Torch Object Storage
Torch Object Storage
Torch Object Storage
Document
What's New
Announcements
Billing
Billable items
Billing method
Getting Started
User Guide
Working with buckets
Basic configurations
Managing lifecycle
Back-to-origin rules
Event notification
Intelligent Tiering
Permissions
Domain management
Fault tolerance and disaster recovery
Cross-region replication
Same-region replication
Data redundancy
Image processing
ObjectSet
Working with objects
Managing folders
Monitoring and alerting
Metric monitoring
Access control
Bucket policies
Common configuration scenarios
Authorizing IAM users of the current account
Authorizing other accounts
Managing access via tools and SDKs
Managing public read access
Data security
Access points
Multi-region access points (MRAP)
Single-region access points (SRAP)
Converged access points (CAP)
DevMind
TOS accelerator
SenseFlow
TOS Agent
Data processing
Basic concepts
Image processing
Media processing
Document preview
Task processing
Data subscription
Flow control management
Quality of Service (QoS) policies
Hierarchical namespace (HNS)
User guide
Tool reference
Best practices
TOS Vectors
User guide
API reference
Vector bucket
Vector index
SDK reference
Python-Vectors
Vector bucket
Vector index
Java-Vectors
Vector bucket
Vector index
Node.js-Vectors
Vector bucket
Vector index
Tool Guide
tosutil
Common commands
Upload, download, and copy objects
Share objects
Auxiliary commands
Common examples
TOS Browser
FSX
FSX best practices
TOS PyTorch Connector
tosfsspec
API Reference
Signature Mechanism
The header contains a signature
Bucket
Basic Bucket Operations
Bucket Lifecycle
Access Monitor
Bucket ACL
Bucket CORS
Bucket Policy
Back-to-origin Rules
Bucket Replication
Versioning
Static Website
Event Notification
Custom Domain
Server-side encryption
Transfer Acceleration
Data Processing
Image processing
Media processing
Video transcoding
Audio transcoding
video to GIF
Document preview
File decompression
Log Storage
Retention Policy
Requester pays
TLS version
Object
Basic Object Operations
Object ACL
Fetch Object
Symbolic Link
WORM object
Multipart Upload
SDK Reference
Java
Pre-signing Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload Object
Download Object
Upload and Download Speed Limit
Copy Object
List Object
Data Processing
Image Processing
Video Processing
Audio Processing
Log Configuration
Hierarchical Namespace
Bucket base interface
Introduction to Typical Scenes
Python
Data processing
Pre-signature mechanism
Bucket interface
Basic bucket interface
Manage bucket configuration
Object interface
Upload object
Download object
Copy object
List objects
Introduction to typical scenes
C
Object Interface
Upload object
C++
Pre-signature Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload Object
Download Object
Copy Object
List Objects
Data Processing
Go
Object Interface
Upload Object
Download Object
Copy Object
List Objects
Manage Objects
Bucket Interface
Manage Bucket Configuration
Data Processing
Log Configuration
Introduction to Typical Scenes
Pre-signature Mechanism
Node.js
Pre-signature Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload object
Download object
Copy object
List objects
Data Processing
Image Processing
Introduction to Typical Scenes
Browser.js
Pre-signature Mechanism
Upload Object
Download Object
Copy Object
List Objects
Manage Objects
Data Processing
.NET
Bucket Interface
Object Interface
Upload Object
Download Object
List Objects
Introduction to Typical Scenes
PHP
Bucket Interface
Object Interface
Download Object
Data Processing
Exception Handling
Android
Bucket Interface
Object Interface
Upload Object
Download Object
Exception Handling
iOS
Bucket Interface
Object Interface
Upload Object
Download Object
Harmony
Pre-signature Mechanism
Bucket Interface
Object Interface
Upload Object
Download Object
List Objects v2
Introduction to Typical Scenarios
Rust
Pre-signing mechanism
Bucket interface
Basic bucket operations
Lifecycle rules
Bucket ACLs
Cross-origin resource sharing
Bucket inventory
Back-to-origin rules
Bucket replication
Static website hosting
Event notification
Custom domain
Server-side encryption
Object interface
Basic operation
Access control
Error Codes
01-SERVICE_ERROR
02-AUTH
03-ACCESS_CONTROL
04-QOS
05-REQUEST
06-BUCKET
07-LIFECYCLE
08-ACL
09-CORS
10-POLICY
11-MIRROR
12-REPLICATION
13-WEBSITE
14-NOTIFICATION
15-ENCRYPT
16-CUSTOMDOMAIN
17-OBJECT
18-TAG
19-MULTIPART
20-STORAGE_CLASS
21-CALLBACK
22-DATA_PROCESS
23-BATCH
24-STORAGE_LENS
25-INVENTORY
26-DIRECTORY_BUCKET
FAQ
Best Practices
AIGC-Doubao LLMs
Accessing TOS with third-party tools
Granting temporary access
Data migration
Data processing
Checking data integrity
Performance optimization
- Documentation
Torch Object StorageSDK ReferenceJavaBucket InterfaceManage Bucket ConfigurationManaging Bucket ACLs (Java SDK)
Copy page
Download PDFManage Bucket Configuration
Managing Bucket ACLs (Java SDK)
Copy pageDownload PDFManaging Bucket ACLs (Java SDK)
A bucket (Bucket) in TOS is a globally unique namespace that serves as a data container for storing object (Object) data. TOS access control for bucket resources includes bucket authorization policies (Bucket Policy) and bucket read/write permission controls (Bucket ACL). This article explains how to manage bucket read and write permissions (ACL) using the TOS Java SDK. For information on bucket authorization policy management, please refer to the authorization policy configuration section.
Configuring Bucket Access Permissions
You can set the read and write permissions for a specified bucket through the putBucketACL interface of the TOS Java SDK.
warning
To set read and write permissions for a bucket, your account must have the tos:PutBucketACL permission or the WRITE_ACP bucket ACL permission. For detailed instructions, see Permission Configuration Overview.
Bucket ACL Description
Bucket ACL permissions include the following five categories.
Access permission | Description | Access Permission Value |
Access permission | Description | Access Permission Value |
READ | Allow authorized users to list objects in the storage bucket. | PermissionType.PERMISSION_READ |
WRITE | Authorized users are permitted to create, overwrite, and delete any object within the bucket. | PermissionType.PERMISSION_WRITE |
READ_ACP | Allow authorized entities to read the storage bucket ACL. | PermissionType.PERMISSION_READ_ACP |
WRITE_ACP | Allow authorized users to write to the bucket ACL. | PermissionType.PERMISSION_WRITE_ACP |
FULL_CONTROL | Authorized users are permitted READ, WRITE, READ_ACP, and WRITE_ACP permissions on the storage bucket. | PermissionType.PERMISSION_FULL_CONTROL |
Bucket access permissions can be configured either by specifying detailed ACL information in the request body or by setting them in the request header.
Provide detailed information in the request body. ACL Permission Information
The following code demonstrates how to set bucket permission information in the request body.
import com.volcengine.tos.TOSV2;
import com.volcengine.tos.TOSV2ClientBuilder;
import com.volcengine.tos.TosClientException;
import com.volcengine.tos.TosServerException;
import com.volcengine.tos.comm.common.CannedType;
import com.volcengine.tos.comm.common.GranteeType;
import com.volcengine.tos.comm.common.PermissionType;
import com.volcengine.tos.model.acl.GrantV2;
import com.volcengine.tos.model.acl.GranteeV2;
import com.volcengine.tos.model.acl.Owner;
import com.volcengine.tos.model.bucket.PutBucketACLInput;
import com.volcengine.tos.model.bucket.PutBucketACLOutput;
import java.util.ArrayList;
import java.util.List;
public class PutBucketACLWithGrantsExample {
public static void main(String[] args) {
String endpoint = "your endpoint";
String region = "your region";
String accessKey = System.getenv("TOS_ACCESS_KEY");
String secretKey = System.getenv("TOS_SECRET_KEY");
String bucketName = "your bucket name";
TOSV2 tos = new TOSV2ClientBuilder().build(region, endpoint, accessKey, secretKey);
try{
String accountId = "the granted account id";
String accountDisplayName = "the granted account display name";
GranteeV2 grantee1 = new GranteeV2().setType(GranteeType.GRANTEE_USER)
.setId(accountId).setDisplayName(accountDisplayName);
GrantV2 grant1 = new GrantV2().setGrantee(grantee1).setPermission(PermissionType.PERMISSION_FULL_CONTROL);
GranteeV2 grantee2 = new GranteeV2().setType(GranteeType.GRANTEE_GROUP)
.setCanned(CannedType.CANNED_ALL_USERS);
GrantV2 grant2 = new GrantV2().setGrantee(grantee2).setPermission(PermissionType.PERMISSION_READ);
List<GrantV2> grantList = new ArrayList<>();
grantList.add(grant1);
grantList.add(grant2);
String ownerId = "your owner id";
String ownerDisplayName = "your owner display name";
PutBucketACLInput input = new PutBucketACLInput().setBucket(bucketName).setGrants(grantList)
.setOwner(new Owner().setId(ownerId).setDisplayName(ownerDisplayName));
PutBucketACLOutput output = tos.putBucketACL(input);
System.out.println("putBucketACL succeed");
} catch (TosClientException e) {
System.out.println("putBucketACL failed");
System.out.println("Message: " + e.getMessage());
if (e.getCause() != null) {
e.getCause().printStackTrace();
}
} catch (TosServerException e) {
System.out.println("putBucketACL failed");
System.out.println("StatusCode: " + e.getStatusCode());
System.out.println("Code: " + e.getCode());
System.out.println("Message: " + e.getMessage());
System.out.println("RequestID: " + e.getRequestID());
} catch (Throwable t) {
System.out.println("putBucketACL failed");
System.out.println("unexpected exception, message: " + t.getMessage());
}
}
}
Configuring access permissions in the request header
There are four types of bucket read/write permissions that can be configured via the x-tos-acl request header.
Access permission | Description | Access Permission Value |
Access permission | Description | Access Permission Value |
Private | Private. The bucket owner has FULL_CONTROL permissions, while other users are not authorized to operate on this object. | ACLType.ACL_PRIVATE |
Public Read | Public reading. The owner of the bucket has FULL_CONTROL permissions, while other users have only READ permissions for that bucket. | ACLType.ACL_PUBLIC_READ |
Public Read and Write | Public read/write. All users have the FULL_CONTROL permission. | ACLType.ACL_PUBLIC_READ_WRITE |
Read Access for Certified Users | The bucket owner has FULL_CONTROL permission, while authenticated users have READ permission on the bucket. | ACLType.ACL_AUTHENTICATED_READ |
The following code demonstrates how to set bucket read/write permissions using x-tos-acl.
import com.volcengine.tos.TOSV2;
import com.volcengine.tos.TOSV2ClientBuilder;
import com.volcengine.tos.TosClientException;
import com.volcengine.tos.TosServerException;
import com.volcengine.tos.comm.common.ACLType;
import com.volcengine.tos.model.bucket.PutBucketACLInput;
import com.volcengine.tos.model.bucket.PutBucketACLOutput;
public class PutBucketACLWithAclHeaderExample {
public static void main(String[] args) {
String endpoint = "your endpoint";
String region = "your region";
String accessKey = System.getenv("TOS_ACCESS_KEY");
String secretKey = System.getenv("TOS_SECRET_KEY");
String bucketName = "your bucket name";
TOSV2 tos = new TOSV2ClientBuilder().build(region, endpoint, accessKey, secretKey);
try{
ACLType aclType = ACLType.ACL_PRIVATE;
PutBucketACLInput input = new PutBucketACLInput().setBucket(bucketName).setAcl(aclType);
PutBucketACLOutput output = tos.putBucketACL(input);
System.out.println("putBucketACL succeed");
} catch (TosClientException e) {
System.out.println("putBucketACL failed");
System.out.println("Message: " + e.getMessage());
if (e.getCause() != null) {
e.getCause().printStackTrace();
}
} catch (TosServerException e) {
System.out.println("putBucketACL failed");
System.out.println("StatusCode: " + e.getStatusCode());
System.out.println("Code: " + e.getCode());
System.out.println("Message: " + e.getMessage());
System.out.println("RequestID: " + e.getRequestID());
} catch (Throwable t) {
System.out.println("putBucketACL failed");
System.out.println("unexpected exception, message: " + t.getMessage());
}
}
}
The following code demonstrates how to set bucket read and write permissions via the x-tos-grant-* request header.
import com.volcengine.tos.TOSV2;
import com.volcengine.tos.TOSV2ClientBuilder;
import com.volcengine.tos.TosClientException;
import com.volcengine.tos.TosServerException;
import com.volcengine.tos.model.bucket.PutBucketACLInput;
import com.volcengine.tos.model.bucket.PutBucketACLOutput;
public class PutBucketACLWithGrantHeaderExample {
public static void main(String[] args) {
String endpoint = "your endpoint";
String region = "your region";
String accessKey = System.getenv("TOS_ACCESS_KEY");
String secretKey = System.getenv("TOS_SECRET_KEY");
String bucketName = "your bucket name";
TOSV2 tos = new TOSV2ClientBuilder().build(region, endpoint, accessKey, secretKey);
try{
String grantFullControlRule = "id=\"1000000001\"";
String grantReadRule = "canned=\"AllUsers\"";
PutBucketACLInput input = new PutBucketACLInput().setBucket(bucketName)
.setGrantFullControl(grantFullControlRule).setGrantRead(grantReadRule);
PutBucketACLOutput output = tos.putBucketACL(input);
System.out.println("putBucketACL succeed");
} catch (TosClientException e) {
System.out.println("putBucketACL failed");
System.out.println("Message: " + e.getMessage());
if (e.getCause() != null) {
e.getCause().printStackTrace();
}
} catch (TosServerException e) {
System.out.println("putBucketACL failed");
System.out.println("StatusCode: " + e.getStatusCode());
System.out.println("Code: " + e.getCode());
System.out.println("Message: " + e.getMessage());
System.out.println("RequestID: " + e.getRequestID());
} catch (Throwable t) {
System.out.println("putBucketACL failed");
System.out.println("unexpected exception, message: " + t.getMessage());
}
}
}
Obtaining Access Permissions for Buckets
You can obtain the current read and write permissions configured for a specified bucket through the TOS Java SDK's getBucketACL interface.
warning
To obtain access to a bucket, your account must have the tos:GetBucketACL permission or the bucket ACL permission READ_ACP. For detailed procedures, refer to Permission Configuration Overview.
<SOURCE_TEXT>The following code demonstrates how to obtain bucket access permissions.</SOURCE_TEXT>
import com.volcengine.tos.TOSV2;
import com.volcengine.tos.TOSV2ClientBuilder;
import com.volcengine.tos.TosClientException;
import com.volcengine.tos.TosServerException;
import com.volcengine.tos.model.acl.GrantV2;
import com.volcengine.tos.model.bucket.GetBucketACLInput;
import com.volcengine.tos.model.bucket.GetBucketACLOutput;
public class GetBucketACLExample {
public static void main(String[] args) {
String endpoint = "your endpoint";
String region = "your region";
String accessKey = System.getenv("TOS_ACCESS_KEY");
String secretKey = System.getenv("TOS_SECRET_KEY");
String bucketName = "your bucket name";
TOSV2 tos = new TOSV2ClientBuilder().build(region, endpoint, accessKey, secretKey);
try{
GetBucketACLInput input = new GetBucketACLInput().setBucket(bucketName);
GetBucketACLOutput output = tos.getBucketACL(input);
System.out.println("getBucketACL succeed");
if (output.getOwner() != null) {
System.out.println("owner id is " + output.getOwner().getId());
System.out.println("owner display name is " + output.getOwner().getDisplayName());
}
if (output.getGrants() != null) {
System.out.println("this bucket has " + output.getGrants().size() + " grants");
for (int i = 0; i < output.getGrants().size(); i++){
GrantV2 grant = output.getGrants().get(i);
if (grant.getGrantee() != null) {
System.out.printf("bucket acl grantee, id is %s, displayName is %s, type is %s, uri is %s.\n",
grant.getGrantee().getId(), grant.getGrantee().getDisplayName(),
grant.getGrantee().getType(), grant.getGrantee().getCanned());
}
System.out.println("bucket acl grant permission is " + grant.getPermission() + ".");
}
}
} catch (TosClientException e) {
System.out.println("getBucketACL failed");
System.out.println("Message: " + e.getMessage());
if (e.getCause() != null) {
e.getCause().printStackTrace();
}
} catch (TosServerException e) {
System.out.println("getBucketACL failed");
System.out.println("StatusCode: " + e.getStatusCode());
System.out.println("Code: " + e.getCode());
System.out.println("Message: " + e.getMessage());
System.out.println("RequestID: " + e.getRequestID());
} catch (Throwable t) {
System.out.println("getBucketACL failed");
System.out.println("unexpected exception, message: " + t.getMessage());
}
}
}
Related documentation
Last updated: 2025.09.19 20:00:28
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
