Object Storage Service. User Guide. Issue 01. Date

Transcription

1 Issue 01 Date

2 Contents Contents 1 Introduction Definition Basic Concepts Object Bucket AK/SK Region Advantages Accessing OBS Using Domain Names Access Control ACL Bucket Policy Signature Verification Access Log Record Lifecycle Management Static Website Hosting CORS URL Validation Adding External Buckets Fragment Management Versioning Control Object URL Quick Start Registering an public cloud Account Enabling the OBS Service Creating an Access Key Using OBS on the Management Console Logging In to the Management Console Issue 01 ( ) ii

3 Contents Managing Buckets Managing Files and Folders Typical Application Using OBS Through OBS Browser Installing OBS Browser Logging In to OBS Browser Managing Buckets Managing Files and Folders Typical Application Using OBS SDKs Obtaining More Resources Issue 01 ( ) iii

4 1 Introduction 1 Introduction About This Chapter This chapter describes the concepts, advantages, data security and reliability, and tariff of object storage service (OBS). 1.1 Definition 1.2 Basic Concepts 1.3 Advantages 1.1 Definition OBS provides customers with massive, secure, reliable, and cost-effective data storage capabilities, including bucket creation, modification, and deletion as well as object upload, download,and deletion. It applies to the storage of any type of file and is suitable for ordinary subscribers, websites, enterprises, and developers. Oriented to Internet access, OBS provides web service interfaces based on Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Service (HTTPS). Users can use the OBS management console to access and manage data stored on OBS from any computer connected to the Internet anytime, anywhere. In the mean time, OBS is compatible with most Amazon S3 interfaces. Users can invoke Representational State Transfer (REST) application programming interfaces (APIs) of OBS and software development kits (SDKs) to develop software adapting to upper-layer applications or connect to the Amazon S3 storage, so that the users can focus on service applications and ignore underlying storage implementation technologies. Public cloud service enables infrastructure to be deployed in multiple areas and delivers flexible expansion and enhanced reliability. Users can deploy OBS in specific areas based on site requirements to obtain rapid access speed at an affordable price. OBS provides an ultra-large storage capacity. It also provides a browser-based visualized and unified management console (browser/server architecture), host-based clients (client/server architecture), SDKs (Java, Python, PHP,.Net, Android, and C++), and REST APIs that are compatible with Amazon S3 interfaces to help users easily manage their own data stored on OBS and develop a wide array of upper-layer applications. OBS has the following functions: Issue 01 ( ) 1

5 1 Introduction Creates and deletes buckets in specific regions (service areas). Manages objects, including uploading (such as multipart upload),downloading, copying,and deleting objects. Manages bucket permissions, including bucket policies, access control lists (ACLs), and cross-origin resource sharing (CORS). Manages bucket versioning, allowing multiple versions of objects to exist in a bucket. Supports website attribute setting of buckets, achieving static website hosting. Sets lifecycle management policies for buckets to automatically delete expired objects. Sets web page redirection to redirect bucket requests to specified hosts. Provides the URL validation function to prevent object links on OBS from being stolen by other websites. Provides a variety of management and development platforms, such as a management console, clients, SDKs (Java, Python, PHP,.Net, Android, C++, and Ruby), and REST APIs. OBS provides storage resources for: Massive storage resource pool Enterprise cloud disk Static website hosting Cloud backup Video surveillance and archive Big Data storage 1.2 Basic Concepts Object This section describes concepts related to OBS, including the object, bucket, access key ID (AK)/secret key ID (SK), and region. An object is a basic data unit on OBS. It consists of object data and object metadata that describes object attributes. The data uploaded to OBS is stored in Bucket as objects. An object consists of the key, metadata, and data. Key: specifies the object name. An object key is a character string containing 1 to 1024 characters in the UTF-8 format. The object key for each object in a bucket must be unique. Metadata: specifies the object description. Metadata contains system metadata and user metadata. All the metadata is uploaded to OBS as key-value pairs. System metadata is automatically generated by OBS and is used for processing object data. It includes Date, Content-length, Last-modify, and Content-MD5. User metadata is specified when users upload objects. Users adopt the metadata to describe their objects. Data: Specifies the object data. Generally, objects are managed as files. However, OBS is an object-based storage service and it does not involve the file and folder concepts. For easy data management, OBS provides a Issue 01 ( ) 2

6 1 Introduction Bucket method to simulate folders. After adding a slash (/) in an object name, for example, test/123.jpg, you can simulate test as a folder and 123.jpg as the name of a file under the test folder. However, the key remains test/123.jpg. On the OBS management console, you can directly use folders. A bucket is a container used to store objects on OBS. OBS provides flat storage methods based on buckets and objects. All objects in a bucket are on the same logical layer, eliminating multi-layer directory structures in file systems. On OBS, the bucket name must be unique and cannot be changed. When a bucket is created, its ACL is generated by default. The items in the ACL include permissions of authorized users such as the read (READ), write (WRITE), and full control (FULL_CONTROL) permissions. Only authorized users can perform operations related to buckets, including creating, deleting, and viewing a bucket as well as setting the ACL of a bucket. A user can create a maximum of 100 buckets. However, the number and total size of objects in a bucket are not restricted. Users do not need to consider data expandability. As OBS is based on REST HTTP and HTTPS, you can use uniform resource locators (URLs) to locate resources. For example, if object test/123.jpg is stored in bucket testbucket and the bucket is located in the OBS Germany Bonn zone (the domain name is obs.eu-de.otc.t-systems.com), you can use URL to locate the object. Figure 1-1 illustrates the relationship between objects and buckets. Figure 1-1 Relationship between objects and buckets AK/SK AKs and SKs are key pairs used to access OBS. When OBS APIs are used to access stored data, AKs and SKs are used to generate authentication information for security authentication. After subscribing to the OBS service, you can log in to the OBS management console and create AKs and SKs based on site requirements. The system identifies users who access the system by AK, and SKs are used for key authentication. Issue 01 ( ) 3

7 1 Introduction Region One AK maps to only one user but one user can have multiple AKs. One SK maps to one AK, forming a key pair for accessing OBS and thereby ensuring access security. When creating a bucket, you can specify a region (an Amazon region) for the bucket based on your requirements for the price, response latency, and request source. The specified region cannot be changed after the bucket is created. After a bucket is created, all objects uploaded to the bucket will be stored in the data center. 1.3 Advantages Compared with storage systems constructed by enterprises and household storage systems, OBS delivers: Higher availability OBS uses the node redundancy design that ensures robust reliability of object data and service node networks. The availability ratio is up to 99.99%. Enhanced data reliability OBS stores object data in multiple copies and uses automatic repair technology that ensures the consistency of the copies to improve the reliability of object data. The data durability is up to %. That is, in every 100 billion user files on OBS, data of at most one file may be lost in a month. Robust data security User data can be encrypted using Secure Sockets Layer (SSL) before being transferred to OBS. OBS employs AKs and SKs to authenticate users and uses a wide array of methods, such as ACLs and bucket policies to control user access to ensure the security of data transfer and access. Object data uploaded to OBS is stored in segments and then randomly distributed onto different disks. For this reason, if data on some disks is stolen, the data cannot be restored to the object data. Flexible expansion All service nodes and universal distributed storage nodes (UDSNs) work in cluster mode. All function nodes and clusters can be independently and smoothly expanded. Storage space can be scaled up and out based on service requirements, boosting service flexibility. Lower maintenance cost As data is stored on OBS, enterprises do not need professional maintenance personnel, reducing maintenance cost. Issue 01 ( ) 4

8 2 Accessing OBS Using Domain Names 2 Accessing OBS Using Domain Names OBS can be accessed using domain names. Different data centers are assigned different domain names. When using OBS through APIs or SDKs, you can use domain names to locate resources on OBS. When creating a bucket, you can specify a region (a cloud service zone) for the bucket. You can specify a region for your bucket based on your requirements for the price, response latency, and request source. Table 2-1 OBS endpoint information Region Name Regi on Endpoint Protoco l Description The global domain name for accessing OBS. - obs.otc.t-systems.com HTTP and HTTPS The global domain name for accessing OBS. When this domain name is used, OBS locates the data center based on requests. The domain name for accessing data centers in Bonn of Germany. eu-de obs.eu-de.otc.t-systems.com HTTP and HTTPS The domain name for accessing data centers in Bonn of Germany. The domain name for OBS static website hosting in Bonn of Germany. eu-de obs-website.eu-de.otc.t -systems.com HTTP and HTTPS The domain name for OBS static website hosting in Bonn of Germany. If a user creates a bucket named newbucket in Bonn of Germany, the domain name for accessing the bucket is newbucket.obs.eu-de.otc.t-systems.com. Issue 01 ( ) 5

9 2 Accessing OBS Using Domain Names Ensure that the domain name used for accessing OBS from the intranet is the same as that used for accessing OBS from the Internet. Issue 01 ( ) 6

10 3 Access Control 3 Access Control About This Chapter Access requests to OBS can be controlled using ACLs, bucket policies, and signature verification. 3.1 ACL OBS provides account-based ACLs to assign accounts specified access permissions. 3.2 Bucket Policy A bucket owner can compile a bucket policy to restrict the access permission for the bucket. 3.3 Signature Verification OBS employs AKs and SKs in user accounts for signature verification to ensure that only authorized accounts can access specified OBS resources. 3.1 ACL OBS provides account-based ACLs to assign accounts specified access permissions. OBS enables bucket and object access permissions to be assigned to four types of authorized users using the ACL, as shown in Table 3-1. Table 3-1 Authorized users supported by OBS Authorized User Bucket owner Registered user group Anonymous user Log delivery user Description The owner of a bucket. It can disable or enable read and write permissions but cannot modify other permissions. A user registered with OBS. The user employs the AK or SK to access OBS. A user not registered with OBS. Access permission for a bucket and objects can be assigned to anonymous users. If the permission is assigned, all users can access the bucket and objects. A user used to deliver bucket access logs. The user is configured Issue 01 ( ) 7

11 3 Access Control Authorized User group Specific user Description for bucket log management. A user assigned the permission to access a bucket by the bucket owner. OBS supports five types of bucket and object access permissions, as shown in Table 3-2. Table 3-2 Access permissions supported by OBS Permission Read permission (READ) Write permission (WRITE) Viewing the ACL permission (READ_ACP) Modifying the ACL permission (WRITE_ACP) Full control (FULL_CONTROL) Description The permission to read a bucket and objects in the bucket. The permission to write a bucket. A user with the write permission for a bucket can upload, overwrite, and delete any object in the bucket. The permission to view the ACL of a bucket. A bucket owner has this permission. The permission to write the ACL of a bucket, that is, the permission to modify the ACL of a bucket. A bucket owner has this permission. As a user assigned such a permission can modify access control policies, the user owns the full control permission. The permission to control a bucket and objects in the bucket. A user assigned such a permission possesses all the permissions mentioned above. If no ACL permission is assigned for a new bucket, OBS automatically disables the access to the bucket and objects by other users except the bucket owner. For details on OBS ACLs, see the Object Storage Service API Reference. 3.2 Bucket Policy A bucket owner can compile a bucket policy to restrict the access permission for the bucket. A bucket policy defines the access permission for a bucket assigned by the bucket owner. After a bucket policy is created, access requests to the bucket are controlled by the bucket policy. The bucket policy controls access requests by accepting or rejecting the requests. Bucket policies are compiled in the JSON format. Grant OBS account permission: { { "Id": "Policy ", Issue 01 ( ) 8

12 3 Access Control "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:getbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::783fc6652cf246c096ea836694f71855:root" ] } } ] } Grant OBS user permission: { "Id": "Policy ", "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:putbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:user/71f e ea2c26d19 99" ] } } ] } Table 3-3 describes parameters in bucket policies. Table 3-3 Parameters in bucket policies Parameter Version Id Statement Description Specifies the version that is consistent with Amazon S3. This parameter is optional. Only is supported. Specifies the ID of the bucket policy. This parameter is optional. Specifies the description of the bucket policy. This parameter is mandatory. The statement defines complete permission control. Each bucket policy can have multiple statements, and each statement contains the following parameters: Sid Principal Issue 01 ( ) 9

13 3 Access Control Parameter Description NotPrincipal Action NotAction Effect Resource NotResource Condition Effect Sid Principal Action Resource Specifies the effect of the bucket policy. That is, the statement is to accept or reject requests. This parameter is mandatory. Possible values are Allow and Deny. Specifies the statement ID. This parameter is optional. Specifies the authorized user, that is, the user on who the bucket policy statement takes effect. This parameter is optional. Either Principal or NotPrincipal can be selected to specify the user on who the bucket policy statement takes effect or does not take effect. Specifies the operation, that is, the OBS operation on which the bucket policy statement takes effect. This parameter is optional. Either Action or NotAction can be selected to specify whether the bucket policy statement takes effect on the OBS operation. Specifies the resource, that is, the object on which the bucket policy statement takes effect. This parameter is optional. Either Resource or NotResource can be selected to specify whether the bucket policy statement takes effect on the OBS resource. After a bucket policy is created, OBS determines whether to accept or reject requests to the bucket based on the bucket policy. When no bucket policy statement matches with an access request, OBS rejects the request by default. The priority of the Effect value in a new bucket policy is higher than that of Deny, the default value of OBS. The priority of Deny is higher than that of Allow. For details on OBS bucket policies, see the Object Storage Service API Reference. Typical Application Assign specific users the permission to obtain objects in specific buckets. In the following example, tenant-user (whose UserID is ac49fefeb fbaf43249eb73ed) of the account (whose DomainID is 783fc6652cf246c096ea836694f71855) is assigned the permission to obtain all objects in bucket mybucket. { "Version":" ", Issue 01 ( ) 10

14 3 Access Control "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : { "AWS":["arn:aws:iam::783fc6652cf246c096ea836694f71855:user/ac49fefeb fba f43249eb73ed"] } }, "Action":["s3:GetObject"], "Resource":"arn:aws:s3:::mybucket/*" } ] Limit specific addresses' permission to access specific buckets. In the following example, the permission of address to access all objects in bucket mybucket is limited. { "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Deny", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition": {"StringEquals":{"aws:Referer":[" } } ] } List objects in a bucket with conditions. In the following example, only account 219d520ceac84c5a98b237431a2cf4c2 is allowed to list objects prefixed with Obj in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : {"AWS":["arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:root"]}, "Action":["s3:ListBucket"], "Resource":"arn:aws:s3:::mybucket", Condition":{"StringEquals":{"s3:prefix":"Obj"}} } ] } Limit the start time of accessing objects in a bucket. In the following example, the start time of accessing all objects in bucket mybucket by all users is limited. Issue 01 ( ) 11

15 3 Access Control { "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Allow", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition":{"DateGreaterThan" : { "aws:currenttime" : " T12:00:00Z"} "DateLessThan": {"aws:currenttime" : " T15:00:00Z"} } } ] } 3.3 Signature Verification OBS employs AKs and SKs in user accounts for signature verification to ensure that only authorized accounts can access specified OBS resources. When accessing OBS, accounts must provide a pair of access keys, that is an AK and an SK. AKs and SKs support the identity and access management authentication mechanism. They are required when OBS is accessed using clients, APIs, or SDKs. The following describes AKs and SKs: AK: identifies the access key on OBS. One AK maps to only one user but one user can have multiple AKs. OBS recognizes the users who access the system by their AKs. SK: specifies the secure access key on OBS. It is used to access OBS. Users generate authentication information based on AKs and request header fields. SKs and AKs are in one-to-one match. For details on how to obtain AKs and SKs, see 13.3 Creating an Access Key. A request to be sent to OBS must contain the SK, request time, request type, and other information for authentication. Before authentication, OBS encodes the bucket name and object names using URLENCODE and generates required information for authentication. Accounts can access specified OBS resources only after they pass the signature authentication. OBS supports Amazon V2 and V4 for authentication. In addition to using the HMAC-SHA256 algorithm, Amazon V4 introduces user data into signature computing. The header fields introduced in signature computing can be specified by users, notably improving the security of request authentication. Issue 01 ( ) 12

16 4 Access Log Record 4 Access Log Record OBS can record bucket access requests in logs for request analysis and log audit. Logs occupy some OBS storage space rented by users, causing extra fees. For this reason, OBS does not collect bucket access logs by default. For analysis and audit purpose, you can enable log management. Access logs enable a bucket owner to analyze the property, type, or trend of requests to the bucket in depth. After log management is enabled for a bucket, OBS automatically logs access requests to the bucket and generates and writes log files into the specified bucket (that is, the destination bucket). Log files are stored to the destination bucket after being named as follows: <TargerPrefix>YYYY-mm-DD-HH-MM-SS-<UniqueString> <TargerPrefix> indicates the specified destination prefix, that is, the first field in the log file name. YYYY-mm-DD-HH-MM-SS indicates the date and time when the log is generated. <UniqueString> indicates a unique character string generated by OBS. On the management console, if configured <TargetPrifix> ends with a slash (/), logs generated in the bucket are stored in the <TargetPrifix> folder in the destination bucket to facilitate management. For example: If the destination bucket is bucket and destination prefix is bucket-log/, all logs are stored in the bucket-log/ folder in bucket. If the destination bucket is bucket and destination prefix is bucket-log, all logs are directly stored in bucket. The log file is named as follows: bucket-log n7mxlaf1bdg7mpdv. The following shows the access log of the destination bucket: 787f2f92b a4fe2ab75eb09b8 bucket [13/Aug/2015:01:43: ] f2f92b a4fe2ab75eb09b BACAD9376ECE141B842B94535B REST.GET.BUCKET.LOCATION - "GET /bucket?location HTTP/1.1" "-" "HttpClient" - The access log of each bucket contains the following information: Table 4-1 Bucket logging format Name Example Description Issue 01 ( ) 13

17 4 Access Log Record Name Example Description BucketOwner 787f2f92b a4fe2ab75eb09b8 ID of the bucket owner Bucket bucket Bucket name Time [13/Aug/2015:01:43: ] Request timestamp Remote IP Request IP address Requester 787f2f92b a4fe2ab75eb09b8 Requester ID RequestID BACAD9376ECE141B842B94 535B Request ID Operation REST.GET.BUCKET Operation Request-URI GET /bucket?location HTTP/1.1 Request URI HTTPStatus 200 Return code BytesSent 211 Size of the HTTP response, expressed in bytes TotalTime 6 Processing time on the server Turn-AroundTi me 6 Total request processing time For details on access logs, see section PUT Bucket logging in the Object Storage Service API Reference. Issue 01 ( ) 14

18 5 Lifecycle Management 5 Lifecycle Management OBS can periodically delete objects in a bucket based on preset rules. That is, OBS supports the lifecycle management of objects. Lifecycle management means periodically deleting objects in a bucket by configuring rules. Lifecycle management applies to the following scenarios: Periodically uploaded files: Some files uploaded periodically need only to be retained for one week or one month. Documents that are seldom accessed after a certain period of time. You can archive these documents before deleting them. You can define lifecycle management rules for identifying objects and manage lifecycles of the objects based on the rules. After unnecessary files are deleted, less OBS storage space is required, thereby reducing the rent fee. Lifecycle management rules have two key elements: Configuration policy: You can specify the prefix of object names so that objects whose names have this prefix are restricted by the rules. You can configure a lifecycle rule for a bucket so that all objects in the bucket can be restricted by the lifecycle rule. Expiration time: You can specify the number of days after which objects are automatically deleted or the day after which objects that match with a rule are deleted. For example, you stored the following files on OBS on January 7, 2015: log/test1.log log/test2.log doc/example.doc doc/good.txt You stored the following files on OBS on January 10, 2015: log/clientlog.log log/serverlog.log doc/work.doc doc/travel.txt 1. If the expiration time of objects prefixed with log/ is set to January 11, 2015 (or one day later) on January 10, 2015, OBS will delete objects log/clientlog.log and log/serverlog.log on January 11, Issue 01 ( ) 15

19 5 Lifecycle Management 2. If the expiration time of objects prefixed with log/ is set to January 8, 2015 on January 10, 2015, OBS will delete objects log/test1.log and log/test2.log that were last modified before January 8, 2015 on January 10, 2015 but will not delete objects log/clientlog.log and log/serverlog.log that were stored on OBS the same day. The deletion of an object may be delayed after the object expires. Generally, the delay does not exceed 48 hours. If you specify log/ as the prefix, OBS automatically deletes objects log/clientlog.log and log/serverlog.log when the expiration time arrives. For details on lifecycle management, see section PUT Bucket lifecycle in the Object Storage Service API Reference. Issue 01 ( ) 16

20 6 Static Website Hosting 6 Static Website Hosting OBS enables you to configure the static website hosting mode for your bucket on OBS. You can upload the content files of the static website to your bucket on OBS and configure a read permission to anonymous users for these files, then configure the static website hosting mode for your bucket to host your static website on OBS. Static websites contain static web pages and some scripts that can run on clients, such as JavaScript and Flash. Different from static websites, dynamic websites depend on processing scripts on servers, including PHP, PHP, and ASP.NET. OBS does not support scripts running on servers. After the static website hosting settings take effect on OBS, you can use the following domain names to access the static website: For example, after configuring the static website hosting mode for bucket mysite in the OBS Germany Bonn zone (the static website hosting domain name is obs-website.eu-de.otc.t-systems.com), you can use or to access your static website. When configuring static website hosting, you can specify the index page and error page returned during website access: Index page: specifies the default home page of the static website. When the management console is used to configure static website hosting, only html web pages are supported. When APIs or SDKs are used, the Content-Type of objects must be specified. OBS does not allow the default home page to be set by specifying the directory level (for example, /page/index.html). After changing the default home page, you must wait for about 5 minutes before using the access point to access the new default home page. Error page: specifies the error page returned when an error occurs during static website access. When the management console is used to configure static website hosting, only html web pages are supported. When APIs or SDKs are used, the Content-Type of objects must be specified. When using the static website hosting function, you can configure request redirection to redirect specified or all requests. Typical application scenarios include: Issue 01 ( ) 17

21 6 Static Website Hosting Redirects all requests to another site. Redirects specified requests based on redirection rules. After changing the destination address for redirection, you must manually clear the browser cache so that requests will be redirected to the new destination address. For example, if the original destination address for redirection is the system automatically jumps to the page after you access the static website hosting address (or replicate the address to another browser). After changing the destination address for redirection to you must clear the browser cache. By doing so, when you access the static website hosting address, the system automatically jumps to the page. Otherwise, the system jumps to the page. For details on static website hosting, see section PUT Bucket website in the Object Storage Service API Reference. Issue 01 ( ) 18

22 7 CORS 7 CORS OBS supports CORS rules and allows resources on OBS to be accessed across origins. CORS is a browser standard mechanism provided by the World Wide Web Consortium (W3C). It defines the interaction methods between client-side web applications in one origin and resources in another origin. In web page requests, website scripts and contents in one origin cannot interact with those in another origin because of Same Origin Policies (SOPs). OBS supports 6 Static Website Hosting. Static websites stored on OBS can respond to website requests from another origin only when CORS is configured for the bucket. OBS CORS is used in the following scenarios: Enables JavaScript and HTML 5 to be used to establish web applications that can directly access resources on OBS. No proxy servers are required for transfer. Enables the dragging function of HTML 5 to be used to upload files to OBS (with the upload progress displayed) or update OBS contents using web applications. Hosts external web pages, style sheets, and HTML 5 applications in different origins. Web fonts or pictures on OBS can be shared by multiple websites. Table 7-1 describes parameters in CORS rules. Table 7-1 Parameters in CORS rules Parameter Allowed Origin Description Specifies the origin of cross-origin requests. That is, requests from the origin can access the bucket. This parameter is mandatory. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Example: Allowed Method Allowed Header Specifies the method of cross-origin requests, that is, the operation type of buckets and objects. This parameter is mandatory. Specifies the allowed header of cross-origin requests. This parameter is optional. Only CORS requests matching the allowed header are valid. Issue 01 ( ) 19

23 7 CORS Parameter Expose Header Max Age Seconds Description Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Specifies the supplemented header in CORS responses, providing additional information for clients. This parameter is optional. Multiple matching rules are allowed. One rule occupies one line, and does not allow wildcard character *. Specifies the duration that a client can buffer CORS responses, expressed in seconds. This parameter is mandatory. For details on CORS, see section PUT Bucket CORS in the Object Storage Service API Reference. Issue 01 ( ) 20

24 8 URL Validation 8 URL Validation On a pay-per-use basis, OBS supports URL validation based on Referer in HTTP headers to prevent a user's data in OBS from being stolen by other users. OBS supports both whitelists and blacklists. To reduce costs, some websites steal links to other websites to enrich contents. Stealing links not only damages interests of the original websites but also increases workloads on the server. To resolve this problem, URL validation comes into being. In HTTP, a website can detect the web page that accesses a target web page using the Referer field. As the Referer field can trace sources, specific techniques can be used to block or return to specific web pages if the pages are not from the website. URL validation checks whether the Referer field in requests matches the whitelist or blacklist by setting Refer. If the field matches the whitelist, the requests are allowed. Otherwise, the requests are blocked or specific pages are displayed. OBS employs the whitelist Refer and blacklist Refer for URL validation. The following describes the principles for setting Refer: 1. Refer format: Refers are separated from each other using newline characters. 2. When the whitelist Refer is empty but the blacklist Refer is not, all websites except specified ones in the blacklist are allowed to access data in the target bucket. 3. When the whitelist Refer is not empty and the blacklist Refer is empty or not empty, only specified websites in the whitelist are allowed to access data in the target bucket. When the whitelist Refer is the same as the blacklist Refer, the blacklist takes effect. For example, if the Referer fields of the whitelist Refer and blacklist Refer are set to the access request from is blocked. 4. When the whitelist Refer and blacklist Refer are empty, all websites can access data in the target bucket by default. 5. URL validation is implemented only when users use URL signatures or anonymously access buckets and objects in the buckets. It will not be implemented for requests whose headers have the Authorition field. 6. Before determining whether a user has the five types of permission (full control, read, write, ACL view, and ACL modification) for a bucket or objects in the bucket, check whether the user complies with the URL validation principles of Referer. For example: Issue 01 ( ) 21

25 8 URL Validation If Whitelist Refer of bucket test-111 is set to and Blacklist Refer is empty, only requests whose referer is can access data in the bucket. If Blacklist Refer of bucket test-111 is set to and Whitelist Refer is empty, all requests except the requests whose referer is can access data in the bucket. Issue 01 ( ) 22

26 9 Adding External Buckets 9 Adding External Buckets OBS enables you to use the external bucket adding function to add buckets of other users if you have access permission for the buckets. By doing so, you can access the external buckets locally using your account. After successfully adding an external bucket, you can see the external bucket in the bucket list using your own account and have the ACL access permission for the bucket. For example: If you are assigned the write permission for bucket test, you can leverage the external bucket adding function to add bucket test to a local computer using your account. You can see bucket test in the bucket list on the left and have the write permission for the bucket. That is, you can upload objects to, overwrite objects in, and delete objects from the bucket. Issue 01 ( ) 23

27 10 Fragment Management 10 Fragment Management The fragment management function enables you to clear junk data that was generated due to object upload failures 90 days ago. Fragments are incomplete data in buckets generated due to data upload failures. OBS uploads data by blocks. In the following situations (but not limited to the following situations), junk data is generated due to data upload failures. The junk data needs to be cleared to free up space. The network is in poor condition, and the connection to the OBS server is interrupted frequently. The upload task is manually interrupted. The device is faulty. The device is powered off suddenly. Issue 01 ( ) 24

28 11 Versioning Control 11 Versioning Control OBS can store multiple versions of an object. You can quickly search for and restore the versions as well as restore data in the event of misoperations or application faults. Versioning control is an effective means to restore overwritten or incorrectly deleted objects. By default, the versioning function is disabled for new buckets on OBS. New objects will overwrite the existing objects with the same names as the new ones in a bucket. After versioning control is enabled: When an object is uploaded, OBS automatically allocates a unique version ID for the object. Objects with the same name are stored on OBS with different version IDs. Objects can be downloaded by version ID. By default, the latest object is downloaded if the version ID is not specified. Objects can be permanently deleted by specifying version IDs. If an object is deleted with no version ID specified, the object is only attached with a deletion mark and a unique version ID but is not physically deleted. If an access request is sent to the object, a message will return indicating that the object does not exist. The latest objects in a bucket are returned by default after a GET Object request. You can also send a request to obtain a bucket's objects with all version IDs. All object versions except deletion marks stored on OBS are charged. If versions of objects in a bucket do not need to be controlled, you can suspend versioning control: Old version data remains on OBS. You need to manually delete unnecessary old version data. Objects can be downloaded by version ID. By default, the latest object is downloaded if the version ID is not specified. All old object versions except deletion marks stored on OBS are charged. Current OBS Browser does not support versioning control. To use this function, use the OBS management console, APIs, or SDKs to manage data on OBS. For details on versioning, see section PUT Bucket versioning in the Object Storage Service API Reference. Issue 01 ( ) 25

29 12 Object URL 12 Object URL The object uniform resource locator (URL) (object sharing) function allows anonymous users to access object data using object URLs. OBS provides the object URL function. When anonymous users are assigned the permission to read specific objects, the anonymous users can quickly access the objects using the object URLs. The object URL is in the format of name/bucket name/directory level/object name, for example, If the object is in the root directory of the bucket, the URL does not contain directory level. If Versioning Control is enabled for the bucket and Show Version is enabled for the object list, the object URL contains a version and is in the format of name/bucket name/directory level/object name?versionid=version, for example, 2e9292f6872c446b47e04cf4001B a. The browser-based object access method varies depending on the object type. You can directly open TXT and HTML files using a browser. However, when you open EXE and DAT files using a browser, the files are automatically downloaded to your local computer. Issue 01 ( ) 26

30 13 Quick Start 13 Quick Start About This Chapter This chapter describes basic OBS operations Registering an public cloud Account You must register an public cloud account before using OBS Enabling the OBS Service You must recharge the account before using the OBS service Creating an Access Key This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs Using OBS on the Management Console The OBS management console enables you to perform most basic operations Using OBS Through OBS Browser OBS Browser enables you to perform most basic operations Registering an public cloud Account Procedure You must register an public cloud account before using OBS. Step 1 Open a browser. Step 2 Type otc.t-systems.com in the address box and press Enter. Step 3 In the upper right corner of the page, click Register. The registration page is displayed. Issue 01 ( ) 27

31 13 Quick Start Step 4 Enter the registration information. Choose I have read and agree to the User Agreement. and click Next. Step 5 Enter User name and address according to the information displayed, and click Next. When the following page is displayed, the registration is complete. ----End Issue 01 ( ) 28

32 13 Quick Start 13.2 Enabling the OBS Service Procedure You must recharge the account before using the OBS service. Step 1 Log in to the management console. Step 2 Click Recharge. The recharging window is displayed. Step 3 Recharge the account as prompted. Step 4 After the recharging, close the window. Step 5 On the home page, click Object Storage Service to enable the OBS service and log in to the OBS management console. ----End 13.3 Creating an Access Key Procedure This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs. Step 1 Log in to the management console. Step 2 In the upper right corner of the page, click the user name and choose Authentication Center. Issue 01 ( ) 29

33 13 Quick Start Step 3 On the Authentication Center page, click Add Access Key below the Access Credentials area. Each user can create two valid access keys at most. Step 4 In the dialog box that is displayed, enter the login password and SMS verification code and click OK. Issue 01 ( ) 30

34 13 Quick Start You can click Verify by to obtain the verification code from the registered mailbox. Step 5 In the Confirm dialog box that is displayed, click OK to download the access key. ----End To prevent access key leakage, properly save the access key. If you click Cancel in the Confirm dialog box, the access key will not be downloaded and cannot be downloaded later. You must delete the access key and create one later. Follow-up Procedure If an access key is abnormally used (for example, an access key is lost or leaked) or will be no longer used, click Delete to delete the access key or contact the administrator to reset the key. When deleting an access key, you must enter the login password and verification code. A deleted access key cannot be restored Using OBS on the Management Console The OBS management console enables you to perform most basic operations Logging In to the Management Console Procedure This section describes how to log in to the management console using a web browser. Step 1 Open a browser. Step 2 Type obs.console.otc.t-systems.com in the address box and press Enter. Step 3 Enter your account and password to log in to the management console. To log in as an enterprise user, go to Step 3.1. To log in as an individual user, go to Step 3.2. Issue 01 ( ) 31

35 13 Quick Start 1. Click Multitenant Login in the upper right corner and enter Enterprise Account, User name, address, Mobile number, Password, and Verify code. Then click Log In. To obtain the account and password, contact the enterprise administrator. 2. Click User Login in the upper right corner and enter User name, address, Mobile number, Password, and Verify code. Then click Log In. If you have not registered with public cloud, click Register and register a public cloud account as prompted. Issue 01 ( ) 32

36 13 Quick Start ----End Managing Buckets Procedure This section describes how to manage buckets. Step 1 Log in to the management console. Step 2 Select the bucket you want to manage and click Attribute. Issue 01 ( ) 33

37 13 Quick Start Step 3 Click Basic Information to view the creation time, owner, capacity, and object quantity of the bucket. Step 4 Click Permission Settings to manage the read and write permissions for and policies of the bucket. Step 5 Click Static Website Hosting to manage static website hosting. Step 6 Click CORS Settings to manage cross-origin resource sharing (CORS). Step 7 Click Log Management Settings to manage bucket logs. Step 8 Click Periodic Cycling Rule Management to manage lifecycle rules of objects. Step 9 Click URL Validation Settings to manage object access permissions. Step 10 Click Versioning Control to manage object versioning. Step 11 Click Fragment Management to manage fragments in buckets. ----End Managing Files and Folders Procedure This section describes how to use the management console to manage files and folders. Step 1 Log in to the management console. Step 2 Click the bucket where the files and folders to be managed reside. The Object Management page is displayed. Step 3 Click Create Folder to create a folder. Step 4 Click Delete to delete a file or folder. Step 5 Click Download to download a file. Step 6 Click the icon in the red box, select a file, and click Upload to upload the file. Issue 01 ( ) 34

38 13 Quick Start ----End Typical Application Prerequisites Context Procedure This section describes how an enterprise uses OBS through the management console. The enterprise has enabled the OBS service. The enterprise needs to store a large number of files but does not want to purchase storage devices. Therefore, the enterprise enables the OBS service for storing the files. The enterprise wants to control the read and write permissions for stored files and delete all the files after one-year storage. Step 1 Log in to the management console as an enterprise user. Step 2 Create a bucket. 1. Click Create Bucket in the upper left corner. 2. Click Region. 3. Enter Bucket Name. Bucket Name must be unique. 4. Click Create Bucket. Step 3 Click Attribute. Step 4 Configure the read and write permissions for the bucket. 1. Click Permission Settings. 2. Click Add Permission. Issue 01 ( ) 35

39 13 Quick Start 3. Add the read and write permissions for the bucket and click Save. Step 5 Set a lifecycle rule. 1. Click Periodic Cycling Rule Management. 2. Click Add Rule. 3. In Periodic Cycling Rule, configure a lifecycle management rule. Step 6 Create a folder. 1. Click Bucket Name. The Object Management page is displayed. 2. Click Create Folder and enter a name for the folder. Step 7 Upload a file. 1. Click the folder. 2. Click the button on the left side of Upload to select the file you want to upload. 3. Click Upload. ----End Follow-up Procedure To view the content of a file stored on OBS, log in to the management console and download the file to a local computer Using OBS Through OBS Browser OBS Browser enables you to perform most basic operations Installing OBS Browser Procedure This section describes how to install OBS Browser. Step 1 Download OBS Browser from public cloud website. Step 2 Decompress the installation package to the local computer. Step 3 Double-click the obs.exe file to start the OBS service. ----End Follow-up Procedure If you have got an OBS account, you can add your account to manage resources on OBS. You can disable OBS Browser. Then log in to OBS Browser and add your account when necessary Logging In to OBS Browser This section describes how to use OBS Browser to manage resources stored on OBS. Issue 01 ( ) 36

40 13 Quick Start Procedure Step 1 Click OBS Browser to start it. If you start OBS Browser for the first time, the Add Account page is automatically displayed. Go to Step 4. Step 2 In the upper right corner of OBS Browser, click the account name. Then click Account Manage. Step 3 In the Account Manage dialog box that is displayed, click Add Account. Step 4 In the Add Account dialog box, enter the account information and click OK. Issue 01 ( ) 37

41 13 Quick Start The account information includes the following: Account name: specifies the account name used on OBS Browser. The account name is used only to uniquely identify an account and can be different from the OBS account registered with the public cloud. Storage type: OBS Browser can be connected to OBS or other storage compatible with Amazon S3. When OBS Browser is connected to OBS, set the storage type to OBS Storage. When OBS Browser is connected to other storage compatible with Amazon S3, set the storage type to S3 Compatible Storage. You need to specify the Server IP address or domain name of the storage. The format is IP address or domain name:port. The access requests use the HTTPS port by default. If you want to use the HTTP port, click the icon on the top right corner. Then modify the port in the System Settings page that is displayed. Issue 01 ( ) 38

42 13 Quick Start AK/SK: specifies the AK/SK created in Authentication Center after you register with a storage service, such as OBS. For details on how to obtain the AK/SK, see 13.3 Creating an Access Key. After OBS Browser is successfully connected to the storage service, the account information is displayed in the Account Management dialog box. Step 5 Click OK. Then you can log in to the storage service using the account and check bucket and object resources owned by the account. Step 6 Optional: To manage objects owned by multiple accounts using OBS Browser, click the account name and Account Management to add multiple accounts. You can click a desired account to switch to the account. ----End Managing Buckets Procedure This section describes how to manage buckets using OBS Browser. Step 1 Start OBS Browser. Step 2 In the upper left corner of the page, click Create to create a bucket. Step 3 Select buckets you want to manage. Issue 01 ( ) 39

43 13 Quick Start Step 4 Choose More > Basic Information to view basic information, such as the bucket owner and number of objects. Step 5 Choose More > Permission Settings to configure read and write permissions. Step 6 Choose More > Configure Bucket Policy to configure bucket policies. Step 7 Choose More > CORS Settings to configure CORS. Step 8 Choose More > Log Management Settings to configure logging. Step 9 Choose More > Periodic Cycling Rule Management to configure lifecycle rules. Step 10 Choose More > Add External Buckets to add external buckets. Step 11 Choose More > Fragment Management to manage fragments in a bucket. Step 12 Click Delete to delete unnecessary empty buckets. ----End For details on how to use OBS Browser to manage buckets, see the Object Storage Service Client Operation Guide Managing Files and Folders This section describes how to manage files and folders using OBS Browser. Issue 01 ( ) 40