Object Storage Service. Console Operation Guide. Issue 01. Date

Transcription

1 Issue 01 Date

2 Contents Contents 1 Definition Advantages Relationship Between OBS and Other Products Basic OBS Operations Logging In to the Management Console Creating a Bucket Uploading a File Creating an Access Key Creating a Bucket Viewing Basic Information About a Bucket Setting ACL Permissions for Buckets Configuring a Bucket Policy Configuring Static Website Hosting Configuring CORS Configuring Logging Configuring a Lifecycle Management Rule Configuring URL Validation Versioning Control Managing Fragments Deleting a Bucket Object Management Creating a Folder Setting ACL Permissions for Objects Object URL Uploading a File Downloading a File Deleting a File Deleting a Folder Issue 01 ( ) ii

3 1 Definition 1 Definition OBS provides customers with massive, secure, reliable, and cost-effective data storage capabilities, including bucket creation, modification, and deletion as well as object upload, download,and deletion. It applies to the storage of any type of file and is suitable for ordinary subscribers, websites, enterprises, and developers. Oriented to Internet access, OBS provides web service interfaces based on Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Service (HTTPS). Users can use the OBS management console to access and manage data stored on OBS from any computer connected to the Internet anytime, anywhere. In the mean time, OBS is compatible with most Amazon S3 interfaces. Users can invoke Representational State Transfer (REST) application programming interfaces (APIs) of OBS and software development kits (SDKs) to develop software adapting to upper-layer applications or connect to the Amazon S3 storage, so that the users can focus on service applications and ignore underlying storage implementation technologies. Public cloud service enables infrastructure to be deployed in multiple areas and delivers flexible expansion and enhanced reliability. Users can deploy OBS in specific areas based on site requirements to obtain rapid access speed at an affordable price. OBS provides an ultra-large storage capacity. It also provides a browser-based visualized and unified management console (browser/server architecture), host-based clients (client/server architecture), SDKs (Java, Python, PHP,.Net, Android, and C++), and REST APIs that are compatible with Amazon S3 interfaces to help users easily manage their own data stored on OBS and develop a wide array of upper-layer applications. OBS has the following functions: Creates and deletes buckets in specific regions (service areas). Manages objects, including uploading (such as multipart upload),downloading, copying,and deleting objects. Manages bucket permissions, including bucket policies, access control lists (ACLs), and cross-origin resource sharing (CORS). Manages bucket versioning, allowing multiple versions of objects to exist in a bucket. Supports website attribute setting of buckets, achieving static website hosting. Sets lifecycle management policies for buckets to automatically delete expired objects. Sets web page redirection to redirect bucket requests to specified hosts. Provides the URL validation function to prevent object links on OBS from being stolen by other websites. Issue 01 ( ) 1

4 1 Definition Provides a variety of management and development platforms, such as a management console, clients, SDKs (Java, Python, PHP,.Net, Android, C++, and Ruby), and REST APIs. OBS provides storage resources for: Massive storage resource pool Enterprise cloud disk Static website hosting Cloud backup Video surveillance and archive Big Data storage Issue 01 ( ) 2

5 2 Advantages 2 Advantages Compared with storage systems constructed by enterprises and household storage systems, OBS delivers: Higher availability OBS uses the node redundancy design that ensures robust reliability of object data and service node networks. The availability ratio is up to 99.99%. Enhanced data reliability OBS stores object data in multiple copies and uses automatic repair technology that ensures the consistency of the copies to improve the reliability of object data. The data durability is up to %. That is, in every 100 billion user files on OBS, data of at most one file may be lost in a month. Robust data security User data can be encrypted using Secure Sockets Layer (SSL) before being transferred to OBS. OBS employs AKs and SKs to authenticate users and uses a wide array of methods, such as ACLs and bucket policies to control user access to ensure the security of data transfer and access. Object data uploaded to OBS is stored in segments and then randomly distributed onto different disks. For this reason, if data on some disks is stolen, the data cannot be restored to the object data. Flexible expansion All service nodes and universal distributed storage nodes (UDSNs) work in cluster mode. All function nodes and clusters can be independently and smoothly expanded. Storage space can be scaled up and out based on service requirements, boosting service flexibility. Lower maintenance cost As data is stored on OBS, enterprises do not need professional maintenance personnel, reducing maintenance cost. Issue 01 ( ) 3

6 3 Relationship Between OBS and Other Products 3 Relationship Between OBS and Other Products OBS provides ultra-large storage space. You can use storage resources provided by OBS for other products purchased from public cloud service. OBS can serve as storage resource pools or snapshot backup storage for: Image Management Service (IMS) Volume Backup Service (VBS) Relational Database Service (RDS) Elastic BigData Service (BigData) Issue 01 ( ) 4

7 4 Basic OBS Operations 4 Basic OBS Operations About This Chapter This chapter describes basic operations on the management console. 4.1 Logging In to the Management Console This section describes how to log in to the management console using a web browser. 4.2 Creating a Bucket A bucket is a container used to store objects on OBS. This section describes how to create a bucket. 4.3 Uploading a File This section describes how to upload local files to OBS for storage. 4.4 Creating an Access Key This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs. 4.1 Logging In to the Management Console Procedure This section describes how to log in to the management console using a web browser. Step 1 Open a browser. Step 2 Type obs.console.otc.t-systems.com in the address box and press Enter. Step 3 In the upper right corner of the page, click Seller Marketplace. The management console login page is displayed. Step 4 Enter your account and password to log in to the management console. To log in as an enterprise user, go to Step 3.1. To log in as an individual user, go to Step 3.2. Issue 01 ( ) 5

8 4 Basic OBS Operations 1. Click Multitenant Login in the upper right corner and enter Enterprise Account, User name, address, Mobile number, Password, and Verify code. Then click Log In. To obtain the account and password, contact the enterprise administrator. 2. Click User Login in the upper right corner and enter User name, address, Mobile number, Password, and Verify code. Then click Log In. If you have not registered with public cloud, click Register and register a public cloud account as prompted. Issue 01 ( ) 6

9 4 Basic OBS Operations ----End 4.2 Creating a Bucket Procedure A bucket is a container used to store objects on OBS. This section describes how to create a bucket. Step 1 Log in to the management console. Step 2 Click Create Bucket in the upper left corner. The following dialog box is displayed. Issue 01 ( ) 7

10 4 Basic OBS Operations Step 3 Set Region and Bucket Name. The OBS service is enabled in eu-de only. Bucket Name must be unique. Step 4 Click OK. A message is displayed indicating a successful creation. ----End 4.3 Uploading a File Prerequisites This section describes how to upload local files to OBS for storage. At least one bucket has been created. Context You can upload a file with up to 50 MB on the OBS management console. You cannot batch upload files on the management console. To upload multiple files, use OBS clients or invoke application programming interfaces (APIs) or software development kits (SDKs). Issue 01 ( ) 8

11 4 Basic OBS Operations Procedure Step 1 Log in to the management console. Step 2 Select the bucket from which you want to upload files and click Object Management,the Object Management page is displayed. Step 3 Optional: 6.1 Creating a Folder. Step 4 Optional: Click the folder name in Object Name. The folder is opened. Step 5 Click the icon in the red box shown in the picture. Step 6 Select the file that you want to upload and click Open. Step 7 Click Upload. A message is displayed indicating a successful upload. ----End 4.4 Creating an Access Key Procedure This section describes how to create an access key, an access key ID (AK) or a secret access key (SK). Access keys enable you to use OBS through clients, APIs, and SDKs. Step 1 Log in to the management console. Step 2 In the upper right corner of the page, click the user name and choose Authentication Center. Issue 01 ( ) 9

12 4 Basic OBS Operations Step 3 On the Authentication Center page, click Add Access Key below the Access Credentials area. Each user can create two valid access keys at most. Step 4 In the dialog box that is displayed, enter the login password and SMS verification code and click OK. Issue 01 ( ) 10

13 4 Basic OBS Operations You can click Verify by to obtain the verification code from the registered mailbox. Step 5 In the Confirm dialog box that is displayed, click OK to download the access key. ----End To prevent access key leakage, properly save the access key. If you click Cancel in the Confirm dialog box, the access key will not be downloaded and cannot be downloaded later. You must delete the access key and create one later. Follow-up Procedure If an access key is abnormally used (for example, an access key is lost or leaked) or will be no longer used, click Delete to delete the access key or contact the administrator to reset the key. When deleting an access key, you must enter the login password and verification code. A deleted access key cannot be restored. Issue 01 ( ) 11

14 About This Chapter This chapter describes a series of bucket management operations. 5.1 Creating a Bucket A bucket is a container used to store objects on OBS. This section describes how to create a bucket. 5.2 Viewing Basic Information About a Bucket This section describes how to view basic information about a bucket, including the owner, capacity, location, and object quantity. 5.3 Setting ACL Permissions for Buckets This section describes how to set access control list (ACL) permissions for buckets. 5.4 Configuring a Bucket Policy A bucket policy defines the access control policy of resources (buckets and objects) on OBS. 5.5 Configuring Static Website Hosting This section describes how to set the static website hosting mode for buckets and use bucket domain names to access static websites. 5.6 Configuring CORS This section describes how to use cross-origin resource sharing (CORS) in HTML5 to implement cross-origin access. 5.7 Configuring Logging After logging is enabled for a bucket, OBS automatically converts logs of the bucket into objects following the naming rules and writes the objects into the specified bucket. 5.8 Configuring a Lifecycle Management Rule This section describes how to define a lifecycle management rule for a bucket so that the rules can take effect on objects in the bucket. 5.9 Configuring URL Validation Issue 01 ( ) 12

15 OBS enables blacklisted URLs to be blocked whereas whitelisted URLs are permitted to avoid link theft Versioning Control OBS can store multiple versions of an object. You can quickly search for and restore the versions as well as restore data in the event of misoperations or application faults Managing Fragments The fragment management function enables you to clear junk data that was generated due to object upload failures 90 days ago Deleting a Bucket This section describes how to delete a bucket. 5.1 Creating a Bucket Procedure A bucket is a container used to store objects on OBS. This section describes how to create a bucket. Step 1 Log in to the management console. Step 2 Click Create Bucket in the upper left corner. The following dialog box is displayed. Issue 01 ( ) 13

16 Step 3 Set Region and Bucket Name. The OBS service is enabled in eu-de only. Bucket Name must be unique. Step 4 Click OK. A message is displayed indicating a successful creation. ----End 5.2 Viewing Basic Information About a Bucket Procedure This section describes how to view basic information about a bucket, including the owner, capacity, location, and object quantity. Step 1 Log in to the management console. Step 2 Select a desired bucket and click Bucket Attribute. Step 3 On the Basic Information tab page, view basic information about the bucket. Issue 01 ( ) 14

17 ----End 5.3 Setting ACL Permissions for Buckets Prerequisites Procedure This section describes how to set access control list (ACL) permissions for buckets. Only a bucket creator can set read and write permissions for the bucket. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure ACL permissions and click Bucket Attribute. Step 3 Click Permission Settings. You can set ACL permissions for bucket owners, registered users, anonymous users, and log delivery users on the page. You can assign the preceding users ACL permissions for target buckets by selecting the permissions or delete permissions by deselecting the permissions. You can add ACL permissions for specific users as services required or click Delete next to specific permissions to delete the permissions. Issue 01 ( ) 15

18 OBS enables bucket access permissions to be assigned to five types of authorized users using the ACL, as shown in Table 5-1. Table 5-1 Authorized users supported by OBS Authorized User Bucket owner Registered user group Anonymous user Log delivery user group Specific user Description The owner of a bucket. It can disable or enable read and write permissions but cannot modify other permissions. A user registered with OBS. The user employs the AK or SK to access OBS. A user not registered with OBS. Access permission for a bucket and objects can be assigned to anonymous users. If the permission is assigned, all users can access the bucket and objects. A user used to deliver bucket access logs. The user is configured for bucket log management. A user assigned the permission to access a bucket by the bucket owner. OBS supports five types of bucket access permissions, as shown in Table 5-2. Table 5-2 Access permissions supported by OBS Permission Read permission (READ) Write permission (WRITE) Description The permission to read a bucket and objects in the bucket. The permission to write a bucket. A user with the write permission for a bucket can upload, overwrite, and delete any object in the Issue 01 ( ) 16

19 Permission ACL view permission (READ_ACP) ACL modification permission (WRITE_ACP) Full control (FULL_CONTROL) Description bucket. The permission to view the ACL of a bucket. A bucket owner has this permission. The permission to modify the ACL of a bucket. A bucket owner has this permission. NOTE As a user assigned such a permission can modify permission control policies, the user owns the full control permission. Exercise caution when assigning this permission to other users. The permission to control a bucket and objects in the bucket. A user assigned such a permission possesses all the permissions mentioned above. Step 4 Optional: Click Add Permission. Enter Domain ID of a specific user and set ACL permission for the user. You can obtain Domain ID on the Authentication Center page. If no ACL permission is assigned for a new bucket, OBS automatically disables the access to the bucket and objects by other users except the bucket owner. For details on how to use ACL permissions, see section ACL in the Object Storage Service API Reference. Step 5 Click Save. A message is displayed indicating a successful bucket permission setting. ----End Issue 01 ( ) 17

20 Follow-up Procedure Click Delete to delete permissions of specific users when necessary. 5.4 Configuring a Bucket Policy Prerequisites Context Procedure A bucket policy defines the access control policy of resources (buckets and objects) on OBS. Only a bucket owner can configure a bucket policy for the bucket. Access requests to a bucket are controlled by the bucket policy. The bucket policy controls access requests by accepting or rejecting the requests. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure a bucket policy and click Bucket Attribute. Step 3 Click Permission Settings. Step 4 Click Configure Bucket Policy. Issue 01 ( ) 18

21 Step 5 In the Configure Bucket Policy text box, enter the specified bucket policy. Bucket policies are compiled in the JSON format. To obtain the bucket policy template, click How to configure bucket policies. Grant OBS account permission: { { "Id": "Policy ", "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:getbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::783fc6652cf246c096ea836694f71855:root" ] } } ] } Issue 01 ( ) 19

22 Grant OBS user permission: { "Id": "Policy ", "Statement": [ { "Sid": "Stmt ", "Action": [ "s3:putbucketlogging" ], "Effect": "Allow", "Resource": "arn:aws:s3:::logging.bucket3", "Principal": { "AWS": [ "arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:user/71f e ea2c26d19 99" ] } } ] } Step 6 Modify the configurations. Table 5-3 describes parameters in bucket policies. For details on the parameters in bucket policies, see section Bucket Policy in the Object Storage Service API Reference. Table 5-3 Parameters in bucket policies Parameter Version Id Statement Description Specifies the version that is consistent with Amazon S3. This parameter is optional. Only is supported. Specifies the ID of the bucket policy. This parameter is optional. Specifies the description of the bucket policy. This parameter is mandatory. The statement defines complete permission control. Each bucket policy can have multiple statements, and each statement contains the following parameters: Sid Principal NotPrincipal Action NotAction Effect Resource NotResource Condition Effect Specifies the effect of the bucket policy. That is, the statement is to accept or reject requests. This parameter is mandatory. Possible values are Allow and Deny. Issue 01 ( ) 20

23 Parameter Sid Principal Action Resource Description Specifies the statement ID. This parameter is optional. Specifies the authorized user, that is, the user on who the bucket policy statement takes effect. This parameter is optional. Either Principal or NotPrincipal can be selected to specify the user on who the bucket policy statement takes effect or does not take effect. Specifies the operation, that is, the OBS operation on which the bucket policy statement takes effect. This parameter is optional. Either Action or NotAction can be selected to specify whether the bucket policy statement takes effect on the OBS operation. Specifies the resource, that is, the object on which the bucket policy statement takes effect. This parameter is optional. Either Resource or NotResource can be selected to specify whether the bucket policy statement takes effect on the OBS resource. Step 7 Click Save. ----End Example Assign specific users the permission to obtain objects in specific buckets. In the following example, tenant-user (whose UserID is ac49fefeb fbaf43249eb73ed) of the account (whose DomainID is 783fc6652cf246c096ea836694f71855) is assigned the permission to obtain all objects in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : { "AWS":["arn:aws:iam::783fc6652cf246c096ea836694f71855:user/ac49fefeb fba f43249eb73ed"] } }, "Action":["s3:GetObject"], "Resource":"arn:aws:s3:::mybucket/*" } ] Limit specific addresses' permission to access specific buckets. In the following example, the permission of address to access all objects in bucket mybucket is limited. { "Version":" ", Issue 01 ( ) 21

24 "Statement":[ { "Sid":"1", "Effect":"Deny", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition": {"StringEquals":{"aws:Referer":[" } } ] } List objects in a bucket with conditions. In the following example, only account 219d520ceac84c5a98b237431a2cf4c2 is allowed to list objects prefixed with Obj in bucket mybucket. { "Version":" ", "Id":"aaaa-bbbb-cccc-dddd", "Statement" : [ { "Effect":"Allow", "Sid":"1", "Principal" : {"AWS":["arn:aws:iam::219d520ceac84c5a98b237431a2cf4c2:root"]}, "Action":["s3:ListBucket"], "Resource":"arn:aws:s3:::mybucket", Condition":{"StringEquals":{"s3:prefix":"Obj"}} } ] } Limit the start time of accessing objects in a bucket. In the following example, the start time of accessing all objects in bucket mybucket by all users is limited. { "Version":" ", "Statement":[ { "Sid":"1", "Effect":"Allow", "Principal":{"CanonicalUser":["*"]}, "Action":["s3:*"], "Resource":["arn:aws:s3:::mybucket/*"], "Condition":{"DateGreaterThan" : { "aws:currenttime" : " T12:00:00Z"} "DateLessThan": {"aws:currenttime" : " T15:00:00Z"} } } ] } Issue 01 ( ) 22

25 5.5 Configuring Static Website Hosting This section describes how to set the static website hosting mode for buckets and use bucket domain names to access static websites. Prerequisites Only a bucket creator can set the static website hosting mode for the bucket. Website files required by the static website have been uploaded to the specified bucket. To ensure that a hosted static website can be accessed by all users, set the ACL permission for the bucket storing static website files to Read permission by anonymous users. Then enable anonymous users to access static website files in the bucket in bucket policies to ensure that the users have sufficient access permissions for desired objects. Procedure Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure the static website hosting mode and click Bucket Attribute. Step 3 Click Static Website Hosting. Step 4 Click Enable Website Hosting. Step 5 Set Default Home Page and Default 404 to the default page and 404 (Not Found) page. Issue 01 ( ) 23

26 Default Home Page: Only a file in the current bucket can serve as the index page (home page) of the static website. If the file name is not entered, the default home page setting is disabled. OBS does not allow the default home page to be set by specifying the directory level (for example, /page/index.html). After changing the default home page, you must wait for about 5 minutes before using the access point to access the new default home page. Default 404: Only a file in the current bucket can serve as the default 404 (Not Found) page of the static website. This error page is displayed when an incorrect path is accessed. If the file name is not entered, the default 404 error page setting is disabled. Step 6 Optional: In Redirection Rules, configure redirection rules. Requests that comply with the redirection rules are redirected to the specified host or page. Redirection Rules are compiled in the JavaScript object notation (JSON) format. Each rule contains a Condition and a Redirect. You can click Redirection rules template to copy the redirection rules template to the Redirection Rules text box for modification. The following shows a redirection rules template: [{"Condition":{"KeyPrefixEquals":"folder1/"},"Redirect":{"HostName":"www. example.com"}},{"condition":{"keyprefixequals":"folder2/"},"redirect":{"r eplacekeyprefixwith":"folder3/"}}] In the preceding template, there are two redirection rules: Automatically redirects requests prefixed with folder1/ to host Automatically redirects requests prefixed with folder2/ to an object prefixed with folder3/. For example, if object folder2/work.txt on OBS is renamed as folder3/work.txt and the redirection rules are enabled, access requests to folder2/work.txt will be automatically directed to folder3/work.txt. For details on redirection rules, see section PUT Bucket website in the Object Storage Service API Reference. Step 7 Click Save. After the static website hosting settings take effect on OBS, you can use the following domain names to access the static website: For example, after configuring the static website hosting mode for bucket mysite in the OBS Germany Bonn zone (the static website hosting domain name is obs-website.eu-de.otc.t-systems.com), you can use or to access your static website. ----End Issue 01 ( ) 24

27 Follow-up Procedure You can select Do Not Enable Website Hosting to disable static website hosting or Redirect to other hosts to redirect the page based on site requirements. If Redirect to other hosts is selected, all access requests to the bucket will be redirected to specified hosts. After changing the destination address for redirection, you must manually clear the browser cache so that requests will be redirected to the new destination address. For example, if the original destination address for redirection is the system automatically jumps to the page after you access the static website hosting address (or replicate the address to another browser). After changing the destination address for redirection to you must clear the browser cache. By doing so, when you access the static website hosting address, the system automatically jumps to the page. Otherwise, the system jumps to the page. 5.6 Configuring CORS Prerequisites Procedure This section describes how to use cross-origin resource sharing (CORS) in HTML5 to implement cross-origin access. You have been assigned required permissions. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure CORS and click Bucket Attribute. Step 3 Click CORS Settings. Issue 01 ( ) 25

28 Step 4 Click Add Rule. Step 5 In CORS Rule, configure Allowed Origin, Allowed Method, Allowed Header, Expose Header, and Max Age Seconds. Table 5-4 describes parameters in CORS rules. Issue 01 ( ) 26

29 Table 5-4 Parameters in CORS rules Parameter Allowed Origin Description Specifies the origin of cross-origin requests. That is, requests from the origin can access the bucket. This parameter is mandatory. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Example: Allowed Method Allowed Header Expose Header Max Age Seconds Specifies the method of cross-origin requests, that is, the operation type of buckets and objects. This parameter is mandatory. Specifies the allowed header of cross-origin requests. This parameter is optional. Only CORS requests matching the allowed header are valid. Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character *. Specifies the supplemented header in CORS responses, providing additional information for clients. This parameter is optional. Multiple matching rules are allowed. One rule occupies one line, and does not allow wildcard character *. Specifies the duration that a client can buffer CORS responses, expressed in seconds. This parameter is mandatory. Step 6 Click OK. The system prompts on top of the page that CORS configuration of the bucket is successful. ----End Follow-up Procedure You can click Edit or Delete to edit or delete a configured rule based on site requirements. 5.7 Configuring Logging After logging is enabled for a bucket, OBS automatically converts logs of the bucket into objects following the naming rules and writes the objects into the specified bucket. Prerequisites The log delivery user group has the ACL viewing (READ_ACP) and write (WRITE) permissions for the current bucket and the target bucket storing logs. Issue 01 ( ) 27

30 Procedure Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure logging and click Bucket Attribute. Step 3 Click Log Management Settings. Step 4 Select Open. Step 5 Set Target Bucket to store logs. Step 6 Set Target Prefix to specify the prefix for log names. After logging is enabled, generated logs are named based on the following rules: <TargetPrifix>YYYY-mm-DD-HH-MM-SS-<UniqueString> <TargetPrifix> indicates the specified target prefix. YYYY-mm-DD-HH-MM-SS indicates the date and time when the log is generated. <UniqueString> indicates a character string generated by OBS. On the management console, if configured <TargetPrifix> ends with a slash (/), logs generated in the bucket are stored in the <TargetPrifix> folder in the target bucket to facilitate management. Example: If the target bucket is bucket and target prefix is bucket-log/, all logs are stored in the bucket-log/ folder in bucket. If the target bucket is bucket and target prefix is bucket-log, all logs are directly stored in bucket. Log naming example: bucket-log n7mxlaf1bdg7mpdv Step 7 Click Save. The system prompts on top of the page that log management configuration of the bucket is successful. ----End 5.8 Configuring a Lifecycle Management Rule This section describes how to define a lifecycle management rule for a bucket so that the rules can take effect on objects in the bucket. Issue 01 ( ) 28

31 Context Lifecycle management means periodically deleting objects in a bucket by configuring rules. Lifecycle management applies to the following scenarios: Periodically uploaded files: Some files uploaded periodically need only to be retained for one week or one month. Documents that are seldom accessed after a certain period of time. You can archive these documents before deleting them. For details on how to configure lifecycle management, see section PUT Bucket lifecycle in the Object Storage Service API Reference. Procedure Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure a lifecycle management rule and click Bucket Attribute. Step 3 Click Periodic Cycling Rule Management. Step 4 Click Add Rule. Step 5 In Periodic Cycling Rule, configure a lifecycle management rule. Enable or Not: Select Yes to enable the lifecycle rule. Configuration Policy: You can match lifecycle rules with the prefixes of object names so that objects with such name prefixes can be managed by the lifecycle rules. You can configure a lifecycle rule for a bucket so that all objects in the bucket can be managed by the lifecycle rule. When Configure by Prefix is selected and the specified prefix and the prefix of an existing lifecycle rule overlap, OBS regards the two rules as one and disables your rule. For example, if a rule with prefix abc exists in the system, another rule whose prefix contains abc cannot be configured. A lifecycle rule whose Configuration Policy is set to Configure by prefix is mutually exclusive with a lifecycle rule whose Configuration Policy is set to Configure for all buckets. Expiration Time: specifies the number of days after which an object is automatically deleted or the day after which objects that match with a rule are deleted. Rule Identifiers: identifies lifecycle rules. For example, you stored the following files on OBS on January 7, 2015: log/test1.log log/test2.log Issue 01 ( ) 29

32 doc/example.doc doc/good.txt You stored the following files on OBS on January 10, 2015: log/clientlog.log log/serverlog.log doc/work.doc doc/travel.txt 1. If the expiration time of objects prefixed with log/ is set to January 11, 2015 (or one day later) on January 10, 2015, OBS will delete objects log/clientlog.log and log/serverlog.log on January 11, If the expiration time of objects prefixed with log/ is set to January 8, 2015 on January 10, 2015, OBS will delete objects log/test1.log and log/test2.log that were last modified before January 8, 2015 on January 10, 2015 but will not delete objects log/clientlog.log and log/serverlog.log that were stored on OBS the same day. The deletion of an object may be delayed after the object expires. Generally, the delay does not exceed 48 hours. Step 6 Click Save. A message is displayed indicating that the lifecycle rule is successfully created. Issue 01 ( ) 30

33 ----End Follow-up Procedure You can click Edit or Delete to edit or delete a configured lifecycle management rule. 5.9 Configuring URL Validation Context OBS enables blacklisted URLs to be blocked whereas whitelisted URLs are permitted to avoid link theft. In HTTP, a website can detect the web page that accesses a target web page using the Referer field. As the Referer field can trace sources, specific techniques can be used to block or return to specific web pages if the pages are not from the website. URL validation checks whether the Referer field in requests matches the whitelist or blacklist by setting Refer. If the field matches the whitelist, the requests are allowed. Otherwise, the requests are blocked or specific pages are displayed. On a pay-per-use basis, OBS supports URL validation based on Referer in HTTP headers to prevent a user's data in OBS from being stolen by other users. OBS supports both whitelists and blacklists. The following describes the principles for setting Refer: 1. Refer format: Refers are separated from each other using newline characters. 2. When the whitelist Refer is empty but the blacklist Refer is not, all websites except specified ones in the blacklist are allowed to access data in the target bucket. 3. When the whitelist Refer is not empty and the blacklist Refer is empty or not empty, only specified websites in the whitelist are allowed to access data in the target bucket. Procedure When the whitelist Refer is the same as the blacklist Refer, the blacklist takes effect. For example, if the Referer fields of the whitelist Refer and blacklist Refer are set to the access request from is blocked. 4. When the whitelist Refer and blacklist Refer are empty, all websites are allowed to access data in the target bucket by default. 5. URL validation is implemented only when users use URL signatures or anonymously access buckets and objects in the buckets. It will not be implemented for requests whose headers have the Authorition field. 6. Before determining whether a user has the five types of permission (full control, read, write, ACL view, and ACL modification) for a bucket or objects in the bucket, check whether the user complies with the URL validation principles of Referer. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure URL validation and click Bucket Attribute. Step 3 Click URL Validation Settings. Issue 01 ( ) 31

34 Step 4 Enter the whitelist Refer and blacklist Refer based on site requirements. Step 5 Click Save. A message is displayed indicating a successful URL validation setting. ----End Example If Whitelist Refer of bucket test-111 is set to and Blacklist Refer is empty, only requests whose referer is can access data in the bucket. If Blacklist Refer of bucket test-111 is set to and Blacklist Refer is empty, all requests except the requests whose referer is can access data in the bucket. Follow-up Procedure To delete whitelisted or blacklisted websites, delete the websites in Whitelist Refer or Blacklist Refer and click Save Versioning Control Context OBS can store multiple versions of an object. You can quickly search for and restore the versions as well as restore data in the event of misoperations or application faults. Versioning control is an effective means to restore overwritten or incorrectly deleted objects. By default, the versioning function is disabled for new buckets on OBS. New objects will overwrite the existing objects with the same names as the new ones in a bucket. After versioning control is enabled: Issue 01 ( ) 32

35 When an object is uploaded, OBS automatically allocates a unique version ID for the object. Objects with the same name are stored on OBS with different version IDs. Objects can be downloaded by version ID. By default, the latest object is downloaded if the version ID is not specified. Objects can be permanently deleted by specifying version IDs. If an object is deleted with no version ID specified, the object is only attached with a deletion mark and a unique version ID but is not physically deleted. If an access request is sent to the object, a message will return indicating that the object does not exist. The latest objects in a bucket are returned by default after a GET Object request. You can also send a request to obtain a bucket's objects with all version IDs. All object versions except deletion marks stored on OBS are charged. If versions of objects in a bucket do not need to be controlled, you can suspend versioning control: Old version data remains on OBS. You need to manually delete unnecessary old version data. Objects can be downloaded by version ID. By default, the latest object is downloaded if the version ID is not specified. All old object versions except deletion marks stored on OBS are charged. Procedure Step 1 Log in to the management console. Step 2 Select a desired bucket and click Bucket Attribute. Step 3 Click Versioning Control. Step 4 Click Enable to enable versioning control for objects in the bucket. After enabling versioning control, click Object Management. Then click Show Version to view versions of objects with the same name. ----End Follow-up Procedure On the Versioning Control page, you can click Suspend to suspend versioning control for the objects. Once being enabled, versioning control cannot be disabled. It can be suspended only. Issue 01 ( ) 33

36 5.11 Managing Fragments Prerequisites Context Procedure The fragment management function enables you to clear junk data that was generated due to object upload failures 90 days ago. Only fragments generated 90 days ago can be deleted. OBS uploads data by blocks. In the following situations (but not limited to the following situations), junk data is generated due to data upload failures. The junk data needs to be cleared to free up space. The network is in poor condition, and the connection to the OBS server is interrupted frequently. The upload task is manually interrupted. The device is faulty. The device is powered off suddenly. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure fragment management and click Bucket Attribute. Step 3 Click Fragment Management. Step 4 Select a desired fragment and click Delete. You can select multiple fragments to batch delete them. Issue 01 ( ) 34

37 Step 5 Click OK. A message is displayed indicating a successful fragment deletion. ----End 5.12 Deleting a Bucket This section describes how to delete a bucket. Prerequisites The bucket to be deleted is empty. Only a bucket owner can delete the bucket. Procedure Step 1 Log in to the management console. Step 2 In the middle of the page, select a bucket and click Delete. Step 3 Click OK. The system prompts on top of the page that the bucket is successfully deleted. Issue 01 ( ) 35

38 ----End Issue 01 ( ) 36

39 6 Object Management 6 Object Management About This Chapter On OBS, operations are performed based on objects. This chapter describes a series of object management operations. 6.1 Creating a Folder This section describes how to create a folder on the management console. 6.2 Setting ACL Permissions for Objects This section describes how to set access control list (ACL) permissions for objects. 6.3 Object URL The object uniform resource locator (URL) (object sharing) function allows anonymous users to access object data using object URLs. 6.4 Uploading a File This section describes how to upload local files to OBS for storage. 6.5 Downloading a File This section describes how to download a file from OBS to a local computer. 6.6 Deleting a File This section describes how to delete a file. 6.7 Deleting a Folder This section describes how to delete a folder. 6.1 Creating a Folder Procedure This section describes how to create a folder on the management console. Step 1 Log in to the management console. Issue 01 ( ) 37

40 6 Object Management Step 2 Select the bucket for which you want to create a folder and click Object Management. The Object Management page is displayed. Step 3 Click Create Folder. Step 4 In the Folder Name text box, enter a name for the folder. The folder name cannot contain the following special characters: \/:*?"<>. The folder name cannot start or end with a period (.). There are no files and folders on OBS. For easy data management, OBS provides a method to simulate folders. On OBS, an object is simulated as a folder ( the object name on the management console. ) by adding a slash (/) into The folder cannot be downloaded on the management console. However, you can batch download files in the folder. Alternatively, you can use the OBS client to download the folder. Step 5 Click OK. Issue 01 ( ) 38

41 6 Object Management The system prompts on top of the page that the folder is successfully created. ----End 6.2 Setting ACL Permissions for Objects Prerequisites Procedure This section describes how to set access control list (ACL) permissions for objects. Only an object creator can set read and write permissions for the object. Step 1 Log in to the management console. Step 2 Select the bucket for which you want to configure ACL permissions for object and click Bucket Attribute. Step 3 Click the icon before the object name. You can set ACL permissions for object owners, registered users, anonymous users, and log delivery users on the page. You can assign the preceding users ACL permissions for target objects by selecting the permissions or delete permissions by deselecting the permissions. You can add ACL permissions for specific users as services required or click Delete next to specific permissions to delete the permissions. OBS enables object access permissions to be assigned to five types of authorized users using the ACL, as shown in Table 6-1. Issue 01 ( ) 39

42 6 Object Management Table 6-1 Authorized users supported by OBS Authorized User Object owner Registered user Anonymous user Log delivery user Specific user Description The owner of an object. It can disable or enable read and write permissions but cannot modify other permissions. A user registered with OBS. The user employs the AK or SK to access OBS. A user not registered with OBS. Access permission for objects can be assigned to anonymous users. If the permission is assigned, all users can access the objects. A user used to deliver bucket access logs. The user is configured for log file management. A user assigned the permission to access an object by the object owner. OBS supports five types of object access permissions, as shown in Table 6-2. Table 6-2 Access permissions supported by OBS Permission Read permission (READ) Write permission (WRITE) ACL view permission (READ_ACP) ACL modification permission (WRITE_ACP) Full control (FULL_CONTROL) Description The permission to read an object. The permission to write an object, that is, to overwrite and change the object. The permission to view the ACL of an object. An object owner has this permission. The permission to modify the ACL of an object. An object owner has this permission. NOTE As a user assigned such a permission can modify permission control policies, the user owns the full control permission. Exercise caution when assigning this permission to other users. The permission to control an object. A user assigned such a permission possesses all the permissions mentioned above. Step 4 Optional: Click Add Permission. Enter Domain ID of a specific user and set ACL permission for the user. You can obtain Domain ID on the Authentication Center page. Issue 01 ( ) 40

43 6 Object Management If no ACL permission is assigned for a new object, OBS automatically disables the access to the object by other users except the object owner. For details on how to use ACL permissions, see section ACL in the Object Storage Service API Reference. Step 5 Click Save. A message is displayed indicating a successful object permission setting. ----End Follow-up Procedure Click Delete to delete permissions of specific users when necessary. Click the permission list. to collapse 6.3 Object URL Procedure The object uniform resource locator (URL) (object sharing) function allows anonymous users to access object data using object URLs. Step 1 Log in to OBS Console. Issue 01 ( ) 41

44 6 Object Management Step 2 In the bucket list, select the bucket where the object you want to share resides. And click Object Management. Step 3 Click the icon before the object name. Step 4 Click Permission to assign the anonymous user the permission to read the object. Step 5 Click Save to save the ACL permission settings. Step 6 Click Link. The URL is displayed on the page. The anonymous user can access the object by clicking the URL. The object URL is in the format of name/bucket name/directory level/object name, for example, If the object is in the root directory of the bucket, the URL does not contain directory level. If Versioning Control is enabled for the bucket and Show Version is enabled for the object list, the object URL contains a version and is in the format of name/bucket name/directory level/object name?versionid=version, for example, 2e9292f6872c446b47e04cf4001B a. Issue 01 ( ) 42

45 6 Object Management ----End The browser-based object access method varies depending on the object type. You can directly open TXT and HTML files using a browser. However, when you open EXE and DAT files using a browser, the files are automatically downloaded to your local computer. 6.4 Uploading a File Prerequisites This section describes how to upload local files to OBS for storage. At least one bucket has been created. Context You can upload a file with up to 50 MB on the OBS management console. You cannot batch upload files on the management console. To upload multiple files, use OBS clients or invoke application programming interfaces (APIs) or software development kits (SDKs). Procedure Step 1 Log in to the management console. Step 2 Select the bucket from which you want to upload files and click Object Management,the Object Management page is displayed. Step 3 Optional: 6.1 Creating a Folder. Step 4 Optional: Click the folder name in Object Name. The folder is opened. Step 5 Click the icon in the red box shown in the picture. Step 6 Select the file that you want to upload and click Open. Step 7 Click Upload. A message is displayed indicating a successful upload. Issue 01 ( ) 43

46 6 Object Management ----End 6.5 Downloading a File Procedure This section describes how to download a file from OBS to a local computer. Step 1 Log in to the management console. Step 2 Select the bucket from which you want to download files and click Object Management. Step 3 Select the file you want to download. Step 4 Click Download and complete the download as prompted. ----End 6.6 Deleting a File Procedure This section describes how to delete a file. Step 1 Log in to the management console. Step 2 Select the bucket from which you want to delete files and click Object Management. Step 3 Select a file and click Delete. You can select multiple files and click Batch Delete to batch delete the files. Step 4 Click OK. The system prompts on top of the page that the file is successfully deleted. ----End Issue 01 ( ) 44

47 6 Object Management 6.7 Deleting a Folder Procedure This section describes how to delete a folder. Step 1 Log in to the management console. Step 2 Select the bucket from which you want to delete folders and click Object Management. The Object Management page is displayed. Step 3 Select the folder you want to delete. Step 4 Click Delete. Step 5 Click OK. The system prompts on top of the page that the folder is successfully deleted. ----End Issue 01 ( ) 45