Question

我正在循环遍历存储桶中的所有对象ACL，以从所有对象中删除“Everyone”权限。这里的想法是保留所有当前权限。

我的问题是PutACL调用不起作用。在下面的示例中，创建了一个新的AccessControlList，省略了“everyone”条目。 PutACL调用成功返回，但对象的ACL未更改。

也许有一种更简单的方法来识别和删除特定的拨款。

AmazonS3Client s3 = new AmazonS3Client();
GetACLRequest aclRequest = new GetACLRequest() { BucketName = "my-bucket", Key = "/dir/protect_me.txt" };
var aclResponse = s3.GetACL(aclRequest);

bool foundEveryonePriv = false;  //if found at least one.

S3AccessControlList newAcl = new S3AccessControlList();
foreach (var grant in aclResponse.AccessControlList.Grants)
{
    bool grantToEveryone = string.Compare(grant.Grantee.URI, "http://acs.amazonaws.com/groups/global/AllUsers") == 0;
    Logger.log.InfoFormat("{0},{1},{2},{3}", aclRequest.BucketName, o.Key, grant.Permission, (everyoneHasThisPriv ? "EVERYONE" : string.Empty));

    if (grantToEveryone)
    {
        foundEveryonePriv = true;
        newAcl.AddGrant(grant.Grantee, grant.Permission);
    }
}

//modify the items if necessary and requested.
if (foundEveryonePriv)
{
    newAcl.Owner = aclResponse.AccessControlList.Owner;
    var response = s3.PutACL(new PutACLRequest() { AccessControlList = newAcl, BucketName = aclRequest.BucketName, Key = o.Key });
}

Answer 1

尝试从GET修改现有ACL以删除公共授权。然后在PUT请求中发回修改后的ACL。这就是我所做的，并且保留原始拨款并从给定对象中删除公共拨款。

    private void RemovePublicAcl(AmazonS3Client client, string bucket, string key)
    {
        var aclRequest = new GetACLRequest { BucketName = bucket, Key = key };
        var aclResponse = client.GetACL(aclRequest);
        var acl = aclResponse.AccessControlList;

        const string PUBLIC_GRANTEE = "http://acs.amazonaws.com/groups/global/AllUsers";

        if (acl.Grants.Any(x =>
            !string.IsNullOrWhiteSpace(x.Grantee.URI) &&
            x.Grantee.URI.Equals(PUBLIC_GRANTEE)))
        {
            var publicGrant = new S3Grantee();
            publicGrant.URI = PUBLIC_GRANTEE;
            acl.Grants.RemoveAll(x =>
                !string.IsNullOrWhiteSpace(x.Grantee.URI) &&
                x.Grantee.URI.Equals(PUBLIC_GRANTEE));

            var aclUpdate = new PutACLRequest();
            aclUpdate.BucketName = bucket;
            aclUpdate.Key = key;
            aclUpdate.AccessControlList = acl;

            var response = client.PutACL(aclUpdate);
        }

使用.NET API从aws s3对象ACL中删除“Everyone”

1 个答案: