com.ibm.cloud.objectstorage.services.s3.model

Class AccessControlList

java.lang.Object

com.ibm.cloud.objectstorage.services.s3.model.AccessControlList

All Implemented Interfaces:

S3RequesterChargedResult, Serializable

public class AccessControlList
extends Object
implements Serializable, S3RequesterChargedResult

Represents an Amazon S3 Access Control List (ACL), including the ACL's set of grantees and the permissions assigned to each grantee.

Each bucket and object in Amazon S3 has an ACL that defines its access control policy. When a request is made, Amazon S3 authenticates the request using its standard authentication procedure and then checks the ACL to verify the sender was granted access to the bucket or object. If the sender is approved, the request proceeds. Otherwise, Amazon S3 returns an error.

An ACL contains a list of grants. Each grant consists of one grantee and one permission. ACLs only grant permissions; they do not deny them.

For convenience, some commonly used ACLs are defined in CannedAccessControlList.

Note: Bucket and object ACLs are completely independent; an object does not inherit an ACL from its bucket. For example, if you create a bucket and grant write access to another user, you will not be able to access the user's objects unless the user explicitly grants access. This also applies if you grant anonymous write access to a bucket. Only the user "anonymous" will be able to access objects the user created unless permission is explicitly granted to the bucket owner.

Important: Do not grant the anonymous group write access to buckets, as you will have no control over the objects others can store and their associated charges. For more information, see Grantee and Permissions.

See Also:

CannedAccessControlList, Serialized Form

Constructor Summary

Constructors

Constructor and Description
AccessControlList()

Method Summary

Modifier and Type	Method and Description
boolean	equals(Object obj)
Set<Grant>	getGrants() Deprecated. This will remove the duplicate grants if received from Amazon S3. Use AccessControlList.getGrantsAsList() instead.
List<Grant>	getGrantsAsList() Gets the list of Grant objects in this access control list (ACL).
Owner	getOwner() Gets the owner of the AccessControlList.
void	grantAllPermissions(Grant... grantsVarArg) Adds a set of grantee/permission pairs to the access control list (ACL), where each item in the set is a Grant object.
void	grantPermission(Grantee grantee, Permission permission) Adds a grantee to the access control list (ACL) with the given permission.
int	hashCode()
boolean	isRequesterCharged() Returns true if the user has enabled Requester Pays option when conducting this operation from Requester Pays Bucket; else false.
void	revokeAllPermissions(Grantee grantee) Revokes the permissions of a grantee by removing the grantee from the access control list (ACL).
void	setOwner(Owner owner) Sets the owner of the AccessControlList.
void	setRequesterCharged(boolean isRequesterCharged) Used for conducting this operation from a Requester Pays Bucket.
String	toString()
AccessControlList	withOwner(Owner owner) Sets the owner of the AccessControlList.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

AccessControlList

public AccessControlList()

Method Detail

getOwner

public Owner getOwner()

Gets the owner of the AccessControlList.

Every bucket and object in Amazon S3 has an owner, the user that created the bucket or object. The owner of a bucket or object cannot be changed. However, if the object is overwritten by another user (deleted and rewritten), the new object will have a new owner.

Note: Even the owner is subject to the access control list (ACL). For example, if an owner does not have Permission.Read access to an object, the owner cannot read that object. However, the owner of an object always has write access to the access control policy (Permission.WriteAcp) and can change the ACL to read the object.

Returns:

The owner for this AccessControlList.

withOwner

public AccessControlList withOwner(Owner owner)

Sets the owner of the AccessControlList. Note that an owner of a resource can't change once created.

Every bucket and object in Amazon S3 has an owner, the user that created the bucket or object. The owner of a bucket or object cannot be changed. However, if the object is overwritten by another user (deleted and rewritten), the new object will have a new owner.

Note: Even the owner is subject to the access control list (ACL). For example, if an owner does not have Permission.Read access to an object, the owner cannot read that object. However, the owner of an object always has write access to the access control policy (Permission.WriteAcp) and can change the ACL to read the object.

Parameters:

owner - Owner of the bucket.

setOwner

public void setOwner(Owner owner)

Sets the owner of the AccessControlList. Note that an owner of a resource can't change once created.

Every bucket and object in Amazon S3 has an owner, the user that created the bucket or object. The owner of a bucket or object cannot be changed. However, if the object is overwritten by another user (deleted and rewritten), the new object will have a new owner.

Note: Even the owner is subject to the access control list (ACL). For example, if an owner does not have Permission.Read access to an object, the owner cannot read that object. However, the owner of an object always has write access to the access control policy (Permission.WriteAcp) and can change the ACL to read the object.

Parameters:

owner - Owner of the bucket.

grantPermission

public void grantPermission(Grantee grantee,
                            Permission permission)

Adds a grantee to the access control list (ACL) with the given permission. If this access control list already contains the grantee (i.e. the same grantee object) the permission for the grantee will be updated.

Parameters:

grantee - The grantee to whom the permission will apply.

permission - The permission to apply to the grantee.

grantAllPermissions

public void grantAllPermissions(Grant... grantsVarArg)

Adds a set of grantee/permission pairs to the access control list (ACL), where each item in the set is a Grant object.

Parameters:

grantsVarArg - A collection of Grant objects

revokeAllPermissions

public void revokeAllPermissions(Grantee grantee)

Revokes the permissions of a grantee by removing the grantee from the access control list (ACL).

Parameters:

grantee - The grantee to remove from this ACL.

getGrants

@Deprecated
public Set<Grant> getGrants()

Deprecated. This will remove the duplicate grants if received from Amazon S3. Use AccessControlList.getGrantsAsList() instead.

Gets the set of Grant objects in this access control list (ACL).

Returns:

The set of Grant objects in this ACL.

getGrantsAsList

public List<Grant> getGrantsAsList()

Gets the list of Grant objects in this access control list (ACL).

Returns:

The list of Grant objects in this ACL.

hashCode

public int hashCode()

Overrides:

hashCode in class Object

equals

public boolean equals(Object obj)

Overrides:

equals in class Object

toString

public String toString()

Overrides:

toString in class Object

isRequesterCharged

public boolean isRequesterCharged()

Description copied from interface: S3RequesterChargedResult

Returns true if the user has enabled Requester Pays option when conducting this operation from Requester Pays Bucket; else false.

If a bucket is enabled for Requester Pays, then any attempt of operation from it without Requester Pays enabled will result in a 403 error and the bucket owner will be charged for the request.

Enabling Requester Pays disables the ability to have anonymous access to this bucket

Specified by:

isRequesterCharged in interface S3RequesterChargedResult

Returns:

true if the user has enabled Requester Pays option for conducting this operation from Requester Pays Bucket.

setRequesterCharged

public void setRequesterCharged(boolean isRequesterCharged)

Description copied from interface: S3RequesterChargedResult

Used for conducting this operation from a Requester Pays Bucket. If set the requester is charged for conducting the operation from the bucket.

If a bucket is enabled for Requester Pays, then any attempt of operation from it without Requester Pays enabled will result in a 403 error and the bucket owner will be charged for the request.

Specified by:

setRequesterCharged in interface S3RequesterChargedResult

Parameters:

isRequesterCharged - Indicates requester is charged for this operation.