Object Storage Service. Client Guide (OBS Browser) Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2018. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China support@huawei.com i

3 Contents Contents 1 Basic Knowledge of OBS OBS Browser Overview Function Description Basic Operations on OBS Browser Registering a Public Cloud Service Account Enabling OBS Logging In to OBS Console Starting OBS Browser Creating Access Keys (AKs and SKs) Logging In to OBS Browser Configuring the System Managing Accounts Updating OBS Browser Feedback Managing Buckets Creating a Bucket Searching for a Bucket Viewing Basic Information About a Bucket Managing Fragments Deleting a Bucket Managing Objects Creating a Folder Accessing an Object Using Its Object URL Searching for a File or Folder Uploading a File or Folder Downloading a File or Folder Deleting a File or Folder Restoring a File Managing Bucket Properties Bucket ACL Bucket ACL Overview Setting ACL Permissions for Buckets ii

4 Contents 5.2 Lifecycle Management Lifecycle Management Overview Configuring a Lifecycle Rule Bucket Policy Bucket Policy Overview Configuring a Bucket Policy CORS CORS Overview Configuring CORS Access Logging Access Logging Overview Configuring Logging Adding External Buckets External Buckets Overview Adding External Buckets Managing Object Properties Server-Side Encryption Server-Side Encryption Overview Uploading a File with Server-Side Encryption Task Management Managing Upload Tasks Managing Download Tasks Managing Deletion Tasks Managing Restoration Tasks Typical Application Storing Video Data Backing Up and Archiving Data Troubleshooting Objects Cannot Be Globally Searched for in a Bucket Object URL Cannot Be Opened Using a Browser No Upload Task Is Created After a Large Number of Files Are Selected for Upload Using OBS Browser Blue or Black Screen of Death Occurs When Files Are Uploaded Using OBS Browser Relevant Tasks Are Not Displayed in the Task List When Objects Are Managed Using OBS Browser Time Difference Is Longer Than 15 Minutes Between the Client and the Server List of OBS Error Codes iii

5 1 Basic Knowledge of OBS 1 Basic Knowledge of OBS Object Storage Service (OBS) is an object-based storage service that provides customers with massive, secure, reliable, and cost-effective data storage capabilities, such as bucket creation, modification, and deletion, as well as object upload, download, and deletion. OBS provides super large storage capacity that can store any type of file and is suitable for websites, enterprises, developers, and common subscribers. As an Internet-based service, OBS provides web service interfaces over Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS). You can use OBS Console or OBS Browser to access and manage data stored on OBS from any Internet-connected computer anytime, anywhere. In addition, OBS supports SDKs of programming languages including Java, Python,.NET, ios, C++, Android, Ruby, and PHP, and Representational State Transfer (REST) application programming interfaces (APIs) that are compatible with Amazon S3 APIs. This way, you can easily manage your data stored on OBS and develop a wide range of upper-layer applications. Public cloud services allow infrastructures to be deployed in multiple regions and deliver flexible expansion and enhanced reliability. Users can deploy OBS in specific areas to obtain fast access speeds at an affordable price. You can access OBS using either of the following tools: OBS Console, REST API, and OBS Browser. For details about OBS, see the Object Storage Service Product Introduction. 1.1 OBS Browser Overview OBS Browser is an object storage service client that runs on a Windows operating system. It is compatible with APIs of OBS and Amazon S3, helping you manage object storage on your personal computers. Table 1-1 provides personal computer (PC) specifications required by OBS Browser. 1

6 1 Basic Knowledge of OBS Table 1-1 PC specifications required by OBS Browser Item Specifications Remarks Operating system CPU Memory Available space of the installation CD-ROM Available space of the data disk Windows XP Pro X64 Edition Windows 7 Pro SP1 32-bit Windows 7 Pro SP1 64-bit Windows 8 Pro 32-bit Windows 10 Pro 64-bit Windows Server 2008 R2 standard SP1 64-bit Windows Server 2012 standard SP1 64-bit Minimum: 2-core 1.6 GHz CPU Standard: 2-core 2.4 GHz CPU Minimum: 4 GB Standard: 8 GB Available memory >= 512 MB >=512MB >=3GB Disk space required for installing OBS Browser Disk space required for storing data files in the database of OBS Browser (The data files are stored in the system disk in the current version.) NOTICE When OBS Browser runs on a 32-bit operating system, the maximum database storage space is 2 GB. When the number of tasks in the task list is more than 1 million, OBS Browser may work incorrectly. For better experience, use a 64-bit operating system. OBS Browser has a flattened GUI, which is friendly to Windows users. For a better experience, use devices with a display resolution of 1280 x 1024 or higher. You can click at the upper right corner and choose About to view the version, or check the online help documents. 1.2 Function Description Table 1-2 describes the functions of OBS Browser: 2

7 1 Basic Knowledge of OBS Table 1-2 Function description Function Basic bucket operations Basic object operations Server-side encryption Bucket permissions Access log recording Lifecycle management Fragment management Object URL Large object upload Batch upload Multipart upload Batch download External bucket adding Task management Description Creates and deletes buckets of different storage classes in specific regions (service areas). Manages objects by uploading (including multipart uploading), downloading, and deleting objects. OBS allows users to encrypt objects using server-side encryption so that the objects can be securely stored on OBS. Manages bucket permissions, including bucket policies, access control lists (ACLs), and cross-origin resource sharing (CORS). Records bucket access requests in logs for request analysis and log audit. Supports the ability to set lifecycle rules for buckets to automatically delete expired objects. Fragments are incomplete data in buckets generated due to data upload failures. Fragment management enables you to clear fragments that have been generated. Shares data using the object URL. Uploads a single file or folder that is larger than 50 MB and less than 48.8 TB. Uploads objects in batches. Uploads objects in multiparts. Downloads objects in batches. Allow you to manage data shared by other OBS users. Allows you to upload, download, delete, and restore tasks. 3

8 2 Basic Operations on OBS Browser 2 Basic Operations on OBS Browser This chapter describes basic operations on OBS Browser. 2.1 Registering a Public Cloud Service Account Procedure You must register a public cloud service account before using OBS. Step 1 Step 2 Step 3 Step 4 Open a browser. Log in to the HUAWEI CLOUD website at Click Register. Complete the registration as instructed. 2.2 Enabling OBS Procedure After the registration is complete, you are navigated to your account information page. ----End You must recharge the account before using the OBS service. Step 1 Step 2 Step 3 Step 4 Step 5 Log in to Console. Click Recharge. The recharging window is displayed. Recharge the account as prompted. After the recharging, close the window. On the homepage, click Object Storage Service to enable the OBS service and log in to OBS Console. ----End 4

9 2 Basic Operations on OBS Browser 2.3 Logging In to OBS Console Procedure This section describes how to log in to OBS Console using a web browser. Step 1 Step 2 Step 3 Step 4 Log in to the HUAWEI CLOUD website at In the upper left corner, click Console. Log in using your account. If you have not registered with the public cloud, click Register and register a public cloud service account as prompted. On the homepage of the Console, choose All Services > Storage > Object Storage Service. ----End 2.4 Starting OBS Browser Procedure Step 1 Step 2 Step 3 Download the OBS Browser software package. The OBS Browser software package is integrated in OBS Console. Log in to OBS Console and download OBS Browser from the home page of OBS Console. If you move the pointer over Download OBS Browser, you can view information about Version, Released, and Size of OBS Browser. Decompress the OBS Browser software package to a folder whose absolute path length does not exceed 130 characters. Double-click the obs.exe file to start OBS Browser. ----End Follow-up Procedure You can directly add a user account to manage resources on OBS. Alternatively, you can close OBS Browser and log in to OBS Browser to add your account when necessary. 2.5 Creating Access Keys (AKs and SKs) Context This section describes how to create access keys (AKs and SKs) in OBS Console. A pair of AK and SK is used to encrypt the signature of a request, ensuring that the request is secure and integral, and that identities of the request sender and receiver are correct. AKs and SKs support the authentication mechanism of Identity and Access Management (IAM). Detailed explanations are as follows: 5

10 2 Basic Operations on OBS Browser An Access Key ID (AK) defines a user that accesses the OBS system. An AK belongs to only one user, but one user can have multiple AKs. The OBS system recognizes the users that access the system by their AKs. Restrictions and Limitations Prerequisites Procedure A Secret Access Key (SK) is the key used by users to access OBS. It is the authentication information generated based on the AK and the request header. SKs and AKs are in one-to-one mapping. Each user can create up to two valid AK/SK pairs. You have registered and activated a cloud account. Step 1 Step 2 Step 3 Step 4 Step 5 Log in to OBS Console. In the upper right corner of the page, click the username and select Basic Information from the drop-down list. On the displayed page, click Manage my credentials. On the My Credential page, click the Access Keys tab, and then click Add Access Key below the displayed access key list. In the Add Access Key dialog box that is displayed, enter the password and its verification code. NOTE If you have not bound an address or mobile number, you need to enter only the password. If you have bound an address and a mobile number, you can select the verification either by address or mobile number. Step 6 Step 7 Click OK. In the Download Access Key dialog box that is displayed, click OK to save the access keys to your browser's default download path. NOTE To prevent the access keys from being leaked, keep it secure. If you click Cancel in the dialog box, the access keys will not be downloaded, and you cannot download them later. You can re-create an access key if you need to use it. Step 8 Open the downloaded credentials.csv file to obtain the access keys (AK and SK). ----End Follow-up Procedure If the AK and SK are used abnormally (including loss and leakage) or they are no longer needed, click Delete on the My Credential page to delete them. When deleting the AK and SK, you need to enter the login password and either an or mobile verification code. After the AK and SK are deleted, they will be permanently deleted and cannot be restored. 6

11 2 Basic Operations on OBS Browser 2.6 Logging In to OBS Browser Procedure This section describes how to log in to OBS Browser. Step 1 Double-click obs.exe to start OBS Browser. If you are starting OBS Browser for the first time, the Add Account dialog box is automatically displayed. Go directly to Step 4. Step 2 In the upper right corner of OBS Browser, click the account name, and select Manage Accounts, as shown in Figure 2-1. Figure 2-1 Clicking Manage Accounts Step 3 Step 4 In the Manage Accounts dialog box that is displayed, click Add Account. In the Add Account dialog box, enter the account information and click OK, as shown in Figure

12 2 Basic Operations on OBS Browser Figure 2-2 Adding an OBS account The account information includes the following parameters: Account Name The account name is used only to uniquely identify an account and can be different from the OBS account registered with the public cloud services. The account name cannot exceed 50 characters. Storage Type OBS Browser can connect to OBS or other storage compatible with Amazon S3. When connecting OBS Browser to OBS, select OBS. When connecting OBS Browser to storage compatible with Amazon S3, select S3 compatible storage. Specify Server Address. You can enter the IP address or domain name in the following format: serverip address or domain name:server port (the protocol port of HTTPS is 443 and that of HTTP is 80), as shown in Figure 2-3. The HTTPS server is used by default. If you want to use the HTTP server, click in the upper right corner and click System Configuration. In the System Configuration dialog box that is displayed, deselect Enable HTTPS. 8

13 2 Basic Operations on OBS Browser Figure 2-3 Adding an OBS account AK and SK Enter the AK and SK created in My Credential after you register with a storage service, such as OBS. For details about how to obtain an AK and SK, see section 2.5 Creating Access Keys (AKs and SKs). Remember my SK is selected by default. If you do not select Remember my SK, you must configure SK each time you log in to OBS Browser. Information about the new account is displayed in the Manage Accounts dialog box. Step 5 Step 6 Click OK. You can log in to OBS Browser using the account and check bucket and object resources owned by the account. Optional: To manage objects owned by multiple accounts on OBS Browser, click the account name and Manage Accounts to add multiple accounts. You can click a desired account to switch to the account. ----End 2.7 Configuring the System This section describes how to modify system configurations. 9

14 2 Basic Operations on OBS Browser Procedure Step 1 Log in to OBS Browser. Step 2 In the upper right corner of OBS Browser, click and click System Configuration. The System Configuration dialog box is displayed, as shown in Figure 2-4. Figure 2-4 Configuring the system Step 3 In the System Configuration dialog box, modify parameters on the General tab page. Table 2-1 describes the parameters that can be modified. Table 2-1 General configurations on OBS Browser Parameter Enable HTTPS Enable KMS encryption Description If this option is selected, all communication information is encrypted and transferred to OBS over HTTPS. If Enable HTTPS and Enable KMS encryption are selected, KMS encryption will be implemented for all objects uploaded to OBS. 10

15 2 Basic Operations on OBS Browser Parameter Multipart Upload, Part Size (MB) Max Number of Upload Tasks Max Number of Download Tasks Language Description Objects whose size is larger than the specified part size (5 MB by default) are segmented and uploaded in the OBS background. The size of each segment can be set in this dialog box. The value of Part Size (MB) can range from 5 MB to 5 GB. This item is selected by default. NOTE Multipart upload is used by default. Recommended settings of Part Size (MB) are as follows: To maximize client performance, set Part Size (MB) based on the upload speed. The optimal Part Size (MB) is larger than the maximum upload speed. For example, if the maximum upload speed is 10 MB/s, set Part Size (MB) to an integer greater than 10 MB. It is recommended that the part size be set to a value two to three times the maximum upload speed. Specifies the maximum number of upload tasks. Enter an integer ranging from 2 to 20. Specifies the maximum number of download tasks. Enter an integer ranging from 5 to 50. Selects the language of the display. Changes take effect after the software is restarted. Step 4 Optional: Click Network and add proxy server information, as shown in Figure 2-5. Table 2-2 Network configurations on OBS Browser Parameter Enable proxy Authentication Description If this option is selected, the Authentication option is displayed. Set the following parameters to access OBS through the proxy server: Address: domain name or IP address of the proxy server Port: port of the proxy server (default port is 8080) If this option is selected, you need to enter the username and password when connecting the proxy server for authentication. Username: login username of the proxy server. Password: login password of the proxy server. 11

16 2 Basic Operations on OBS Browser Figure 2-5 Network configurations Step 5 Optional: Click Other and add other configuration information, as shown in Figure 2-6. Table 2-3 Other configurations of OBS Browser Parameter Enable automatic update check Join in the user experience improvement project Object Count on Each Page Description If this option is selected, each time when you log in to OBS Browser, a check will be automatically performed to determine whether the current software version is the latest. Before selecting Join in the user experience improvement project, click View details and carefully read User experience improvement project. Sets the number of objects that are displayed on each page. The default value is 100. The value ranges from 50 to 300. After setting the value, click the button in the upper right corner of the page so that the setting takes effect. 12

17 2 Basic Operations on OBS Browser Parameter Task Count in Task List Description Sets the number of tasks that are displayed in the task list. The default value is 100. The value ranges from 50 to 150. After setting the value, click the button in the upper right corner of the page so that the setting takes effect. NOTE Tasks in the task list are displayed on only one page. If the actual number of tasks exceeds that you set to display, the exceeding tasks are not displayed in the task list. However, the task list updates in real time to display unfinished tasks. Figure 2-6 Other configurations Step 6 Click Save to save the system configuration. ----End 2.8 Managing Accounts Add an Account This section describes how to manage multiple accounts on OBS Browser. OBS Browser supports a maximum of five accounts. 13

18 2 Basic Operations on OBS Browser Step 1 Step 2 Log in to OBS Browser. In the upper right corner of OBS Browser, click the account name, and select Manage Accounts, as shown in Figure 2-7. Figure 2-7 Clicking Manage Accounts Step 3 Step 4 In the Manage Accounts dialog box that is displayed, click Add Account. In the Add Account dialog box, enter the account information. The account information includes the following parameters: Account Name The account name is used only to uniquely identify an account and can be different from the OBS account registered with the public cloud services. The account name cannot exceed 50 characters. Storage Type OBS Browser can connect to OBS or other storage compatible with Amazon S3. When connecting OBS Browser to OBS, select OBS. When connecting OBS Browser to storage compatible with Amazon S3, select S3 compatible storage. Specify Server Address. You can enter the IP address or domain name in the following format: serverip address or domain name:server port (the protocol port of HTTPS is 443 and that of HTTP is 80). The HTTPS AK and SK server is used by default. If you want to use the HTTP server, click in the upper right corner and click System Configuration. In the System Configuration dialog box that is displayed, deselect Enable HTTPS. Enter the AK and SK created in My Credential after you register with a storage service, such as OBS. For details about how to obtain an AK and SK, see section 2.5 Creating Access Keys (AKs and SKs). Remember my SK is selected by default. If you do not select Remember my SK, you must configure SK each time you log in to OBS Browser. Step 5 Click OK. After saving the account information, you can click the account name in the upper corner of the page and the newly added account is displayed in the account name drop-down list. You can click the desired account to switch to from the current login account. ----End 14

19 2 Basic Operations on OBS Browser Modifying an Account Step 1 Step 2 Log in to OBS Browser. In the upper right corner of OBS Browser, click the account name, and select Manage Accounts, as shown in Figure 2-8. Figure 2-8 Clicking Manage Accounts Step 3 Step 4 Step 5 Click Edit in the row where the desired account resides. Modify the account information as required. Click OK to save the modification. ----End Deleting an Account Step 1 Step 2 Log in to OBS Browser. In the upper right corner of OBS Browser, click the account name, and select Manage Accounts, as shown in Figure 2-9. Figure 2-9 Clicking Manage Accounts Step 3 Step 4 Click Delete in the row where the desired account resides. Click OK and the account is deleted. ----End 2.9 Updating OBS Browser This section describes how to update OBS Browser. 15

20 2 Basic Operations on OBS Browser Procedure Every time you log in to OBS Browser, the system automatically checks for update by default. If the current version is not the latest, upgrade the software as instructed. If you log in to OBS Browser, click in the upper corner of the page, select System Configuration, click Other in the System Configuration dialog box that is displayed, and deselect Automatic Update Check. Manually upgrade OBS Browser as follows: Step 1 Log in to OBS Browser. Step 2 In the upper right corner, click and select Check for Update, as shown in Figure Figure 2-10 Clicking Check for Update Step 3 Update the OBS Browser version as instructed. Click on OBS Browser. Then click Check for Update. If It is already the latest version is displayed, the upgrade is successful. ----End 2.10 Feedback Context Procedure This section describes how to feed back your comments or suggestions on OBS using OBS Browser. Statistics on user comments and suggestions as well as function usage must be collected and analyzed to continuously improve operation experience and product performance, boosting customer satisfaction. Step 1 Log in to OBS Browser. 16

21 2 Basic Operations on OBS Browser Step 2 In the upper right corner of OBS Browser, click. Then click Feedback, as shown in Figure Figure 2-11 What Happened Step 3 In the dialog box that is displayed, enter the problems that you encounter and suggestions, your address, and phone number. Your contact information is used for us to reach you quickly. Your personal data will be anonymized, encrypted, and sent to our company for us to improve our products and services. The data will neither be disclosed or shared, nor be used for other products. You can capture screenshots of problems you encounter during OBS Browser usage and send them to us. ----End 17

22 3 Managing Buckets 3 Managing Buckets This chapter describes a series of bucket management operations. OBS Browser supports three methods of bucket management. This document takes the first method as an example to describe bucket management operations. 1. Click the blank area in the row where the bucket to be managed resides. You can manage the bucket using the buttons displayed above the bucket list, as shown in Figure 3-1. Figure 3-1 First method 2. Click the operation buttons in the row of the bucket to be managed, as shown in Figure 3-2. Figure 3-2 Second method 3. Right-click the blank area in the row where the bucket to be managed resides. A shortcut menu is displayed for managing the bucket, as shown in Figure

23 3 Managing Buckets Figure 3-3 Third method 3.1 Creating a Bucket Procedure On OBS, buckets are containers where objects are stored. Before you store data onto OBS, you need to create buckets. Step 1 Step 2 Step 3 Log in to OBS Browser. In the upper left corner on the page, click Create Bucket. In the Create Bucket dialog box that is displayed, as shown in Figure 3-4, enter the bucket information as required. 19

24 3 Managing Buckets Figure 3-4 Creating a Bucket Table 3-1 Creating a Bucket Parameter Region Storage Class Bucket Name Description Region where the bucket to be created is located. OBS has the following storage classes: Standard, Infrequent Access, and Archive. In such a manner, OBS comprehensively meets customers' requirements on storage performance and costs. Standard: features low access latency and high throughput. Infrequent Access: applicable to storing semi-frequently accessed (less than 12 times a year) data requiring quick response. Archive: applicable to archiving rarely-accessed (once a year) data. Name of the bucket to be created. The bucket name must be globally unique and comply with the following rules: Contains 3 to 63 characters, including lowercase letters, digits, hyphens (-), and periods (.) Cannot be an IP address Cannot start or end with a hyphen (-) or period (.) Cannot contain two consecutive periods (.), for example, my..bucket. Cannot contain periods (.) and hyphens (-) adjacent to each other, for example, my-.bucket or my.-bucket. 20

25 3 Managing Buckets You can move the pointer over behind the Bucket Name text box to view the naming rules for a bucket. A user can create a maximum of 100 buckets on OBS. NOTE When a URL is used to access a bucket, the bucket name will become a part of the URL. According to the DNS rule, URLs do not support uppercase letters and cannot be used to access a bucket whose name contains uppercase letters. Therefore, a bucket name can contain only lowercase letters, digits, hyphens (-), and periods (.) For example, if you attempt to access bucket MyBucket using the URL, bucket mybucket will be accessed instead, causing an access error. DNS naming can standardize the bucket naming globally, facilitating the resolution when accessing a bucket. Users can benefit from new functions and optimized features, and static website hosting is then applicable to buckets. Once you create a bucket, you cannot change the name of it. Make sure that the bucket name you set is appropriate. Step 4 In the dialog box that is displayed, click OK. NOTE In a multi-region scenario, if you create a bucket in a region, delete it from the region later, and immediately create a bucket with the same name in another region, the system will show a message stating that the bucket failed to be created. In this case, wait one hour and create a bucket with the same name again. Then, the system will show a message stating that the bucket has been successfully created. ----End Region Information Configuration The Region information can be configured on OBS Browser. The following details the configuration procedure: 1. Open file region in folder OBS Browser in the decompression path of OBS Browser. 2. Change the value of parameter options in file region. Enter the region information to be added to the end of parameter options in the following format: {"key":"region alias","value":"region"} The newly added information must be in the JSON format. The following describes the parameters. key indicates a user-defined region alias. Its value is in the Region drop-down list in the Create Bucket dialog box. For a convenient view, you are advised to enter not more than 25 characters. value indicates Region. Enter its value based on Region supported by OBS. Each time when a Region is added, a group of values will be added to options, that is, {"key":"region alias","value":"region"}. Groups of values are separated by commas (,). The following provides two configuration examples of newly added region01 and region02. Keep the values of other parameters in file region unchanged. "options":[{"key":"test_region01","value":"region01"}, {"key":"test_region02","value":"region02"}] 3. After file region is successfully modified, restart OBS Browser so that the configurations can take effect. 21

26 3 Managing Buckets 3.2 Searching for a Bucket Procedure This section describes how to search for a bucket by entering characters contained in its name on OBS Browser. Step 1 Step 2 Log in to OBS Browser. In the search box in the upper right corner on the main page, enter characters contained in the name of the desired bucket. Step 3 Click. The found buckets are displayed in the bucket list. If you want to search for another bucket, click to delete the keyword you entered and enter a bucket name again. If you want to quickly switch to another bucket on the object list page, you can click on the left side to expand the hidden bucket list and search for the desired bucket in the search box above the bucket list. For example, if you want to search for buckets whose names contain the test characters, you only need to enter test in the search box in the upper right corner on the main page and click ----End. Then, all buckets that contain test in their names are displayed in the bucket list. 3.3 Viewing Basic Information About a Bucket Procedure This section describes how to view basic information about a bucket, including the owner, capacity, location, and object quantity using OBS Browser. Step 1 Step 2 Step 3 Log in to OBS Browser. Click the blank area in the row of the bucket about which you want to query the basic information and click Basic. On the Basic page displayed as Figure 3-5, view basic information about the bucket. Table 3-2 Parameter description Parameter Owner Storage Class Description Owner of the bucket. It indicates the current account on OBS. Storage class of a bucket, The value can be Standard, Infrequent Access, or Archive. 22

27 3 Managing Buckets Parameter Space Used Number of Objects Region Domain ID Created Description Total capacity used by objects in the bucket. Number of the objects stored in the bucket. Region where the bucket is stored. Unique identity of the bucket owner. It is the same as Domain ID on the My Credential page. Time when the creation of a bucket is completed. Figure 3-5 Basic information about the bucket ----End 3.4 Managing Fragments Fragment management enables you to clear fragments that were generated due to object upload failures. Context The following lists examples of situations where fragments may be generated due to data upload failures. 23

28 3 Managing Buckets The network is in poor condition, and the connection to the OBS server is interrupted frequently. The upload task is manually interrupted. The device is faulty. The device is powered off suddenly. The fragments need to be cleared to free up space. Procedure Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket and choose More > Manage Fragments, as shown in Figure 3-6. Figure 3-6 Choosing Manage Fragments Step 3 In the Manage Fragments dialog box, select a fragment and click. You can click Clear above the object list to delete all the fragments. Click Check to refresh the fragment list. Step 4 Step 5 In the Warning dialog box that is displayed, confirm upload task information and click OK. Click OK. The Manage Fragments dialog box is displayed. You can close the dialog box to return to the OBS Browser home page. ----End 3.5 Deleting a Bucket This section describes how to delete a bucket. Prerequisites The bucket to be deleted is empty. 24

29 3 Managing Buckets Only the bucket owner can delete a bucket. Before deleting a bucket, ensure that all objects in the bucket have been deleted and no multipart upload tasks are running in the bucket. Procedure Step 1 Step 2 Log in to OBS Browser. Select the bucket to be deleted and click Delete. NOTE The interval between deleting a bucket and creating another bucket with the same name as the deleted bucket varies in different application scenarios. Step 3 Click OK. ----End 25

30 4 Managing Objects 4 Managing Objects Objects are basic data units that users operate in OBS. This chapter describes a series of object management operations. Right-click the blank area in the object list and a shortcut menu is displayed. You can choose Upload File, Upload Folder, or Create Folder to manage objects. OBS Browser supports three methods of object management. This document takes the first method as an example to describe object management operations. 1. Click the blank area in the row where the object to be managed resides. You can manage the object using the buttons displayed in the upper part, as shown in Figure 4-1. Figure 4-1 First method 2. Click the operation buttons in the row of the object to be managed, as shown in Figure 4-2. Figure 4-2 Second method 3. Right-click the blank area in the row where the object to be managed resides. A shortcut menu is displayed for managing the object, as shown in Figure

31 4 Managing Objects Figure 4-3 Third method 4.1 Creating a Folder Context Procedure This section describes how to create a folder using OBS Browser. There are no files or folders on OBS. For easy data management, OBS provides a method to simulate folders. On OBS, an object is simulated as a folder by adding a slash (/) to the object name on OBS Browser. Step 1 Step 2 Step 3 Log in to OBS Browser. Click the bucket in which you want to create a folder. Click Create Folder. In the dialog box that is displayed, enter a folder name and click OK. The folder name cannot contain special characters, such as \/:*?"<>. The folder name cannot start or end with a period (.). The folder name cannot exceed 1023 bytes. The length of a folder name is the sum of the length of its own and the length of its upper-level directories, and cannot exceed 1023 bytes. Levels of directories are automatically separated by slashes (/). For example, if the upper-level directory of folder01 is folder02, file name length is calculated based on folder02/folder01/. NOTE If an access denial message is displayed when you are creating a folder, the possible causes are as follows: The access permission for the bucket is restricted by the ACL. For example, the user has no write permission for the bucket. The access permission for the bucket is restricted by the bucket policy. For example, the user is forbidden to write data to the bucket during the current period of time, the user has no write permission for the bucket, or server-side encryption is not enabled on OBS Browser, which is against the bucket policy. Consequently, when the message is displayed, check ACL settings and bucket policy settings to resolve the problem. Step 4 Click OK. ----End 27

32 4 Managing Objects 4.2 Accessing an Object Using Its Object URL Prerequisites Procedure The object uniform resource locator (URL) (object sharing) function allows anonymous users to access object data using object URLs. Assign an anonymous user the permission to read the specified object using OBS Console. For details about how to assign ACL permissions to objects, see Setting ACL Permissions for Objects in the Object Storage Service Console Operation Guide. Step 1 Log in to OBS Browser. Step 2 Click the bucket for which you want to configure the object URL function, and click next to the object to be shared to view the object URL, as shown in Figure 4-4. Figure 4-4 Object properties Step 3 If you select S3 compatible storage when logging in to OBS Browser, the object URL is in the format of server IP address or domain name/bucket name/directory level/object name. If the object is in the root directory of the bucket, the URL does not contain a directory level. If you select OBS when logging in to OBS Browser, the object URL is in the format of name.domain name/directory level/object name. If the object is in the root directory of the bucket, the URL does not contain a directory level. Click Copy to copy the object URL to the browser. Then you can access the object. Troubleshooting NOTE To allow Anonymous User to access objects stored in an Archive bucket using the URL, ensure that the objects are in the Restored state. The method of using a browser to access objects varies depending on the object type. You can directly open.txt and.html files using a browser. However, when you open.exe and.dat files using a browser, the files are automatically downloaded to your local computer. ----End If an error message similar to the following is displayed when you are accessing an object using the object URL, configure the Read permission for Anonymous User on 28

33 4 Managing Objects OBS Console. For details about how to configure the permission, see Setting ACL Permissions for Objects in the Object Storage Service Console Operation Guide. After configuring the permission, repeat Step3. <Error> <Code>AccessDenied</Code> <Message>Access Denied</Message> <RequestId> E B18BC86A3FBD65I</RequestId> <HostId> bcmaseve9j9ty/mg646e5xkf5d2jtbhcmxxt6teficxllgbauvuxjj3hl8zfh+b2 </HostId> </Error> If an error message similar to the following is displayed when you are accessing an object using the object URL, it indicates that the object has been encrypted and an encrypted object cannot be accessed using the object URL. <Error> <Code>InvalidRequest</Code> <Message> The object was stored using a form of Server Side Encryption. The correct parameters must be provided to retrieve the object. </Message> <RequestId> E B282B2D4D98C59P</RequestId> <HostId> heawau3vymy64ms9bipt6mt37agwb3sifx6wjuxzyuw9+vraclou4gprquzop+st </HostId> </Error> 4.3 Searching for a File or Folder Procedure This section describes how to search for a file or folder by name prefix on OBS Browser. Step 1 Step 2 Step 3 Log in to OBS Browser. Click the bucket where the target file or folder resides. In the search box in the upper right corner on the object management page that is displayed, enter the name prefix of the desired file or folder. Step 4 Click. The found files or folders are displayed in the object list. If you want to search for other files or folders, click in the search box to delete the keyword and enter the characters contained in the names of the files or folders for which you want to search. For example, if you want to search for files or folders whose name prefix is testobject in bucket mybucket, go to the object management page, enter testobject in the search box in the upper right corner on the page, and click testobject are displayed in the object list.. All files or folders whose name prefix is ----End 4.4 Uploading a File or Folder You can upload local files or folders to OBS. 29

34 4 Managing Objects Context Files are uploaded in multiparts on OBS Browser. You can upload a single file up to 48.8 TB in multiparts. The file or folder name cannot exceed 1023 bytes. The length of a file or folder name is the sum of the length of its own and the length of its upper-level directories, and cannot exceed 1023 bytes. Levels of directories are automatically separated by slashes (/). For example, if the upper-level directory of file01 is folder01, the file name length is calculated based on folder01/file01. Procedure Step 1 Step 2 Step 3 Log in to OBS Browser. Click the bucket to which you want to upload files or folders. Click Upload. Then click Upload File or Upload Folder. If you use the Upload File function, it is a good practice to upload a maximum of 100 files at a time for better user experience. If you need to upload more files, place the files in a folder and use the Upload Folder function to upload the folder. NOTE 1. If a message stating "Service Unavailable" is displayed when files are being uploaded, try again later. 2. If an access denial message is displayed when you are uploading a file or folder, the possible causes are as follows: The access permission for the bucket is restricted by the ACL. For example, the user has no write permission for the bucket. The access permission for the bucket is restricted by the bucket policy. For example, the user is forbidden to write data to the bucket during the current period of time, the user has no write permission for the bucket, or server-side encryption is not enabled on OBS Browser, which is against the bucket policy. Consequently, when the message is displayed, check ACL settings and bucket policy settings to resolve the problem. Step 4 In the dialog box that is displayed, select the file or folder that you want to upload and click Open. You can upload a folder or multiple files at a time. To upload multiple files, hold down Ctrl or Shift to select multiple files. You can also select all the files on the current page by holding down Ctrl+A. The operations are consistent with those on the Windows operating system. The file or folder upload progress is displayed on the task management page. You can suspend, run, or cancel an upload task based on site requirements. For details, see section 7.1 Managing Upload Tasks. Step 5 Click OK. ----End 4.5 Downloading a File or Folder This section describes how to download a file or folder from OBS to a local computer. 30

35 4 Managing Objects Procedure Step 1 Step 2 Log in to OBS Browser. Click the bucket from which you want to download a file or folder. Then select a file or folder and click Download. You can hold down Ctrl or Shift to select files or folders and batch download them. You can also select all the files or folders on the current page by pressing Ctrl+A. The operations are consistent with those on the Windows operating system. NOTE Before downloading Archive files, ensure that they are in the Restored state. For details, see section 4.7 Restoring a File. Step 3 In the dialog box that is displayed, select a path to save the file or folder and click OK. The file or folder download progress is displayed on the task management page. You can suspend, delete, or cancel a download task based on site requirements. For details, see section 7.2 Managing Download Tasks. ----End 4.6 Deleting a File or Folder Context Procedure This section describes how to delete a file or folder. Deleting a folder will delete all files in the folder. Ensure that all files in a folder can be deleted before deleting the folder. Deleting unnecessary files or folders saves space and costs. You can use the lifecycle management function to implement periodic deletion of unneeded files or batch delete all files or folders in OBS. For details, see section Configuring a Lifecycle Rule. Step 1 Step 2 Log in to OBS Browser. Click the bucket from which you want to delete a file or folder. Then select a file or folder and click Delete. You can hold down Ctrl or Shift to select multiple files or folders and batch delete them. You can also select all the files or folders on the current page by pressing Ctrl+A. The operations are consistent with those on the Windows operating system. Step 3 Click OK. The file or folder deletion progress is displayed on the task management page. You can suspend or cancel a deletion task based on site requirements. For details, see section 7.3 Managing Deletion Tasks. ----End 31

36 4 Managing Objects 4.7 Restoring a File Context Procedure You need to restore objects stored in an Archive bucket before downloading them. OBS Archive is applicable to archiving rarely-accessed (once a year) data. The application scenarios include data archiving and long-term data retention for backup. OBS Archive is secure, durable, and inexpensive, which can replace tape libraries. However, it can take up to hours to restore data from OBS Archive. If an Archive object is being restored, you cannot suspend or delete the restoration task. You cannot restore an object that is in the Restoring state. Step 1 Step 2 Log in to OBS Browser. Click the bucket in which the file that you want to restore resides. The object list is displayed. Step 3 Click after the file that you want to restore. Alternatively, you can select an object and click on the top of the object list. Before restoring objects, you need to configure the validity period and restoration speed of the objects. Table 4-1 describes the parameters. Table 4-1 Parameters for restoring objects Parameter Name Bucket Validity Period Description Name of the object to be restored. Bucket where the object to be restored resides. Time duration when an object remains in the Restored state after being restored. The timing starts as the object restoration is completed. The value is an integer ranging from 1 to 30 (unit: day). The default value is 30 days. For example, you set Validity Period to 20 when restoring an object. After 20 days starting from the time when the object is successfully restored, the object's status will change from Restored to Not restored. 32

37 4 Managing Objects Parameter Speed Description Restoration speed of an object. Expedited: Expedited retrievals allow you to quickly access your data when occasional urgent requests for a subset of archives are required. For all but the largest archived objects (over 250 MB), data accessed using Expedited retrievals is typically made available within 1 minute to 5 minutes. Standard: Standard retrievals allow you to access any of your archived objects within several hours. Standard retrievals typically complete within 3 hours to 5 hours. Step 4 Click OK to confirm the restoration of Archive files. Click and the Properties dialog box is displayed, as shown in Figure 4-5. You can view the restoration status. Figure 4-5 Properties of the restored object You can download the file only after its status changes to Restored. You can click the Refresh button in the upper right corner to refresh the restoration tasks and to view the restoration progress. The system also automatically refreshes the restoration tasks every 5 minutes. NOTE ----End The system checks the file restoration status once per day at 00:00 (GMT±00:00). The expiration time is counted starting from the time when the last check was complete. For example, an object was restored at 16:00, on March 7 (GMT+08:00) and it was set to be valid for one day. The system performs the next check at 08:00, on March 8 (GMT+08:00). The object will expire at 08:00, on March 9 (GMT+08:00). 33

38 4 Managing Objects Follow-up Procedure Within the validity period of an object, you can repeatedly restore the object. The validity period of the object is counted starting from the time when the latest restoration is completed. By doing so, you can prolong the validity period of an object. NOTE If an object is to be restored for a second time, the expiration time set for the second restoration must be later than that set for the first restoration. For example, an object is Restored and its expiration time is set to 4/12/ :00:00 GMT+08:00. After the object is restored for the second time, the expiration time must be set to a time point later than 4/12/ :00:00 GMT+08:00. 34

39 5 Managing Bucket Properties 5 Managing Bucket Properties 5.1 Bucket ACL This chapter describes management operations related to bucket properties, including bucket ACLs, bucket lifecycles, bucket policies, cross-origin resource sharing (CORS), access logging, and external buckets. Bucket access permissions can be controlled using access control lists (ACLs) or bucket policies. This section describes how to set a bucket ACL Bucket ACL Overview OBS provides account-based ACLs to assign specific access permissions to accounts. An ACL can restrict all users' permissions to access a single bucket or an object. The permissions include read-only permission, write permission, and full control permission. By default, only the creator of a bucket and users under the same domain as the creator can access the bucket and objects in the bucket. All users under the same domain have the same permissions. A user can set access policies for users under other domains. For example, a user can set the public read permission for a bucket to allow all users to read the bucket. ACLs are only used to grant permissions. OBS can use an ACL to enable bucket access permissions to be assigned to the following types of authorized users, as described in Table 5-1. Table 5-1 Authorized users supported by OBS Authorized User Bucket Owner Anonymous User Description By default, the owner of a bucket has the ACL View and ACL Edit permissions and the two permissions cannot be modified. A user that is not registered with OBS. If the access permission for a bucket and objects is assigned to an anonymous user, all users can access the bucket and objects. 35

40 5 Managing Bucket Properties Authorized User Registered User Log Delivery User Description A user that is registered with OBS. The user accesses OBS using AKs and SKs. A user that delivers bucket access logs. The user is configured for bucket log management. OBS supports the following types of access permissions, as listed in Table 5-2. Table 5-2 Access permissions supported by OBS Permission Read Write ACL View ACL Edit Full Control Description A grantee with this permission for a bucket can obtain the list of objects in the bucket and the metadata of the bucket. A grantee with this permission for a bucket can upload, overwrite, and delete any object in the bucket. A grantee with this permission can obtain the ACL of a bucket or object. A bucket or object owner has this permission permanently. A grantee with this permission can update the ACL of a bucket or object. A bucket or object owner has this permission permanently. NOTE A grantee with this permission can modify the access control policy and thus the grantee obtains full access permissions. Exercise caution when assigning this permission to other users. A grantee with this permission for a bucket has Read, Write, ACL View, and ACL Edit permissions for the bucket. NOTE Users assigned the permission can fully control the bucket and its objects. Exercise caution when assigning this permission to other users. NOTE A request supports a maximum of 100 permissions. Granting new permissions for a bucket overwrites the existing permissions for the bucket and no permissions are added for the bucket. If no ACL permission is assigned for a new bucket, OBS automatically disables the access to the bucket and objects by other users except the bucket owner Setting ACL Permissions for Buckets You can set ACL permissions of the Owner, Anonymous User, Registered User, and Log Delivery User. 36

41 5 Managing Bucket Properties Procedure Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket for which you want to set ACL permissions and click Configure Permission. Step 3 Set ACL permissions for the bucket and click Save, as shown in Figure 5-1. Figure 5-1 Configuring permissions If no ACL permission is assigned for a new bucket, OBS automatically disables the access to the bucket and objects by other users except the bucket owner. ----End 5.2 Lifecycle Management Lifecycle management means periodically deleting objects in a bucket by configuring rules. This section describes lifecycle management and its configuration methods Lifecycle Management Overview Lifecycle management applies to the following scenarios: Some periodically uploaded files need only to be retained for one week or one month, and can be deleted once they have expired. Documents are seldom accessed after a certain period of time, and need to be deleted. You can define lifecycle rules for identifying objects and manage lifecycles of the objects based on the rules. After unnecessary files are deleted, less OBS storage space is required, saving your costs. Lifecycle rules have two key elements: Configuration policy You can also specify the prefix of object names so that objects whose names have this prefix are restricted by the rules. You can configure a lifecycle rule for a bucket so that all objects in the bucket can be restricted by the lifecycle rule. 37

42 5 Managing Bucket Properties Expiration time: You can specify the number of days after which objects are automatically deleted or the day after which an object that matches with a rule is deleted Configuring a Lifecycle Rule Procedure You can configure a lifecycle management rule for a bucket, and applicable objects in the bucket will be managed by the rule. Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket for which you want to configure a lifecycle rule and choose More > Configure Lifecycle Rule, as shown in Figure 5-2. Figure 5-2 Choosing Configure Lifecycle Rule Step 3 In the Configure Lifecycle Rule dialog box, click Add, as shown in Figure 5-3. Step 4 Select Enable and configure required parameters, and click Save. Status Select Enable to enable the lifecycle rule. Policy Match lifecycle rules with the prefixes of object names so that objects with such name prefixes can be restricted by the lifecycle rules. You can also configure a lifecycle rule for a bucket so that all objects in the bucket can be restricted by the lifecycle rule. NOTE When By prefix is selected and the specified prefix and the prefix of an existing lifecycle rule overlap, OBS regards the two rules as one and disables your rule. For example, if a rule with prefix abc exists in the system, another rule whose prefix contains abc cannot be configured. If a lifecycle rule whose Policy is set to By prefix has been configured, you cannot configure a lifecycle rule whose Policy is set to For the entire bucket. If a lifecycle rule whose Policy is set to For the entire bucket has been configured, you cannot configure a lifecycle rule whose Policy is set to By prefix. The Add button becomes unavailable. Expiration Time 38

43 5 Managing Bucket Properties By day specifies the number of days after which an object is automatically deleted. By date specifies the day after which objects that match with a rule are deleted. Rule Name identifies lifecycle rules. The Rule Name contains a maximum of 255 characters. Figure 5-3 Adding a lifecycle rule For example, the following files are stored on OBS on January 7, 2015: log/test1.log log/test2.log doc/example.doc doc/good.txt The following files are stored on OBS on January 10, 2015: log/clientlog.log log/serverlog.log doc/work.doc doc/travel.txt If the expiration time of objects prefixed with log/ is set to January 11, 2015 on January 10, 2015, OBS will delete objects log/test1.log, log/test2.log, log/clientlog.log, and log/ serverlog.log on January 12, On the current day, if you set the objects with the name prefix log/ to be transitioned to Infrequent Access 30 days later, transitioned to Archive 60 days later, and deleted 100 days later, then OBS will transition log/clientlog.log, log/serverlog.log, log/test1.log, and log/test2.log to Infrequent Access on the 31st day, transition them to Archive the 61st day, and delete them on the 101st day. If the expiration time of objects prefixed with log/ is set to January 8, 2015 on January 10, 2015, OBS will delete objects log/test1.log and log/test2.log that were last modified before January 8, 2015 on January 10, 2015 but will not delete objects log/clientlog.log and log/serverlog.log that were stored on OBS the same day. NOTE The deletion of an object may be delayed after the time condition is met. Generally, the delay does not exceed 48 hours. 39

44 5 Managing Bucket Properties Step 5 In the Configure Lifecycle Rule dialog box, click Save to save the lifecycle rule. ----End Follow-up Procedure You can click Edit or Delete to edit or delete a configured lifecycle rule. 5.3 Bucket Policy Bucket access permissions can be controlled using ACLs or bucket policies. This section describes how to set a bucket policy Bucket Policy Overview A bucket owner can compile a bucket policy to control the access permission for the bucket. Bucket policies provide centralized access control over buckets and objects based on a variety of conditions, including OBS operations, requesters, resources, and aspects of the request (for example IP addresses). The permissions attached to a bucket apply to all of the objects in that bucket. Individuals as well as enterprises can use bucket policies. When an enterprise registers with OBS, an account is created. Thereafter, the enterprise becomes synonymous with the account. Accounts are financially responsible for the resources they (and their employees) create. Accounts have the power to grant bucket policy permissions and assign employees permissions based on a variety of conditions. For example, an account can create a policy that gives a user write access: To a particular bucket From an account's corporate network From an account's custom application Policies can either add or deny permissions across all (or a subset) of objects within a bucket. With one request, an account can set the permissions of any number of objects in a bucket Configuring a Bucket Policy Procedure A bucket policy defines the access control policy of resources (buckets and objects) on OBS. Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket for which you want to configure a bucket policy and choose More > Configure Bucket Policy, as shown in Figure

45 5 Managing Bucket Properties Figure 5-4 Choosing Configure Bucket Policy Step 3 In the Configure Bucket Policy dialog box, enter a bucket policy. The following are two examples of bucket policy configurations. 1. Grant a permission to an OBS account. In the following example, the account (whose Domain ID is 783fc6652cf246c096ea836694f71855) is assigned the permission to obtain the log management information about bucket logging.bucket3. { "Id":"Policy ", "Statement":[ { "Sid":"Stmt ", "Action":[ "s3:getbucketlogging" ], "Effect":"Allow", "Resource":"arn:aws:s3:::logging.bucket3", "Principal":{ "AWS": [ "arn:aws:iam::783fc6652cf246c096ea836694f71855:root" ] } } ] } Table 5-3 describes an example of parameters that you need to manually modify: Table 5-3 Parameters to be modified Parameter GetBucketLogging Description Value of the Action field that indicates the operation set in the policy and performed on the bucket. The Action field indicates all operations supported by OBS and contains a string of caseinsensitive characters. The value supports a wildcard character (*) that indicates all operations, for example, "Action": ["s3:list*", "s3:get*"]. Enter a value based on actual conditions. 41

46 5 Managing Bucket Properties Parameter Allow logging.bucket3 783fc6652cf246c096ea836694f71855 Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. Target bucket on which the policy works. The bucket name varies based on actual conditions. Domain ID of an account. The Domain ID needs to be modified based on actual conditions. You can click after the target bucket to view the Domain ID in the Basic dialog box that is displayed. 2. Grant an OBS user a permission. In the following example, the user (whose User ID is 71f e ea2c26d1999) of the account (whose Domain ID is 219d520ceac84c5a98b237431a2cf4c2) is assigned the permission to set log management for bucket logging.bucket3. { "Id":"Policy ", "Statement":[ { "Sid":"Stmt ", "Action":[ "s3:putbucketlogging" ], "Effect":"Allow", "Resource":"arn:aws:s3:::logging.bucket3", "Principal":{ "AWS":[ "arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:user/ 71f e ea2c26d1999" ] } } ] } Table 5-4 describes an example of parameters that you need to manually modify: Table 5-4 Parameters to be modified Parameter PutBucketLogging Description Value of the Action field that indicates the operation set in the policy and performed on the bucket. The Action field indicates all operations supported by OBS and contains a string of caseinsensitive characters. The value supports a wildcard character (*) that indicates all operations, for example, "Action": ["s3:list*", "s3:get*"]. Enter a value based on actual conditions. 42

47 5 Managing Bucket Properties Parameter Allow logging.bucket3 219d520ceac84c5a98b237431a2cf4c2 Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. Target bucket on which the policy works. The bucket name varies based on actual conditions. Domain ID of an account. The Domain ID needs to be modified based on actual conditions. You can click after the target bucket to view the Domain ID in the Basic dialog box that is displayed. 71f e ea2c26d1999 User ID of a user. The User ID needs to be modified based on actual conditions. You can click the username in the upper right corner of the page and select Basic Information from the drop-down list. On the displayed page, click Manage my credentials. Then you can see the User ID. Table 5-5 describes the parameters of bucket policies. All fields except the Effect field are optional. Table 5-5 Parameters in bucket policies Parameter Description Ma nda tor y or Not Version The version that is consistent with Amazon S3. The value can be or Opti onal Id The ID of the bucket policy. The value must be unique. Opti onal 43

48 5 Managing Bucket Properties Parameter Description Ma nda tor y or Not Statement Effect The description of the bucket policy. The statement defines complete permission control. Each bucket policy can have multiple statements, and each statement contains the following parameters: Sid Effect Principal NotPrincipal Action NotAction Resource NotResource Condition The effect of the bucket policy. The statement can be sent to accept or reject requests. Possible values are Allow and Deny. Ma ndat ory Ma ndat ory Sid The statement ID. Opti onal Principal/ NotPrincipal Action/ NotAction Resource/ NotResourc e The user on whom the bucket policy statement takes effect. Either Principal or NotPrincipal must be selected to specify the user on whom the bucket policy statement takes effect or does not take effect. The OBS operation on which the bucket policy statement takes effect. Either Action or NotAction must be selected to specify whether the bucket policy statement takes effect on the OBS operation. The object on which the bucket policy statement takes effect. Either Resource or NotResource must be selected to specify whether the bucket policy statement takes effect on the OBS resources. Ma ndat ory Ma ndat ory Ma ndat ory Condition Indicates the conditions for a statement to take effect. Opti onal ----End Example 1. Assigning specific users the permission to obtain objects in specific buckets 44

49 5 Managing Bucket Properties In the following example, the user (whose User ID is ac49fefeb fbaf43249eb73ed) of the account (whose Domain ID is 783fc6652cf246c096ea836694f71855) is assigned the permission to obtain all objects in bucket mybucket. Table 5-6 describes an example of parameters that you need to manually modify: Table 5-6 Parameters to be modified Parameter Allow 783fc6652cf246c096ea836694f71855 ac49fefeb fbaf43249eb73ed GetObject mybucket/* Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. Domain ID of an account. The Domain ID needs to be modified based on actual conditions. You can click the username in the upper right corner of the page and select Basic Information from the dropdown list. On the displayed page, click Manage my credentials. Then you can see the Domain ID. User ID of a user. The User ID needs to be modified based on actual conditions. You can click the username in the upper right corner of the page and select Basic Information from the drop-down list. On the displayed page, click Manage my credentials. Then you can see the User ID. Value of the Action field that indicates the operation set in the policy and performed on the bucket. The Action field indicates all operations supported by OBS and contains a string of caseinsensitive characters. The value supports a wildcard character (*) that indicates all operations, for example, "Action": ["s3:list*", "s3:get*"]. Enter a value based on actual conditions. Target object on which the policy works. The object varies based on actual conditions. A wildcard character (*) indicates all objects in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement":[ { 45

50 5 Managing Bucket Properties "Effect":"Allow", "Sid":"1", "Principal":{ "AWS":["arn:aws:iam::783fc6652cf246c096ea836694f71855:user/ ac49fefeb fbaf43249eb73ed"] }, "Action":["s3:GetObject"], "Resource":"arn:aws:s3:::mybucket/*" } ] } 2. Limiting specific addresses' permission to access specific buckets In the following example, the permission of address to access all objects in bucket mybucket is limited. Table 5-7 describes an example of parameters that you need to manually modify: Table 5-7 Parameters to be modified Parameter Deny Wildcard character (*) in Principal Wildcard character (*) in Action mybucket/* Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. The user on whom the bucket policy statement takes effect. A wildcard character (*) indicates that the policy works on all users. The OBS operation on which the bucket policy statement takes effect. A wildcard character (*) indicates all OBS actions, such as GetObject and PutObject. Target object on which the policy works. The object varies based on actual conditions. A wildcard character (*) indicates all objects in bucket mybucket. Address whose access to OBS is restricted. { } "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Deny", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition": {"StringEquals":{"aws:Referer":[" } } ] 46

51 5 Managing Bucket Properties 3. Listing objects in a bucket with conditions In the following example, only account 219d520ceac84c5a98b237431a2cf4c2 is allowed to list objects prefixed with Obj in bucket mybucket. Table 5-8 describes an example of parameters that you need to manually modify: Table 5-8 Parameters to be modified Parameter Allow 219d520ceac84c5a98b237431a2cf4c2 ListBucket mybucket Obj Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. Domain ID of an account. The Domain ID needs to be modified based on actual conditions. You can click the username in the upper right corner of the page and click the username and select Basic Information from the drop-down list. On the displayed page, click Manage my credentials. Then you can see the Domain ID. Value of the Action field that indicates the operation set in the policy and performed on the bucket. The Action field indicates all operations supported by OBS and contains a string of caseinsensitive characters. The value supports a wildcard character (*) that indicates all operations, for example, "Action": ["s3:list*", "s3:get*"]. Enter a value based on actual conditions. Target bucket on which the policy works. The bucket name varies based on actual conditions. Objects that are selected by prefixes for listing. The value needs to be modified based on actual conditions. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement":[ { "Effect":"Allow", "Sid":"1", "Principal":{"AWS":["arn:aws:iam:: 219d520ceac84c5a98b237431a2cf4c2:root"]}, "Action":["s3:ListBucket"], "Resource":"arn:aws:s3:::mybucket", "Condition":{"StringEquals":{"s3:prefix":"Obj"}} 47

52 5 Managing Bucket Properties } ] } 4. Limiting the start time and end time of accessing objects in a bucket In the following example, the start time of accessing all objects in bucket mybucket by all users is set. Table 5-9 describes an example of parameters that you need to manually modify: Table 5-9 Parameters to be modified Parameter Allow Wildcard character (*) in Principal Wildcard character (*) in Action mybucket/* T12:00:00Z T15:00:00Z Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. The user on whom the bucket policy statement takes effect. A wildcard character (*) indicates that the policy works on all users. The OBS operation on which the bucket policy statement takes effect. A wildcard character (*) indicates all OBS actions, such as GetObject and PutObject. Target object on which the policy works. The object varies based on actual conditions. A wildcard character (*) indicates all objects in bucket mybucket. Start time of accessing the bucket. End time of accessing the bucket. { } "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Allow", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition": { "DateGreaterThan":{ "aws:currenttime":" t12:00:00z"}, "DateLessThan":{"aws:CurrentTime":" T15:00:00Z"} } } ] 5. Limiting access to OBS from specific IP addresses 48

53 5 Managing Bucket Properties The following policy grants all users the permission to perform any OBS operation on objects in a specific bucket. However, the requests must be from the specified IP address range. Table 5-10 describes an example of parameters that you need to manually modify: Table 5-10 Parameters to be modified Parameter Allow Wildcard character (*) in Principal Wildcard character (*) in Action examplebucket/* Description Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value of the Effect field must be Allow or Deny. The user on whom the bucket policy statement takes effect. A wildcard character (*) indicates that the policy works on all users. The OBS operation on which the bucket policy statement takes effect. A wildcard character (*) indicates all OBS actions, such as GetObject and PutObject. Target object on which the policy works. The object varies based on actual conditions. A wildcard character (*) indicates all objects in bucket mybucket /32 IP address range that is not allowed to access OBS. The value needs to be modified based on actual conditions /24 IP address range that is allowed to access OBS. The value needs to be modified based on actual conditions. { "Version":" ", "Id":"01", "Statement":[ { "Sid":"1", "Effect":"Allow", "Principal":{ "AWS":[ "*" ] }, "Action":[ "s3:*" ], "Resource":[ "arn:aws:s3:::examplebucket/*" ], "Condition":{ "NotIpAddress":{ "aws:sourceip":[ 49

54 5 Managing Bucket Properties } ] } } " /32" ] }, "IpAddress":{ "aws:sourceip":[ " /24" ] } 5.4 CORS CORS Overview CORS is a browser standard mechanism provided by the World Wide Web Consortium (W3C). It defines the interaction methods between client-side web applications in one origin and resources in another origin. In web page requests, website scripts and contents in one origin cannot interact with those in another origin because of Same Origin Policies (SOPs). This section introduces CORS and describes how to configure CORS. OBS supports CORS rules and allows resources on OBS to be accessed across origins. OBS CORS is used in the following scenarios: Enables JavaScript and HTML5 to be used for establishing web applications that can directly access resources on OBS. No proxy servers are required for transfer. Enables the dragging function of HTML5 to be used to upload files to OBS (with the upload progress displayed) or update OBS contents using web applications. Hosts external web pages, style sheets, and HTML5 applications in different origins. Web fonts or pictures on OBS can be shared by multiple websites. The configuration of CORS takes effect within two minutes Configuring CORS Procedure This section describes how to use CORS in HTML5 to implement cross-origin access. OBS has the following storage classes: Standard, Infrequent Access, and Archive. Archive buckets do not support CORS. Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket for which you want to configure CORS and choose More > Configure CORS Rule, as shown in Figure

55 5 Managing Bucket Properties Figure 5-5 Choosing Configure CORS Rule Step 3 Click Add. NOTE You can set a maximum of 100 CORS rules for OBS. Step 4 In the Add CORS Rule dialog box that is displayed, as shown in Figure 5-6, enter CORS rules. Figure 5-6 Add CORS Rule Table 5-11 describes parameters in CORS rules. 51

56 5 Managing Bucket Properties Table 5-11 Parameters in CORS rules Parameter Allowed Origin Allowed Method Allowed Header Exposed Header Cache Duration (s) Description Mandatory Requests from this origin can access the bucket. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character (*) at most. For example: Specifies the acceptable operation type of buckets and objects. The methods include GET, POST, PUT, DELETE, and HEAD. Mandatory Specifies the allowed header of cross-origin requests. Only CORS requests matching the allowed header are valid. You can enter multiple allowed headers (one per line) and each line can contain one wildcard character (*) at most. Spaces and special characters including &:< are not allowed. Optional Specifies the exposed header in CORS responses, providing additional information for clients. You can enter multiple exposed headers (one per line). Spaces and special characters including *&:< are not allowed. Optional Specifies the duration that your browser can cache CORS responses, expressed in seconds. The default value is 100. Mandatory Step 5 Step 6 Click OK. The Configure CORS Rule dialog box is displayed. Click OK to save the rules. After CORS is successfully configured, only the addresses specified in Allowed Origin can access a bucket on OBS using the method specified in Allowed Method. For example, you configure CORS parameters of bucket testbucket as follows: Allowed Origin: Allowed Method: GET Allowed Header: left blank Exposed Header: left blank Cache Duration (s):

57 5 Managing Bucket Properties Then, OBS only allows GET requests from origin to access bucket testbucket without restricting the request headers. Your browser can cache the CORS requests for 100 seconds. ----End Follow-up Procedure 5.5 Access Logging New rules are displayed in the Configure CORS Rule dialog box. You can select a rule and modify or delete it. For the analysis or audit purpose, you can enable log management. Access logs enable a bucket owner to analyze the property, type, or trend of requests to the bucket in depth. When the log management function of a bucket is enabled, OBS will log access requests for the bucket automatically, and write the generated log files to the specified bucket (target bucket). This section describes the access logging function and how to configure log management Access Logging Overview OBS can record bucket access requests in logs for request analysis and log audit. Logs occupy some OBS storage space rented by users, causing extra fees. For this reason, OBS does not collect bucket access logs by default. After log management is configured, you can view the operation logs in the target bucket that stores the logs within approximately five minutes. The following shows the access log of the target bucket: 787f2f92b a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43: ] f2f92b a4fe2ab75eb09b BACAD9376ECE141B842B94535B REST.GET.BUCKET.LOCATION - "GET /bucket?location HTTP/1.1" "-" "HttpClient" - Table 5-12 lists the information contained in the access log of each bucket. Table 5-12 Bucket log format Name Description Example BucketOwner ID of the bucket owner 787f2f92b a4fe2ab75eb09b8 Bucket Bucket name bucket Time Request timestamp [13/Aug/2015:01:43: ] Remote IP Request IP address Requester ID of the requester 787f2f92b a4fe2ab75eb09b8 RequestID ID of the request BACAD9376ECE141B842B94 535B Operation Operation REST.GET.BUCKET.LOCATION 53

58 5 Managing Bucket Properties Name Description Example Request-URI Request URI GET /bucket?location HTTP/1.1 HTTPStatus Return code 200 BytesSent Size of the HTTP response, expressed in bytes 211 TotalTime Processing time on the server 6 Turn- AroundTime Total request processing time Configuring Logging Prerequisites Procedure After logging is enabled for a bucket, OBS automatically converts bucket logs into objects following the naming rules and writes the objects into a specific bucket. The log delivery user group has been assigned the Write and ACL View permissions for the target bucket. For details, see section Setting ACL Permissions for Buckets. Step 1 Step 2 Log in to OBS Browser. Click the blank area in the row of the bucket for which you want to configure logging and choose More > Configure Log Function, as shown in Figure 5-7. Figure 5-7 Choosing Configure Log Function Step 3 Select Enable, select a value for Target Bucket, enter a value for Target Prefix, and click Save, as shown in Figure 5-8. Target Bucket indicates the bucket storing logs. Target Prefix indicates the prefix of a log file name. After logging is enabled, generated logs are named using the following format: 54

59 5 Managing Bucket Properties <TargetPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString> <TargetPrefix> indicates the specific target prefix. YYYY-mm-DD-HH-MM-SS indicates the date and time when the log is generated. <UniqueString> indicates a character string generated by OBS. On OBS Browser, if configured <TargetPrefix> ends with a slash (/), logs generated in the bucket are stored in the <TargetPrefix> folder in the target bucket to facilitate management. For example: If the target bucket is bucket and target prefix is bucket-log/, all logs are stored in the bucket-log/ folder in bucket. The log file is named as follows: N7MXLAF1BDG7MPDV. If the target bucket is bucket and target prefix is bucket-log, all logs are directly stored in bucket. The log file is named as follows: bucket-log N7MXLAF1BDG7MPDV. After log management is configured, you can view the operation logs in the target bucket that stores the logs within approximately five minutes. Figure 5-8 Log management ----End 5.6 Adding External Buckets After external buckets are added, they can be accessed locally. This section describes how to add and configure external buckets External Buckets Overview OBS enables you to add buckets of other users if you have the access permission for the buckets. By doing so, you can access the external buckets locally using your account. By default, after user A has added a bucket of user B and uploaded an object to the bucket, user B cannot download the object. Users cannot mount a bucket whose storage class is Archive. 55

60 5 Managing Bucket Properties Adding External Buckets Prerequisites OBS Browser supports the external bucket adding function. The current account has been assigned the ACL permissions to access the buckets of other users. For example, account A needs to add bucket bucket_share of account B to itself so that account A can read objects stored in bucket bucket_share. Account B needs to obtain Domain ID of account A and set the Read permission on bucket bucket_share for account A using OBS Console. Account A can click after the target bucket to view the Domain ID (same as the owner ID) in the Basic dialog box that is displayed. If account B has set the Read permission on bucket bucket_share for Registered User, all registered users can add bucket bucket_share. For details about how to set permissions for Registered User, see section Setting ACL Permissions for Buckets. Procedure NOTE Currently, you can only use OBS Console to set ACL permissions of a specific user. However, you can use both OBS Console and OBS Browser to set ACL permissions of Registered User. Step 1 Step 2 Step 3 Log in to OBS Browser. In the upper left corner on the page, click Create Bucket. Select Add external bucket for Method. In the Bucket Name text box, enter the name of the external bucket to be added and click OK, as shown in Figure 5-9. Figure 5-9 Adding an external bucket 56

61 5 Managing Bucket Properties After successfully adding an external bucket, you can see the external bucket in the bucket list and have the ACL access permissions for the bucket. ----End Example If you are assigned the Write and Read permissions for bucket test, you can leverage external bucket adding to add bucket test to a local computer using your account. You can see bucket test in the bucket list on the left and have the write permission for the bucket. That is, you can upload objects to, overwrite objects in, and delete objects from the bucket. 57

62 6 Managing Object Properties 6 Managing Object Properties Objects are basic data units that users operate in OBS. This chapter describes how to encrypt uploaded files on the server. 6.1 Server-Side Encryption Server-side encryption secures stored objects at a higher level. This section introduces serverside encryption and describes how to configure it Server-Side Encryption Overview After server-side encryption is enabled, objects to be uploaded will be encrypted and stored on the server. When downloading the encrypted objects, the encrypted data will be decrypted on the server and displayed in plaintext to users. Key Management Service (KMS) uses Hardware Secure Modules (HSMs) to ensure key security, enabling users to easily create and manage encryption keys. Keys are not displayed in plaintext outside HSMs, which prevents key disclosure. All operations performed on keys are controlled and logged, and usage of all keys is recorded, meeting regulatory compliance requirements. OBS Browser supports server-side encryption with KMS-managed keys (SSE-KMS). In SSE- KMS mode, OBS uses the keys provided by KMS for server-side encryption. OBS browser supports SSE-KMS encryption by invoking APIs Uploading a File with Server-Side Encryption OBS allows users to encrypt objects using server-side encryption so that the objects can be securely stored on OBS. Prerequisites The KMS Administrator permission has been added in the region of OBS using Identity and Access Management (IAM). For details about how to add the permission, see How Do I Manage User Groups and Grant Permissions to Them? in the Identity and Access Management User Guide. 58

63 6 Managing Object Properties Procedure Step 1 Log in to OBS Browser. Step 2 In the upper right corner on the page, click. Step 3 Choose SystemConfiguration > General. The System Configuration dialog box is displayed, as shown in Figure 6-1. Figure 6-1 System Configuration Step 4 Select Enable HTTPS and Enable KMS encryption. If Enable HTTPS and Enable KMS encryption are selected, KMS encryption will be implemented for all objects uploaded to OBS. After objects are uploaded, click on the right of the object list. In the Properties dialog box that is displayed, as shown in Figure 6-2, view the object encryption status. KMS encryption indicates that server-side encryption has been implemented for the object. No indicates that server-side encryption has not been implemented for the object. The object encryption status cannot be changed. NOTE HTTPS must be enabled when you enable KMS encryption to upload objects. Therefore, if you deselect Enable HTTPS, Enable KMS encryption is deselected automatically. 59

64 6 Managing Object Properties Figure 6-2 Properties of the encrypted object NOTE Server-side encryption does not support HTTP. To use server-side encryption, enable HTTPS. Do not delete the encryption key that is being used for an encrypted object. Otherwise, the encrypted object cannot be downloaded. ----End 60

65 7 Task Management 7 Task Management OBS supports concurrent file or folder uploads or downloads. Using OBS Browser, you can easily manage the upload, deletion or download tasks. In the right corner of the task management page, you can view the numbers of all uncompleted tasks, completed tasks, and total tasks. You can manually adjust the column width of the task list. In the lower left corner of the Completed task list, you can set the number of completed tasks displayed on each page. If the number of displayed items exceeds 200,000, the system will save the first 100,000 items of tasks that are created earlier to the history directory in the installation path of OBS Browser. These items are saved in the historydbdata[time stamp].csv format, for example, historydbdata t csv. 7.1 Managing Upload Tasks Context Prerequisites Procedure This section describes how to manage upload tasks using OBS Browser. An upload task may be suspended or canceled, or an upload failure may occur when data is being uploaded to OBS. You can use upload task management to manage upload tasks. You have upload tasks to be managed. Step 1 Log in to OBS Browser. Step 2 In the upper right corner on the page, click. Step 3 In the upper right corner, select Upload from the drop-down list. The list of running upload tasks is displayed, as shown in Figure

66 7 Task Management Figure 7-1 Upload task list Upload tasks may fail due to various causes. To view the causes, choose All statuses > Failed. You can select a failed upload task and click to perform the task again. Alternatively, you can move the pointer over task to view the causes. in the Status column of the failed upload Step 4 Optional: Select an ongoing upload task and click to suspend the task. Alternatively, you can click Suspend All to suspend all tasks. Select a suspended upload task and click Run All to resume all suspended tasks. to resume the task. Alternatively, you can click Step 5 Optional: Select an ongoing upload task and click to cancel the task. Alternatively, you can click Cancel All to delete all tasks. Step 6 Optional: Click the Completed button on the top of the page to view completed tasks. You can also click after a completed task to delete the task or click Delete All on the top of the page to delete all completed upload tasks. ----End 7.2 Managing Download Tasks Prerequisites Procedure This section describes how to manage download tasks using OBS Browser. You have download tasks to be managed. Step 1 Log in to OBS Browser. Step 2 In the upper right corner on the page, click. Step 3 In the upper right corner, select Download from the drop-down list. The list of running download tasks is displayed, as shown in Figure

67 7 Task Management Figure 7-2 Download task list Download tasks may fail due to various causes. To view the causes, choose All statuses > Failed. You can select a failed download task and click to perform the task again. Alternatively, you can move the pointer over download task to view the causes. in the Status column of the failed Step 4 Optional: Select an ongoing download task and click to suspend the task. Alternatively, you can click Suspend All to suspend all tasks. Select a suspended download task and click click Run All to resume all suspended tasks. to resume the task. Alternatively, you can Step 5 Optional: Select an ongoing download task and click to cancel the task. Alternatively, you can click Cancel All to delete all tasks that are being uploaded, downloaded, deleted. Step 6 Optional: Click the Completed button on the top of the page to view completed tasks. You can also click after a completed task to delete the task or click Delete All on the top of the page to delete all completed download tasks. ----End 7.3 Managing Deletion Tasks This section describes how to manage deletion tasks using OBS Browser. Prerequisites You have deletion tasks to be managed. Procedure Step 1 Log in to OBS Browser. Step 2 In the upper right corner on the page, click. Step 3 In the upper right corner, select Delete from the drop-down list. The list of running deletion tasks is displayed, as shown in Figure

68 7 Task Management Figure 7-3 Deletion task list Deletion tasks may fail due to various causes. To view the causes, choose All statuses > Failed. You can select a failed deletion task and click to perform the task again. Alternatively, you can move the pointer over task to view the causes. in the Status column of the failed deletion Step 4 Optional: Select an ongoing deletion task and click to suspend the task. Alternatively, you can click Suspend All to suspend all tasks. You can click to resume a suspended deletion task. Alternatively, you can click Run All to resume all suspended tasks. Step 5 Optional: Select an ongoing deletion task and click to cancel the task. Alternatively, you can click Cancel All to delete all tasks that are being uploaded, downloaded, deleted. Step 6 Optional: Click the Completed button on the top of the page to view completed tasks. You can also click after a completed task to delete the task or click Delete All on the top of the page to delete all completed deletion tasks. ----End 7.4 Managing Restoration Tasks This section describes how to manage restoration tasks using OBS Browser. Prerequisites You have restoration tasks to be managed. Procedure Step 1 Log in to OBS Browser. Step 2 In the upper right corner on the page, click. Step 3 In the upper right corner, select Restore from the drop-down list. The list of running restoration tasks is displayed, as shown in Figure

69 7 Task Management Figure 7-4 Restoration task list Restoration tasks may fail due to various causes. To view the causes, you can move the pointer over in the Status column of the failed restoration task to view the causes. You cannot view Speed and Remaining Time. However, you can click on the right of the object to view its restoration status in the Properties dialog box, as shown in Figure 7-5. Figure 7-5 Properties of the restored object You can download the file only after its status changes to Restored. You can click the Refresh button in the upper right corner to refresh the restoration tasks and to view the restoration progress. The system also automatically refreshes the restoration tasks every 5 minutes. NOTE You cannot suspend or cancel a running restoration task. Step 4 Optional: Click the Completed button on the top of the page to view completed tasks. You can also click after a completed task to delete the task or click Delete All on the top of the page to delete all completed restoration tasks. ----End 65

70 8 Typical Application 8 Typical Application 8.1 Storing Video Data Context A user is a film lover and has a large number of videos to be stored. However, this user's disk cannot be expanded in real time. For this reason, the user hopes to use OBS to store videos. The user needs personal data to be isolated and protected from that of other users and resumable data transfer to be available during the upload of large files. Procedure Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Start OBS Browser. In the Add Account dialog box, enter required information to create an account upon the initial start of OBS Browser. Click Create Bucket to create a bucket for storing data. Click the created bucket. Click Create Folder to create a folder. Click Upload to upload a file or folder. Click Manage Tasks. Click Suspend, Run or Cancel to manage the file being uploaded. ----End Follow-up Procedure To obtain files stored on OBS, you can start OBS Browser and download the files to a local computer. 66

71 8 Typical Application 8.2 Backing Up and Archiving Data Context Procedure OBS has the following storage classes: Standard, Infrequent Access, and Archive. In such a manner, OBS comprehensively meets customers' requirements on storage performance and costs. OBS Infrequent Access is applicable to storing semi-frequently accessed (less than 12 times a year) data requiring quick response. The application scenarios include static website hosting, file synchronization or sharing, and enterprise-level backup. It provides the same durability, access latency, and throughput as OBS Standard but at a lower price. OBS Archive is applicable to archiving rarely-accessed (once a year) data. The application scenarios include data archiving and long-term data retention for backup. OBS Archive is secure, durable, and inexpensive, which can replace tape libraries. OBS charging is based on consumed storage capacity and service time. For example, a company has a large number of video or audio data to be backed up or archived in OBS. In the initial period of time, these files may be frequently accessed. However, these files may not be accessed any more, after a certain period of time. Therefore, the company can delete the files that are not to be accessed any more, to reduce cost and use OBS more efficiently. You can use OBS Console and OBS Browser to store data. When using OBS for data backup or archive, you may need to store a large amount of data. In such cases, you can use OBS Browser to upload the data in batches. The batch upload function of OBS Browser greatly shortens the time for data upload. Step 1 Step 2 Log in to OBS Console. Create the AK and SK that will be used to access OBS Browser. 1. In the upper right corner of the page, click the username and select Basic Information from the drop-down list. 2. On the displayed page, click Manage my credentials. 3. My Credential page is displayed. Choose Access Keys > Add Access Key, as shown in Figure 8-1. Each user can create a maximum of two valid access keys. Figure 8-1 Add access key 67

72 8 Typical Application 4. Enter the required information as prompted and save the new access key. NOTE To prevent access key from being leaked, keep it secure. If you click Cancel in the Confirm dialog box, the access key will not be downloaded and cannot be downloaded later. You must delete this access key and create one later when necessary. Step 3 Use the access key created in Step 2 to log in to OBS Browser, as shown in Figure 8-2. Figure 8-2 Add an OBS account Step 4 Create different storage types of buckets based on different application scenarios. Backup scenario: Click Create Bucket. On the displayed dialog box, select Infrequent Access for Storage Class. Enter the bucket name and the selected region and click OK to create a bucket of the Infrequent Access storage class to store the backup data, as shown in Figure

73 8 Typical Application Figure 8-3 Create Bucket Archive scenario: Click Create Bucket. On the displayed dialog box, select Archive for Storage Class. Enter the bucket name and the selected region and click OK to create a bucket of the Archive storage class to store the archive data, as shown in Figure

74 8 Typical Application Figure 8-4 Create Bucket Step 5 Upload the data to be backed up or archived to the newly created bucket. Step 6 Click the icon at the upper left corner of the displayed page to return to the bucket list. Step 7 Right-click the bucket where the backup or archive data is stored, and select Configure Lifecycle Rule to go to the life cycle configuration page. Step 8 Click Add, as shown in Figure 8-5. In the Add Lifecycle Rule dialog box, configure life cycle management rules. Status: If you select Enable, this lifecycle rule is enabled. Policy: Select By prefix, and objects have the defined prefix will be managed by the lifecycle rule. You can also configure the lifecycle rule for a bucket, so that all objects in the bucket will be managed by the lifecycle rule. NOTE When By prefix is selected and the specified prefix and the prefix of an existing lifecycle rule overlap, OBS regards the two rules as one and disables your rule. For example, if a lifecycle rule configured by the prefix named abc exists in the system, you cannot configure a lifecycle rule containing abc in its prefix. If a lifecycle rule has been configured by prefix, you cannot configure this lifecycle rule for the entire bucket. If a lifecycle rule has been configured for the entire bucket, you cannot configure this lifecycle rule by prefix. The Add Lifecycle Rule button is displayed in grey, indicating unavailability for operations. Expiration Time: You can set the expiration time for objects based on your needs. 70

75 8 Typical Application By day: Indicates the number of days that an object is retained, after which the object is automatically deleted. By date: Indicates that an object is automatically deleted after the set date. Rule Name: Indicates the name of a lifecycle rule. The maximum length of the name is 255 characters. Figure 8-5 Add Lifecycle Rule For example, if you have uploaded the backup data to store in OBS for two years. You can set the lifecycle rule as follows: Status: Select Enable to enable this lifecycle rule. Policy: Select For the entire bucket. Expiration Time: You can set the expiration time in either of the following two ways: By day: Set the value to 720, indicating that the object is to be deleted in 720 days. By date: Specify a date that is later than a certain date in two years, indicating the backup data will be deleted after the specified date. Rule Name: Define a name for the lifecycle rule within the maximum length of 255 characters. NOTE The deletion of the object after the expiration time may be delayed. The delay is restricted to 48 hours. Step 9 Click Save to save the lifecycle rule. ----End 71

76 9 Troubleshooting 9 Troubleshooting 9.1 Objects Cannot Be Globally Searched for in a Bucket Question Answer Why cannot objects be globally searched for in a bucket? OBS Browser does not support iterative query of objects in a bucket but supports query of objects in a directory only. If you want to search for an object, go to the directory where the object resides and search for the object. For example, if the root directory of bucket abc contains folder A and object B and folder A contains object C, object C cannot be searched for in the root directory of bucket abc. It can be searched for only in folder A. 9.2 Object URL Cannot Be Opened Using a Browser Question Answer Why cannot an object URL be opened using a browser? If the Bucket Policy rules forbid the user from accessing the object or Read is not assigned to Anonymous User in the ACL of the object, the user cannot open the object URL using a browser. If Read for an object is assigned to Anonymous User but the Bucket Policy rules forbid the user from accessing the object, the user cannot open the object URL using a browser because the priority of Bucket Policy is higher than that of the ACL. You can solve this problem as follows: (Perform Step 1 to Step 2 to check whether the Bucket Policy rules forbid the user from accessing the object. Perform Step 3 to Step 7 to assign Read for the object to Anonymous User.) 72

77 9 Troubleshooting Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Log in to OBS Browser. Choose More > Configure Bucket Policy and check whether the Bucket Policy rules forbid the user from accessing the object. If yes, delete the Bucket Policy rules and try again. Log in to OBS Console. Select the bucket where the objects to be shared are stored, and go to the Overview page. In the navigation tree on the left, click Object. Click the target object. In the ACL, assign Read Permission to the Anonymous User. Select Read behind Anonymous Use, as shown in Figure 9-1. Figure 9-1 Object permissions Step 7 Click Save. ----End 9.3 No Upload Task Is Created After a Large Number of Files Are Selected for Upload Using OBS Browser Question Why is no upload task created and nothing displayed on the page after a large number of files are selected for upload using OBS Browser? For example, after a user logs in to OBS Browser and chooses Upload > Upload File to select a large number of files from drive C for upload, no upload task is created and nothing is displayed on the page. Answer The Upload File function of OBS Browser allows 100 files to be uploaded at the same time. If more files need to be uploaded, place the files in a folder and use the Upload Folder function to upload the folder. Also, the total name length of all files to be uploaded cannot exceed approximately 25,500 characters. If the name length exceeds this threshold, the system stops responding to the upload request. 73

78 9 Troubleshooting 9.4 Blue or Black Screen of Death Occurs When Files Are Uploaded Using OBS Browser Question Why does blue or black screen of death occur when files are uploaded using OBS Browser? Answer When OBS Browser is used to upload a large number of files or a few of big files, most of the memory is used. Check whether the available memory space of the PC is greater than or equal to 512 MB. If the available memory space of the PC is smaller than 512 MB, close some application programs to release the memory, or add new memory or virtual memory to the PC. If the problem persists after memory is added, collect dump files based on the following procedure, and contact customer service personnel for locating and solving this problem. Step 1 Right-click Computer and choose Properties from the shortcut menu. In the dialog box that is displayed, click the Advanced tab. On the Advanced tab page, click Settings. In the dialog box that is displayed, view the path under Dump file. Figure 9-2 shows a screenshot of the Windows 7 Pro SP1 64-bit operating system, which is used as an example. Figure 9-2 Viewing the Dump file path 74