public class AccessControlList extends Object implements Serializable, S3RequesterChargedResult
Represents an Amazon S3 Access Control List (ACL), including the ACL's set of grantees and the permissions assigned to each grantee.
Each bucket and object in Amazon S3 has an ACL that defines its access control policy. When a request is made, Amazon S3 authenticates the request using its standard authentication procedure and then checks the ACL to verify the sender was granted access to the bucket or object. If the sender is approved, the request proceeds. Otherwise, Amazon S3 returns an error.
An ACL contains a list of grants. Each grant consists of one grantee and one permission. ACLs only grant permissions; they do not deny them.
For convenience, some commonly used ACLs are defined in
CannedAccessControlList
.
Note: Bucket and object ACLs are completely independent; an object does not inherit an ACL from its bucket. For example, if you create a bucket and grant write access to another user, you will not be able to access the user's objects unless the user explicitly grants access. This also applies if you grant anonymous write access to a bucket. Only the user "anonymous" will be able to access objects the user created unless permission is explicitly granted to the bucket owner.
Important: Do not grant the anonymous group
write access to buckets, as you will have no control over the objects
others can store and their associated charges. For more information, see
Grantee
and Permissions
.
CannedAccessControlList
,
Serialized FormConstructor and Description |
---|
AccessControlList() |
Modifier and Type | Method and Description |
---|---|
boolean |
equals(Object obj) |
Set<Grant> |
getGrants()
Deprecated.
This will remove the duplicate grants if received from Amazon
S3. Use
getGrantsAsList() instead. |
List<Grant> |
getGrantsAsList()
Gets the list of
Grant objects in this access control list (ACL). |
Owner |
getOwner()
Gets the owner of the
AccessControlList . |
void |
grantAllPermissions(Grant... grantsVarArg)
Adds a set of grantee/permission pairs to the access control list (ACL), where each item in the
set is a
Grant object. |
void |
grantPermission(Grantee grantee,
Permission permission)
Adds a grantee to the access control list (ACL) with the given permission.
|
int |
hashCode() |
boolean |
isRequesterCharged()
Returns true if the user has enabled Requester Pays option when
conducting this operation from Requester Pays Bucket; else false.
|
void |
revokeAllPermissions(Grantee grantee)
Revokes the permissions of a grantee by removing the grantee from the access control list (ACL).
|
void |
setOwner(Owner owner)
Sets the owner of the
AccessControlList . |
void |
setRequesterCharged(boolean isRequesterCharged)
Used for conducting this operation from a Requester Pays Bucket.
|
String |
toString() |
public Owner getOwner()
AccessControlList
.
Every bucket and object in Amazon S3 has an owner, the user that created the bucket or object. The owner of a bucket or object cannot be changed. However, if the object is overwritten by another user (deleted and rewritten), the new object will have a new owner.
Note: Even the owner is subject to the access control list (ACL). For example, if an owner does
not have Permission.Read
access to an object, the owner cannot
read that object. However, the owner of an object always has write access
to the access control policy (Permission.WriteAcp
) and can change
the ACL to read the object.
AccessControlList
.public void setOwner(Owner owner)
AccessControlList
. Note that an owner of a resource can't
change once created.
Every bucket and object in Amazon S3 has an owner, the user that created the bucket or object. The owner of a bucket or object cannot be changed. However, if the object is overwritten by another user (deleted and rewritten), the new object will have a new owner.
Note: Even the owner is subject to the access control list (ACL). For example, if an owner does
not have Permission.Read
access to an object, the owner cannot
read that object. However, the owner of an object always has write access
to the access control policy (Permission.WriteAcp
) and can change
the ACL to read the object.
owner
- Owner of the bucket.public void grantPermission(Grantee grantee, Permission permission)
grantee
- The grantee to whom the permission will apply.permission
- The permission to apply to the grantee.public void grantAllPermissions(Grant... grantsVarArg)
Grant
object.grantsVarArg
- A collection of Grant
objectspublic void revokeAllPermissions(Grantee grantee)
grantee
- The grantee to remove from this ACL.@Deprecated public Set<Grant> getGrants()
getGrantsAsList()
instead.Grant
objects in this access control list (ACL).Grant
objects in this ACL.public List<Grant> getGrantsAsList()
Grant
objects in this access control list (ACL).Grant
objects in this ACL.public boolean isRequesterCharged()
S3RequesterChargedResult
If a bucket is enabled for Requester Pays, then any attempt of operation from it without Requester Pays enabled will result in a 403 error and the bucket owner will be charged for the request.
Enabling Requester Pays disables the ability to have anonymous access to this bucket
isRequesterCharged
in interface S3RequesterChargedResult
public void setRequesterCharged(boolean isRequesterCharged)
S3RequesterChargedResult
If a bucket is enabled for Requester Pays, then any attempt of operation from it without Requester Pays enabled will result in a 403 error and the bucket owner will be charged for the request.
setRequesterCharged
in interface S3RequesterChargedResult
isRequesterCharged
- Indicates requester is charged for this operation.Copyright © 2020. All rights reserved.