OBS. Management Console Operation Guide. Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Management Console Operation Guide Issue 02 Date HUAWEI TECHNOLOGIES CO., LTD.

2 2015. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China i

3 Contents Contents 1 Definition Advantages Relationship Between OBS and Other Products Basic OBS Operations Logging In to the Management Console Creating a Bucket Uploading a File Creating an Access Key Creating a Bucket Viewing Basic Information About a Bucket Setting ACL Permissions for Buckets Configuring a Bucket Policy Configuring Static Website Hosting Configuring CORS Configuring Logging Configuring a Lifecycle Management Rule Configuring URL Validation Managing Fragments Deleting a Bucket Object Management Creating a Folder Setting ACL Permissions for Objects Uploading a File Downloading a File Deleting a File Deleting a Folder ii

4 1 Definition 1 Definition OBS provides customers with massive, secure, reliable, and cost-effective data storage capabilities, including bucket creation, modification, and deletion as well as object upload, download,and deletion. It applies to the storage of any type of file and is suitable for ordinary subscribers, websites, enterprises, and developers. Oriented to Internet access, OBS provides web service interfaces based on Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Service (HTTPS). Users can use the OBS management console to access and manage data stored on OBS from any computer connected to the Internet anytime, anywhere. In the mean time, OBS is compatible with most Amazon S3 interfaces. Users can invoke Representational State Transfer (REST) application programming interfaces (APIs) of OBS and software development kits (SDKs) to develop software adapting to upper-layer applications or connect to the Amazon S3 storage, so that the users can focus on service applications and ignore underlying storage implementation technologies. Huawei Web Service (HWS) enables infrastructure to be deployed in multiple areas and delivers flexible expansion and enhanced reliability. Users can deploy OBS in specific areas based on site requirements to obtain rapid access speed at an affordable price. OBS provides an ultra-large storage capacity. It also provides a browser-based visualized and unified management console (browser/server architecture), host-based clients (client/server architecture), SDKs (Java, Python, PHP,.Net, Android, and C++), and REST APIs that are compatible with Amazon S3 interfaces to help users easily manage their own data stored on OBS and develop a wide array of upper-layer applications. OBS has the following functions: Creates and deletes buckets in specific regions (service areas in HWS). Manages objects, including uploading (such as multipart upload),downloading, copying,and deleting objects. Manages bucket permissions, including bucket policies, access control lists (ACLs), and cross-origin resource sharing (CORS). Manages bucket versioning, allowing multiple versions of objects to exist in a bucket. Supports website attribute setting of buckets, achieving static website hosting. Sets lifecycle management policies for buckets to automatically delete expired objects. Sets web page redirection to redirect bucket requests to specified hosts. 1

5 1 Definition Provides the URL validation function to prevent object links on OBS from being stolen by other websites. Provides a variety of management and development platforms, such as a management console, clients, SDKs (Java, Python, PHP,.Net, Android, C++, and Ruby), and REST APIs. OBS provides storage resources for: Massive storage resource pool Enterprise cloud disk Static website hosting Cloud backup Video surveillance and archive Big Data storage 2

6 2 Advantages 2 Advantages Compared with storage systems constructed by enterprises and household storage systems, OBS delivers: Higher availability OBS uses the node redundancy design that ensures robust reliability of object data and service node networks. The availability ratio is up to 99.99%. Enhanced data reliability OBS stores object data in multiple copies and uses automatic repair technology that ensures the consistency of the copies to improve the reliability of object data. The data durability is up to %. That is, in every 100 billion user files on OBS, data of at most one file may be lost in a month. Robust data security User data can be encrypted using Secure Sockets Layer (SSL) before being transferred to OBS. OBS employs AKs and SKs to authenticate users and uses a wide array of methods, such as ACLs and bucket policies to control user access to ensure the security of data transfer and access. Object data uploaded to OBS is stored in segments and then randomly distributed onto different disks. For this reason, if data on some disks is stolen, the data cannot be restored to the object data. Flexible expansion All service nodes and universal distributed storage nodes (UDSNs) work in cluster mode. All function nodes and clusters can be independently and smoothly expanded. Storage space can be scaled up and out based on service requirements, boosting service flexibility. Lower maintenance cost As data is stored on OBS, enterprises do not need professional maintenance personnel, reducing maintenance cost. 3

7 3 Relationship Between OBS and Other Products 3 Relationship Between OBS and Other Products OBS provides ultra-large storage space. You can use storage resources provided by OBS for other products purchased from Huawei Web Service (HWS). OBS can serve as storage resource pools or snapshot backup storage for: Image Management Service (IMS) Volume Backup Service (VBS) Relational Database Service (RDS) Elastic BigData Service (BigData) 4

8 4 Basic OBS Operations 4 Basic OBS Operations About This Chapter This chapter describes basic operations on the management console. 4.1 Logging In to the Management Console This section describes how to log in to the management console using a web browser. 4.2 Creating a Bucket A bucket is a container used to store objects on OBS. This section describes how to create a bucket. 4.3 Uploading a File This section describes how to upload local files to OBS for storage. 4.4 Creating an Access Key This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs. 5

9 4 Basic OBS Operations 4.1 Logging In to the Management Console Procedure This section describes how to log in to the management console using a web browser. Step 1 Step 2 Step 3 Step 4 Open a browser. Type in the address box and press Enter. In the upper right corner of the page, click Seller Marketplace. The management console login page is displayed. Enter your account and password to log in to the management console. To log in as an enterprise user, go to Step 4.1. To log in as an individual user, go to Step Click Multitenant Login in the upper right corner and enter Enterprise Account, User name, address, Mobile number, Password, and Verify code. Then click Log In. Figure 4-1 shows the login page for an enterprise user. To obtain the account and password, contact the enterprise administrator. 6

10 4 Basic OBS Operations Figure 4-1 Login as an enterprise user 2. Click User Login in the upper right corner and enter User name, address, Mobile number, Password, and Verify code. Then click Log In. Figure 4-2 shows the login page for an individual user. If you have not registered with HWS, click Register and register an HWS account as prompted. 7

11 4 Basic OBS Operations Figure 4-2 Login as an individual user ----End 4.2 Creating a Bucket Procedure A bucket is a container used to store objects on OBS. This section describes how to create a bucket. Step 1 Step 2 Log in to the management console. Click Create Bucket in the upper left corner. The following dialog box is displayed. 8

12 4 Basic OBS Operations Step 3 Step 4 Set Region and Bucket Name. The OBS service is enabled in northchina only. Bucket Name must be unique. Click OK. A message is displayed indicating a successful creation. ----End 4.3 Uploading a File This section describes how to upload local files to OBS for storage. Prerequisites Context At least one bucket has been created. You can upload a file with up to 50 MB on the OBS management console. You cannot batch upload files on the management console. To upload multiple files, use OBS clients or invoke application programming interfaces (APIs) or software development kits (SDKs). Procedure Step 1 Step 2 Log in to the management console. Click desired Bucket Name. The Object Management page is displayed. 9

13 4 Basic OBS Operations Step 3 Step 4 Optional: 6.1 Creating a Folder. Optional: Click the folder name in Object Name. The folder is opened. Step 5 Click the icon in the red box shown in Figure 4-3. Figure 4-3 Uploading a file Step 6 Step 7 Select the file that you want to upload and click Open. Click Upload. A message is displayed indicating a successful upload. ----End 4.4 Creating an Access Key This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs. Procedure Step 1 Step 2 Log in to the management console. In the upper right corner of the page, click the user name and choose Authentication Center. 10

14 4 Basic OBS Operations Step 3 On the Authentication Center page, click Add Access Key below the Access Credentials area. Each user can create two valid access keys at most. 11

15 4 Basic OBS Operations Step 4 In the dialog box that is displayed, enter the login password and SMS verification code and click OK. NOTE You can click Verify by to obtain the verification code from the registered mailbox. Step 5 In the Confirm dialog box that is displayed, click OK to download the access key. NOTE ----End Follow-up Procedure To prevent access key leakage, properly save the access key. If you click Cancel in the Confirm dialog box, the access key will not be downloaded and cannot be downloaded later. You must delete the access key and create one later. If an access key is abnormally used (for example, an access key is lost or leaked) or will be no longer used, click Delete to delete the access key or contact the administrator to reset the key. When deleting an access key, you must enter the login password and verification code. A deleted access key cannot be restored. 12

16 About This Chapter This chapter describes a series of bucket management operations. 5.1 Creating a Bucket A bucket is a container used to store objects on OBS. This section describes how to create a bucket. 5.2 Viewing Basic Information About a Bucket This section describes how to view basic information about a bucket, including the owner, capacity, location, and object quantity. 5.3 Setting ACL Permissions for Buckets This section describes how to set access control list (ACL) permissions for buckets. 5.4 Configuring a Bucket Policy A bucket policy defines the access control policy of resources (buckets and objects) on OBS. 5.5 Configuring Static Website Hosting This section describes how to set the static website hosting mode for buckets and use bucket domain names to access static websites. 5.6 Configuring CORS This section describes how to use cross-origin resource sharing (CORS) in HTML5 to implement cross-origin access. 5.7 Configuring Logging After logging is enabled for a bucket, OBS automatically converts logs of the bucket into objects following the naming rules and writes the objects into the specified bucket. 5.8 Configuring a Lifecycle Management Rule This section describes how to define a lifecycle management rule for a bucket so that the rules can take effect on objects in the bucket. 5.9 Configuring URL Validation OBS enables blacklisted URLs to be blocked whereas whitelisted URLs are permitted to avoid link theft Managing Fragments 13

17 The fragment management function enables you to clear junk data that was generated due to object upload failures 90 days ago Deleting a Bucket This section describes how to delete a bucket. 14

18 5.1 Creating a Bucket Procedure A bucket is a container used to store objects on OBS. This section describes how to create a bucket. Step 1 Step 2 Log in to the management console. Click Create Bucket in the upper left corner. The following dialog box is displayed. Step 3 Step 4 Set Region and Bucket Name. The OBS service is enabled in northchina only. Bucket Name must be unique. Click OK. A message is displayed indicating a successful creation. ----End 15

19 5.2 Viewing Basic Information About a Bucket Procedure This section describes how to view basic information about a bucket, including the owner, capacity, location, and object quantity. Step 1 Step 2 Step 3 Log in to the management console. Select a desired bucket and click Attribute. On the Basic Information tab page, view basic information about the bucket. ----End 5.3 Setting ACL Permissions for Buckets Prerequisites Procedure This section describes how to set access control list (ACL) permissions for buckets. Only a bucket creator can set read and write permissions for the bucket. Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to set ACP permissions and click Attribute. Click Permission Settings. You can set ACL permissions for bucket owners, registered users, anonymous users, and log delivery users on the page. You can assign the preceding users ACL permissions for target buckets by selecting the permissions or delete permissions by deselecting the permissions. You can add ACL permissions for specific users as services required or click Delete next to specific permissions to delete the permissions. 16

20 OBS enables bucket access permissions to be assigned to five types of authorized users using the ACL, as shown in Table 5-1. Table 5-1 Authorized users supported by OBS Authorized User Bucket owner Registered user Anonymous user Log delivery user Specific user Description The owner of a bucket. It can disable or enable read and write permissions but cannot modify other permissions. A user registered with OBS. The user employs the AK or SK to access OBS. A user not registered with OBS. Access permission for a bucket and objects can be assigned to anonymous users. If the permission is assigned, all users can access the bucket and objects. A user used to deliver bucket access logs. The user is configured for bucket log management. A user assigned the permission to access a bucket by the bucket owner. OBS supports five types of bucket access permissions, as shown in Table 5-2. Table 5-2 Access permissions supported by OBS Permission Read permission (READ) Description The permission to read a bucket and objects in the bucket. 17

21 Permission Write permission (WRITE) ACL view permission (READ_ACP) ACL modification permission (WRITE_ACP) Full control (FULL_CONTROL) Description The permission to write a bucket. A user with the write permission for a bucket can upload, overwrite, and delete any object in the bucket. The permission to view the ACL of a bucket. A bucket owner has this permission. The permission to modify the ACL of a bucket. A bucket owner has this permission. NOTE As a user assigned such a permission can modify permission control policies, the user owns the full control permission. Exercise caution when assigning this permission to other users. The permission to control a bucket and objects in the bucket. A user assigned such a permission possesses all the permissions mentioned above. Step 4 Optional: Click Add Permission. Enter Domain ID of a specific user and set ACL permission for the user. You can obtain Domain ID on the Authentication Center page. If no ACL permission is assigned for a new bucket, OBS automatically disables the access to the bucket and objects by other users except the bucket owner. For details on how to use ACL permissions, see section ACL in the OBS API Reference. Step 5 Click Save. 18

22 Follow-up Procedure A message is displayed indicating a successful bucket permission setting. ----End Click Delete to delete permissions of specific users when necessary. 5.4 Configuring a Bucket Policy A bucket policy defines the access control policy of resources (buckets and objects) on OBS. Prerequisites Context Only a bucket owner can configure a bucket policy for the bucket. Access requests to a bucket are controlled by the bucket policy. The bucket policy controls access requests by accepting or rejecting the requests. Procedure Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure a bucket policy and click Attribute. Click Permission Settings. Step 4 Click Configure Bucket Policy. 19

23 Step 5 In the Configure Bucket Policy text box, enter the specified bucket policy. Bucket policies are compiled in the JSON format. To obtain the bucket policy template, click How to configure bucket policy. Grant OBS account permission: { { "Id": "Policy ", "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:getbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::783fc6652cf246c096ea836694f71855:root" ] } } ] } Grant OBS user permission: { "Id": "Policy ", "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:putbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:user/ 20

24 71f e ea2c26d1999" ] } } ] } Step 6 Modify the configurations. Table 5-3 describes parameters in bucket policies. For details on the parameters in bucket policies, see section Bucket Policy in the OBS API Reference. Table 5-3 Parameters in bucket policies Parameter Version Id Statement Effect Sid Principal Action Resource Description Specifies the version that is consistent with Amazon S3. This parameter is optional. Only is supported. Specifies the ID of the bucket policy. This parameter is optional. Specifies the description of the bucket policy. This parameter is mandatory. The statement defines complete permission control. Each bucket policy can have multiple statements, and each statement contains the following parameters: Sid Principal NotPrincipal Action NotAction Effect Resource NotResource Condition Specifies the effect of the bucket policy. That is, the statement is to accept or reject requests. This parameter is mandatory. Possible values are Allow and Deny. Specifies the statement ID. This parameter is optional. Specifies the authorized user, that is, the user on who the bucket policy statement takes effect. This parameter is optional. Either Principal or NotPrincipal can be selected to specify the user on who the bucket policy statement takes effect or does not take effect. Specifies the operation, that is, the OBS operation on which the bucket policy statement takes effect. This parameter is optional. Either Action or NotAction can be selected to specify whether the bucket policy statement takes effect on the OBS operation. Specifies the resource, that is, the object on which the bucket policy statement takes effect. This parameter is optional. Either Resource or NotResource can be selected to specify whether the bucket policy statement takes effect on the OBS resource. 21

25 Step 7 Click Save. ----End Example Assign specific users the permission to obtain objects in specific buckets. In the following example, tenant-user (whose UserID is ac49fefeb fbaf43249eb73ed) of the account (whose DomainID is 783fc6652cf246c096ea836694f71855) is assigned the permission to obtain all objects in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : { "AWS":["arn:aws:iam::783fc6652cf246c096ea836694f71855:user/ ac49fefeb fbaf43249eb73ed"] }, "Action":["s3:GetObject"], "Resource":"arn:aws:s3:::mybucket/*" } ] } Limit specific addresses' permission to access specific buckets. In the following example, the permission of address to access all objects in bucket mybucket is limited. { "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Deny", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition": {"StringEquals":{"aws:Referer":[" } } ] } List objects in a bucket with conditions. In the following example, only account 219d520ceac84c5a98b237431a2cf4c2 is allowed to list objects prefixed with Obj in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : {"AWS":["arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:root"]}, "Action":["s3:ListBucket"], "Resource":"arn:aws:s3:::mybucket", Condition":{"StringEquals":{"s3:prefix":"Obj"}} } 22

26 ] } Limit the start time of accessing objects in a bucket. In the following example, the start time of accessing all objects in bucket mybucket by all users is limited. { "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Allow", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition":{"DateGreaterThan" : { "aws:currenttime" : " T12:00:00Z"} "DateLessThan": {"aws:currenttime" : " T15:00:00Z"} } } ] } 5.5 Configuring Static Website Hosting This section describes how to set the static website hosting mode for buckets and use bucket domain names to access static websites. Prerequisites Only a bucket creator can set the static website hosting mode for the bucket. Website files required by the static website have been uploaded to the specified bucket. NOTICE To ensure that a hosted static website can be accessed by all users, set the ACL permission for the bucket storing static website files to Read permission by anonymous users. Then enable anonymous users to access static website files in the bucket in bucket policies to ensure that the users have sufficient access permissions for desired objects. Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. In the middle of the page, select the bucket for which you want to configure the static website hosting mode and click Attribute. Click Static Website Hosting. Click Enable Website Hosting. 23

27 Step 5 Step 6 Set Default Home Page and Default 404 to the default page and 404 (Not Found) page. Default Home Page: Only a file in the current bucket can serve as the index page (home page) of the static website. If the file name is not entered, the default home page setting is disabled. OBS does not allow the default home page to be set by specifying the directory level (for example, /page/index.html). After changing the default home page, you must wait for about 5 minutes before using the access point to access the new default home page. Default 404: Only a file in the current bucket can serve as the default 404 (Not Found) page of the static website. This error page is displayed when an incorrect path is accessed. If the file name is not entered, the default 404 error page setting is disabled. Optional: In Redirection Rules, configure redirection rules. Requests that comply with the redirection rules are redirected to the specified host or page. Redirection Rules are compiled in the JavaScript object notation (JSON) format. Each rule contains a Condition and a Redirect. You can click Redirection rules template to copy the redirection rules template to the Redirection Rules text box for modification. The following shows a redirection rules template: [{"Condition":{"KeyPrefixEquals":"folder1/"},"Redirect": {"HostName":" {"KeyPrefixEquals":"folder2/"},"Redirect": {"ReplaceKeyPrefixWith":"folder3/"}}] In the preceding template, there are two redirection rules: Automatically redirects requests prefixed with folder1/ to host Automatically redirects requests prefixed with folder2/ to an object prefixed with folder3/. For example, if object folder2/work.txt on OBS is renamed as folder3/ work.txt and the redirection rules are enabled, access requests to folder2/work.txt will be automatically directed to folder3/work.txt. For details on redirection rules, see section PUT Bucket website in the OBS API Reference. 24

28 Step 7 Click Save. After the static website hosting settings take effect on OBS, you can use the following domain names to access the static website: For example, after configuring the static website hosting mode for bucket mysite in the OBS Northern China zone (the static website hosting domain name is obs-website.cnnorth-1.myhwclouds.com), you can use or to access your static website. ----End Follow-up Procedure You can select Do Not Enable Website Hosting to disable static website hosting or Redirect to other hosts to redirect the page based on site requirements. If Redirect to other hosts is selected, all access requests to the bucket will be redirected to specified hosts. 5.6 Configuring CORS This section describes how to use cross-origin resource sharing (CORS) in HTML5 to implement cross-origin access. Prerequisites You have been assigned required permissions. Procedure Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure CORS and click Attribute. Click CORS Settings. 25

29 Step 4 Click Add Rule. Step 5 In CORS Rule, configure Origin, Method, Allowed Header, Supplemented Header, and Buffer Time. Table 5-4 describes parameters in CORS rules. 26

30 Table 5-4 Parameters in CORS rules Parameter Origin Method Allowed Header Supplemented Header Buffer Time Description Specifies the origin of cross-origin requests. That is, requests from the origin can access the bucket. This parameter is mandatory. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Example: Specifies the method of cross-origin requests, that is, the operation type of buckets and objects. This parameter is mandatory. Specifies the allowed header of cross-origin requests. This parameter is optional. Only CORS requests matching the allowed header are valid. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Specifies the supplemented header in CORS responses, providing additional information for clients. This parameter is optional. Multiple matching rules are allowed. One rule occupies one line, and does not allow wildcard character *. Specifies the duration that a client can buffer CORS responses, expressed in seconds. This parameter is mandatory. Step 6 Click OK. The system prompts on top of the page that CORS configuration of the bucket is successful. ----End Follow-up Procedure You can click Edit or Delete to edit or delete a configured rule based on site requirements. 5.7 Configuring Logging Prerequisites After logging is enabled for a bucket, OBS automatically converts logs of the bucket into objects following the naming rules and writes the objects into the specified bucket. The log delivery user group has the ACL viewing (READ_ACP) and write (WRITE) permissions for the current bucket and the target bucket storing logs. 27

31 Procedure Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure logging and click Attribute. Click Log Management Settings. Step 4 Step 5 Step 6 Select Open. Set Target Bucket to store logs. Set Target Prefix to specify the prefix for log names. After logging is enabled, generated logs are named based on the following rules: <TargetPrifix>YYYY-mm-DD-HH-MM-SS-<UniqueString> <TargetPrifix> indicates the specified target prefix. YYYY-mm-DD-HH-MM-SS indicates the date and time when the log is generated. <UniqueString> indicates a character string generated by OBS. On the management console, if configured <TargetPrifix> ends with a slash (/), logs generated in the bucket are stored in the <TargetPrifix> folder in the target bucket to facilitate management. Example: If the target bucket is bucket and target prefix is bucket-log/, all logs are stored in the bucket-log/ folder in bucket. If the target bucket is bucket and target prefix is bucket-log, all logs are directly stored in bucket. Log naming example: bucket-log N7MXLAF1BDG7MPDV Step 7 Click Save. The system prompts on top of the page that log management configuration of the bucket is successful. ----End 5.8 Configuring a Lifecycle Management Rule This section describes how to define a lifecycle management rule for a bucket so that the rules can take effect on objects in the bucket. 28

32 Context Lifecycle management means periodically deleting objects in a bucket by configuring rules. Lifecycle management applies to the following scenarios: Periodically uploaded files: Some files uploaded periodically need only to be retained for one week or one month. Documents that are seldom accessed after a certain period of time. You can archive these documents before deleting them. For details on how to configure lifecycle management, see section PUT Bucket lifecycle in the OBS API Reference. Procedure Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure a lifecycle management rule and click Attribute. Click Periodic Cycling Rule Management. Step 4 Step 5 Click Add Rule. In Periodic Cycling Rule, configure a lifecycle management rule. Enable or Not: Select Yes to enable the lifecycle rule. Configuration Policy: You can match lifecycle rules with the prefixes of object names so that objects with such name prefixes can be managed by the lifecycle rules. You can configure a lifecycle rule for a bucket so that all objects in the bucket can be managed by the lifecycle rule. NOTE When Configure by Prefix is selected and the specified prefix and the prefix of an existing lifecycle rule overlap, OBS regards the two rules as one and disables your rule. For example, if a rule with prefix abc exists in the system, another rule whose prefix contains abc cannot be configured. A lifecycle rule whose Configuration Policy is set to Configure by prefix is mutually exclusive with a lifecycle rule whose Configuration Policy is set to Configure for all buckets. Expiration Time: specifies the number of days after which an object is automatically deleted or the day after which objects that match with a rule are deleted. Rule Identifiers: identifies lifecycle rules. 29

33 Step 6 Click Save. A message is displayed indicating that the lifecycle rule is successfully created. ----End Follow-up Procedure You can click Edit or Delete to edit or delete a configured lifecycle management rule. 5.9 Configuring URL Validation OBS enables blacklisted URLs to be blocked whereas whitelisted URLs are permitted to avoid link theft. Context In HTTP, a website can detect the web page that accesses a target web page using the Referer field. As the Referer field can trace sources, specific techniques can be used to block or return to specific web pages if the pages are not from the website. URL validation checks whether the Referer field in requests matches the whitelist or blacklist by setting Refer. If the field matches the whitelist, the requests are allowed. Otherwise, the requests are blocked or specific pages are displayed. 30

34 On a pay-per-use basis, OBS supports URL validation based on Referer in HTTP headers to prevent a user's data in OBS from being stolen by other users. OBS supports both whitelists and blacklists. The following describes the principles for setting Refer: 1. Refer format: Refers are separated from each other using newline characters. 2. When the whitelist Refer is empty but the blacklist Refer is not, all websites except specified ones in the blacklist are allowed to access data in the target bucket. 3. When the whitelist Refer is not empty and the blacklist Refer is empty or not empty, only specified websites in the whitelist are allowed to access data in the target bucket. NOTE When the whitelist Refer is the same as the blacklist Refer, the blacklist takes effect. For example, if the Referer fields of the whitelist Refer and blacklist Refer are set to the access request from is blocked. 4. When the whitelist Refer and blacklist Refer are empty, all websites are allowed to access data in the target bucket by default. 5. URL validation is implemented only when users use URL signatures or anonymously access buckets and objects in the buckets. It will not be implemented for requests whose headers have the Authorition field. 6. Before determining whether a user has the five types of permission (full control, read, write, ACL view, and ACL modification) for a bucket or objects in the bucket, check whether the user complies with the URL validation principles of Referer. Procedure Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure URL validation and click Attribute. Click URL Validation Settings. Step 4 Step 5 Enter the whitelist Refer and blacklist Refer based on site requirements. Click Save. A message is displayed indicating a successful URL validation setting. ----End 31

35 Example Follow-up Procedure If Whitelist Refer of bucket test-111 is set to and Blacklist Refer is empty, only requests whose referer is can access data in the bucket. If Blacklist Refer of bucket test-111 is set to and Blacklist Refer is empty, all requests except the requests whose referer is can access data in the bucket. To delete whitelisted or blacklisted websites, delete the websites in Whitelist Refer or Blacklist Refer and click Save Managing Fragments Prerequisites Context Procedure The fragment management function enables you to clear junk data that was generated due to object upload failures 90 days ago. Only fragments generated 90 days ago can be deleted. OBS uploads data by blocks. In the following situations (but not limited to the following situations), junk data is generated due to data upload failures. The junk data needs to be cleared to free up space. The network is in poor condition, and the connection to the OBS server is interrupted frequently. The upload task is manually interrupted. The device is faulty. The device is powered off suddenly. Step 1 Step 2 Step 3 Log in to the management console. In the middle of the page, select the bucket for which you want to configure fragment management and click Attribute. Click Fragment Management. 32

36 Step 4 Select a desired fragment and click Delete. You can select multiple fragments to batch delete them. Step 5 Click OK. A message is displayed indicating a successful fragment deletion. ----End 5.11 Deleting a Bucket Prerequisites Procedure This section describes how to delete a bucket. The bucket to be deleted is empty. Only a bucket owner can delete the bucket. Step 1 Step 2 Log in to the management console. In the middle of the page, select a bucket and click Delete. 33

37 Step 3 Click OK. The system prompts on top of the page that the bucket is successfully deleted. ----End 34

38 6 Object Management 6 Object Management About This Chapter On OBS, operations are performed based on objects. This chapter describes a series of object management operations. 6.1 Creating a Folder This section describes how to create a folder on the management console. 6.2 Setting ACL Permissions for Objects This section describes how to set access control list (ACL) permissions for objects. 6.3 Uploading a File This section describes how to upload local files to OBS for storage. 6.4 Downloading a File This section describes how to download a file from OBS to a local computer. 6.5 Deleting a File This section describes how to delete a file. 6.6 Deleting a Folder This section describes how to delete a folder. 35

39 6 Object Management 6.1 Creating a Folder This section describes how to create a folder on the management console. Procedure Step 1 Step 2 Log in to the management console. Click desired Bucket Name. The Object Management page is displayed. Step 3 Click Create Folder. Step 4 In the Folder Name text box, enter a name for the folder. The folder name cannot contain the following special characters: \/:*?"<>. The folder name cannot start or end with a period (.). 36

40 6 Object Management There are no files and folders on OBS. For easy data management, OBS provides a method to simulate folders. On OBS, an object is simulated as a folder ( the object name on the management console. ) by adding a slash (/) into The folder cannot be downloaded on the management console. However, you can batch download files in the folder. Alternatively, you can use the OBS client to download the folder. Step 5 Click OK. The system prompts on top of the page that the folder is successfully created. ----End 6.2 Setting ACL Permissions for Objects This section describes how to set access control list (ACL) permissions for objects. Prerequisites Only an object creator can set read and write permissions for the object. Procedure Step 1 Step 2 Log in to the management console. In the middle of the page, click the bucket where the object to be configured resides. Step 3 Click the icon before the object name. You can set ACL permissions for object owners, registered users, anonymous users, and log delivery users on the page. You can assign the preceding users ACL permissions for target objects by selecting the permissions or delete permissions by deselecting the permissions. You can add ACL permissions for specific users as services required or click Delete next to specific permissions to delete the permissions. OBS enables object access permissions to be assigned to five types of authorized users using the ACL, as shown in Table

41 6 Object Management Table 6-1 Authorized users supported by OBS Authorized User Object owner Registered user Anonymous user Log delivery user Specific user Description The owner of an object. It can disable or enable read and write permissions but cannot modify other permissions. A user registered with OBS. The user employs the AK or SK to access OBS. A user not registered with OBS. Access permission for objects can be assigned to anonymous users. If the permission is assigned, all users can access the objects. A user used to deliver bucket access logs. The user is configured for log file management. A user assigned the permission to access an object by the object owner. OBS supports five types of object access permissions, as shown in Table 6-2. Table 6-2 Access permissions supported by OBS Permission Read permission (READ) Write permission (WRITE) ACL view permission (READ_ACP) ACL modification permission (WRITE_ACP) Full control (FULL_CONTROL) Description The permission to read an object. The permission to write an object, that is, to overwrite and change the object. The permission to view the ACL of an object. An object owner has this permission. The permission to modify the ACL of an object. An object owner has this permission. NOTE As a user assigned such a permission can modify permission control policies, the user owns the full control permission. Exercise caution when assigning this permission to other users. The permission to control an object. A user assigned such a permission possesses all the permissions mentioned above. Step 4 Optional: Click Add Permission. Enter Domain ID of a specific user and set ACL permission for the user. You can obtain Domain ID on the Authentication Center page. 38

42 6 Object Management If no ACL permission is assigned for a new object, OBS automatically disables the access to the object by other users except the object owner. For details on how to use ACL permissions, see section ACL in the OBS API Reference. Step 5 Click Save. A message is displayed indicating a successful object permission setting. ----End Follow-up Procedure Click Delete to delete permissions of specific users when necessary. Click the permission list. to collapse 6.3 Uploading a File This section describes how to upload local files to OBS for storage. Prerequisites Context At least one bucket has been created. You can upload a file with up to 50 MB on the OBS management console. You cannot batch upload files on the management console. To upload multiple files, use OBS clients or invoke application programming interfaces (APIs) or software development kits (SDKs). 39

43 6 Object Management Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Click desired Bucket Name. The Object Management page is displayed. Optional: 6.1 Creating a Folder. Optional: Click the folder name in Object Name. The folder is opened. Step 5 Click the icon in the red box shown in Figure 6-1. Figure 6-1 Uploading a file Step 6 Step 7 Select the file that you want to upload and click Open. Click Upload. A message is displayed indicating a successful upload. ----End 6.4 Downloading a File Procedure This section describes how to download a file from OBS to a local computer. Step 1 Log in to the management console. 40

44 6 Object Management Step 2 Step 3 Step 4 Click desired Bucket Name. The Object Management page is displayed. Select the file you want to download. Click Download and complete the download as prompted. ----End 6.5 Deleting a File This section describes how to delete a file. Procedure Step 1 Step 2 Step 3 Log in to the management console. Click desired Bucket Name. The Object Management page is displayed. Select a file and click Delete. You can select multiple files and click Batch Delete to batch delete the files. Step 4 Click OK. The system prompts on top of the page that the file is successfully deleted. ----End 41

45 6 Object Management 6.6 Deleting a Folder Procedure This section describes how to delete a folder. Step 1 Step 2 Step 3 Step 4 Log in to the management console. Click desired Bucket Name. The Object Management page is displayed. Select the folder you want to delete. Click Delete. Step 5 Click OK. The system prompts on top of the page that the folder is successfully deleted. ----End 42