/obs/umn/obs_03_0314.html index 20425cbe4..fbbf6685f 100644 --- a/docs/obs/umn/obs_03_0314.html +++ b/docs/obs/umn/obs_03_0314.html @@ -6,9 +6,9 @@. Then, all buckets that contain test in their names are displayed.
- A bucket can only be deleted by the bucket owner.
Procedure
- In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.
The name of a deleted bucket can be reused for another bucket or a parallel file system at least 30 minutes after the deletion.
+Procedure
- In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.-
The name of a deleted bucket can be reused for another bucket or parallel file system at least 30 minutes after the deletion.
- Click Yes to confirm the deletion.
- Click Yes to confirm the deletion.
diff --git a/docs/obs/umn/obs_03_0316.html b/docs/obs/umn/obs_03_0316.html index 7b68352a6..edb99fba8 100644 --- a/docs/obs/umn/obs_03_0316.html +++ b/docs/obs/umn/obs_03_0316.html @@ -4,10 +4,10 @@This section describes how to create a folder on OBS Console. Folders facilitate data management in OBS.
-Background Information
- Unlike a file system, OBS does not involve the concepts of file and folder. For easy data management, OBS provides a method to simulate folders. In OBS, an object is simulated as a folder by adding a slash (/) to the end of the object name on OBS Console. If you call the API to list objects, paths of objects are returned. In an object path, the content following the last slash (/) is the object name. If a path ends with a slash (/), it indicates that the object is a folder. The hierarchical depth of the object does not affect the performance of accessing the object.
- OBS Console does not support the download of folders. You can use OBS Browser to download folders.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Create Folder, or click a folder in the object list to open it, and then click Create Folder.
- In the Folder Name text box, enter a name for the folder.
- You can create single-level or multi-level folders.
- The name cannot contain the following special characters: \:*?"<>|+
- The name cannot start or end with a period (.) or slash (/).
- The absolute path of the folder cannot exceed 1023 characters.
- Any single slash (/) separates and creates multiple levels of folders at once.
- The name cannot contain two or more consecutive slashes (/).
-Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Create Folder, or click a folder in the object list to open it and click Create Folder.
- In the Folder Name text box, enter a name for the folder.
- You can create single-level or multi-level folders.
- The name cannot contain the following special characters: \:*?"<>|
- The name cannot start or end with a period (.) or slash (/).
- The folder's absolute path cannot exceed 1,023 characters.
- Any single slash (/) separates and creates multiple levels of folders at once.
- The name cannot contain two or more consecutive slashes (/).
- Click OK.
Follow-up Procedure
You can click Copy Path on the right to copy the path of the folder. You can share the path with other users. Then they open the bucket where the object is stored and enter the path in the search box to find the object.
+Follow-up Procedure
You can click Copy Path on the right to copy the path of the folder and share it with others. Then they can open the bucket where the folder is stored and enter the path in the search box above the object list to find the folder.
diff --git a/docs/obs/umn/obs_03_0317.html b/docs/obs/umn/obs_03_0317.html index 39ce9dd4e..34decd44e 100644 --- a/docs/obs/umn/obs_03_0317.html +++ b/docs/obs/umn/obs_03_0317.html @@ -1,7 +1,7 @@Downloading an Object
-You can download files from OBS Console to the system default path or a custom download path of your local computer.
+You can download files from OBS Console to the system default path or a custom download path on your local computer.
Limitations and Constraints
Objects in the Cold storage class can be downloaded only when they are in the Restored state.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file you want to download. Then, click Download or More > Download As on the right.
In the Download As dialog box, right-click the object and choose Copy Link Address from the shortcut menu to obtain the object's download address.
diff --git a/docs/obs/umn/obs_03_0318.html b/docs/obs/umn/obs_03_0318.html index caef327a0..075d56eaa 100644 --- a/docs/obs/umn/obs_03_0318.html +++ b/docs/obs/umn/obs_03_0318.html @@ -1,14 +1,14 @@Searching for an Object or Folder
-This section describes how to search for a file or folder by name prefix on OBS Console.
+On OBS Console, you can search for files or folders by prefix.
Searching by Prefixes of Object Names
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- In the search box above the object list, enter the name prefix of the file or folder that you want to search for.
In the root directory of the bucket, files and folders whose name starts with the specified prefix are displayed.
- -If you want to search for objects within a folder, you can use either of the following methods:
-- In the search box of the root directory, enter folder path/object name prefix. For example, if you enter abc/123/example, all files and folders whose name is prefixed with example in the abc/123 folder are displayed.
- Alternatively, you can open the specific folder, and enter the object name prefix in the search box of that folder. For example, you can open the abc/123 folder and enter example in the search box. Then all files and folders whose name is prefixed with example in the abc/123 folder are displayed.
- To search for objects within a folder, use either of the following methods:
+- In the search box of the root directory, enter folder path/object name prefix. For example, if you enter abc/123/example, all files and folders with the example prefix in the abc/123 folder will be displayed.
- Open the folder, and enter the object name prefix in the search box. For example, after you open the abc/123 folder and enter example in the search box, all files and folders with the example prefix in the abc/123 folder will be displayed.
- Click
+. The search results are displayed in the object list.- Click
. The search results are displayed in the object list.Related Operations
In the object list, click
+
next to the object name, size, or latest modification time to sort objects.Related Operations
In the object list, click
next to the size or last modification time to sort objects.diff --git a/docs/obs/umn/obs_03_0319.html b/docs/obs/umn/obs_03_0319.html index 1ba7fd201..a00b04915 100644 --- a/docs/obs/umn/obs_03_0319.html +++ b/docs/obs/umn/obs_03_0319.html @@ -2,12 +2,12 @@Accessing an Object Using Its URL
You can grant anonymous users the read permission for an object so they can access the object using the shared object URL.
-Prerequisites
Anonymous users have the read permission for the object. For details about permission granting, see Granting Object Access Permissions to Anonymous Users.
+-Prerequisites
Anonymous users have the read permission for the object. For details about permission granting, see Granting Anonymous Users Permission to Access Objects.
Encrypted objects cannot be shared.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click the object to be shared. The object information is displayed on the top part of the page. The Link displays the shared link of the object. For details, see Figure 1.Anonymous users can access the object by clicking the URL. The object URL is in the format of https://bucket name.domain name/directory level/object name. If the object resides in the root directory of the bucket, its URL does not contain the directory level. -
- To allow anonymous users to access objects in Cold storage using URLs, ensure that these objects are in the Restored state.
- The method of using a browser to access objects varies depending on the object type. You can directly open .txt and .html files using a browser. However, when you open .exe and .dat files using a browser, the files are automatically downloaded to your local computer.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click the object to be shared. The object information is displayed on the top part of the page. You can find the link for accessing the object in the Link area, as shown in Figure 1.Anonymous users can access the object by clicking this link. An object link (URL) is in the format of https://Bucket name.Domain name/Directory level/Object name. If the object is stored in the root directory of the bucket, its URL does not contain any directory level. +
- To allow anonymous users to access objects in Cold storage using URLs, ensure that these objects are in the Restored state.
Restoring Objects from the Cold Storage
-You must restore a Cold object before you can operate it, including download, access using a URL, as well as ACL and metadata settings.
-Limitations and Constraints
- You cannot suspend or delete the restore task if a Cold object is being restored.
- You cannot re-restore an object in the Restoring state.
- After an object is restored, an object copy in the Standard storage class will be generated. This way, there is the object in Cold storage class and also its copy in Standard storage class in the bucket. The copy will be automatically deleted once the restore expires.
You must restore a Cold object before you can download it, access it with a URL, or configure its ACL or metadata.
+Limitations and Constraints
- If a Cold object is being restored, its restore task cannot be suspended or deleted.
- An object being restored cannot be restored again.
- After an object is restored, an object copy in the Standard storage class will be generated. This way, there is a Cold object and also its Standard copy in the bucket. The copy will be automatically deleted once the restore expires.
Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Select the file you want to restore, and click Restore on the right. The following dialog box shown in Figure 1 is displayed.
You can select multiple files and click Restore above the file list to batch restore the files.
Objects that are being restored cannot be added for batch restore.
diff --git a/docs/obs/umn/obs_03_0322.html b/docs/obs/umn/obs_03_0322.html index ebf0d512f..4513320d8 100644 --- a/docs/obs/umn/obs_03_0322.html +++ b/docs/obs/umn/obs_03_0322.html @@ -2,16 +2,34 @@Uploading an Object in Server-Side Encryption Mode
diff --git a/docs/obs/umn/obs_03_0325.html b/docs/obs/umn/obs_03_0325.html index a7c173948..7a46079d4 100644 --- a/docs/obs/umn/obs_03_0325.html +++ b/docs/obs/umn/obs_03_0325.html @@ -1,21 +1,21 @@OBS allows you to encrypt objects with server-side encryption so that the objects can be securely stored in OBS.
-In a bucket with server-side encryption disabled, objects uploaded to it are not encrypted by default. You can configure server-side encryption when uploading objects. In a bucket with server-side encryption enabled, objects uploaded to it inherit the encryption settings of the bucket. You can also separately configure encryption for the objects.
+In a bucket with server-side encryption disabled, objects uploaded to it are not encrypted by default, but you can configure server-side encryption for the objects when uploading them. In a bucket with server-side encryption enabled, objects uploaded to it can inherit the encryption settings of the bucket, and you can also separately configure encryption for the objects.
Limitations and Constraints
- The object encryption status cannot be changed.
- A key in use cannot be deleted. Otherwise, the object encrypted with this key cannot be downloaded.
- Objects encrypted on the server side cannot be shared.
Prerequisites
In the region where OBS is deployed, the KMS Administrator permission has been added to the user group. For details about how to add permissions, see the IAM User Guide.
+ A custom KMS Policy with a minimum required set of allowed actions for users to be able to upload and download objects with Server-Side Encryption is:
+{ + "Version": "1.1", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "kms:dek:crypto", + "kms:dek:create", + "kms:cmk:get", + "kms:cmk:list", + "kms:cmk:generate", + "kms:cmk:crypto" + ] + } + ] +}+Procedure
- In the bucket list, click the bucket you want to operate. The Overview page is displayed.
- In the navigation pane, choose Objects.
- Click Upload Object. The Upload Object dialog box is displayed.
- Add the files to be uploaded.
- Select KMS encryption and select a key that you have created on KMS.-
If the default encryption has been enabled for the bucket, uploaded objects are automatically encrypted.
After KMS encryption is selected, obs/default is selected by default as the key for the encryption. You can also click Create KMS Key to switch to the KMS management console and create a customer master key. Then go back to OBS Console and select the key from the drop-down list.
+After KMS encryption is selected, obs/default is selected by default as the key for the encryption. You can also click Create KMS Key to switch to the KMS management console and create a customer master key. Then go back to OBS Console and select the key from the drop-down list.
Figure 1 Encrypting an object to be uploaded-
- Click Upload.
After the object is uploaded successfully, you can view its encryption status in the object list.
+ - Click Upload.
After the object is uploaded, you can view its encryption status on its details page.
Relationship Between a Bucket ACL and a Bucket Policy
-Mapping Relationship Between Bucket ACLs and Bucket Policies
Bucket ACLs are used to control basic read and write access permissions for buckets. Custom settings of bucket policies support more actions that can be performed on buckets. Bucket policies, supplements to bucket ACLs, can replace the bucket ACL to manage the access permissions of a bucket, except granting permissions to the log delivery user. Table 1 shows the mapping between bucket ACL access permissions and bucket policy actions.
+Mapping Between Bucket ACLs and Bucket Policies
Bucket ACLs are used to control basic read and write access to buckets. Custom settings of bucket policies support more actions that can be performed on buckets. Bucket policies supplement bucket ACLs. In most cases (granting permissions to log delivery user groups excluded), you can use bucket policies to manage access to buckets. Table 1 shows the mapping between bucket ACL access permissions and bucket policy actions.
-
- In the bucket list on OBS Console, select the bucket you want to delete, and then click Delete on the right.
- Example 1: Grant all OBS permissions to users.
- For an object, enter the object name (including its folder name if any). If you want to specify the example.jpg file in the imgs-folder folder in the bucket, enter the following content in the resource text box:
Bucket Default Encryption
-OBS allows you to configure default encryption for a bucket. After the configuration, objects uploaded to this bucket are automatically encrypted using the specified KMS key, making data storage more secure.
-You can enable default encryption when creating a bucket (see Creating a Bucket), or enable or disable default encryption after a bucket is created.
-OBS encrypts only the objects uploaded after the default encryption is enabled, and does not encrypt those uploaded before. After default encryption is disabled, the encryption status of existing objects keeps unchanged, and you can still manually encrypt objects upon upload.
-Enabling Default Encryption for a Bucket
