Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 82 additions & 0 deletions docs/acl_guide.rst
Original file line number Diff line number Diff line change
@@ -0,0 +1,82 @@
ACL
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for fixing the structure and moving the guides up. With this update, I plan to modify this guide to include both ACL and IAM. I'll create a separate PR once this is merged in :)

===

Cloud Storage uses access control lists (ACLs) to manage object and bucket access.
ACLs are the mechanism you use to share files with other users and allow
other users to access your buckets and files.

ACLs are suitable for fine-grained control, but you may prefer using IAM to
control access at the project level. See also:
`Cloud Storage Control Access to Data <https://cloud.google.com/storage/docs/access-control>`_


:class:`google.cloud.storage.bucket.Bucket` has a getting method that creates
an ACL object under the hood, and you can interact with that using
:func:`google.cloud.storage.bucket.Bucket.acl`:

.. code-block:: python
client = storage.Client()
bucket = client.get_bucket(bucket_name)
acl = bucket.acl
Adding and removing permissions can be done with the following methods
(in increasing order of granularity):

- :func:`ACL.all`
corresponds to access for all users.
- :func:`ACL.all_authenticated` corresponds
to access for all users that are signed into a Google account.
- :func:`ACL.domain` corresponds to access on a
per Google Apps domain (ie, ``example.com``).
- :func:`ACL.group` corresponds to access on a
per group basis (either by ID or e-mail address).
- :func:`ACL.user` corresponds to access on a
per user basis (either by ID or e-mail address).

And you are able to ``grant`` and ``revoke`` the following roles:

- **Reading**:
:func:`_ACLEntity.grant_read` and :func:`_ACLEntity.revoke_read`
- **Writing**:
:func:`_ACLEntity.grant_write` and :func:`_ACLEntity.revoke_write`
- **Owning**:
:func:`_ACLEntity.grant_owner` and :func:`_ACLEntity.revoke_owner`

You can use any of these like any other factory method (these happen to
be :class:`_ACLEntity` factories):

.. code-block:: python
acl.user("[email protected]").grant_read()
acl.all_authenticated().grant_write()
After that, you can save any changes you make with the
:func:`google.cloud.storage.acl.ACL.save` method:

.. code-block:: python
acl.save()
You can alternatively save any existing :class:`google.cloud.storage.acl.ACL`
object (whether it was created by a factory method or not) from a
:class:`google.cloud.storage.bucket.Bucket`:

.. code-block:: python
bucket.acl.save(acl=acl)
To get the list of ``entity`` and ``role`` for each unique pair, the
:class:`ACL` class is iterable:

.. code-block:: python
print(list(acl))
# [{'role': 'OWNER', 'entity': 'allUsers'}, ...]
This list of tuples can be used as the ``entity`` and ``role`` fields
when sending metadata for ACLs to the API.

21 changes: 20 additions & 1 deletion docs/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,31 @@
:class:`multiprocessing.Pool` or :class:`multiprocessing.Process` invokes
:func:`os.fork`.

Guides
------
.. toctree::
:maxdepth: 2

acl_guide
generation_metageneration
retry_timeout

API Reference
-------------
.. toctree::
:maxdepth: 2

storage/modules
storage/acl
storage/batch
storage/blob
storage/bucket
storage/client
storage/constants
storage/fileio
storage/hmac_key
storage/notification
storage/retry


More Examples
-------------
Expand Down
File renamed without changes.
File renamed without changes.
85 changes: 1 addition & 84 deletions docs/storage/acl.rst
Original file line number Diff line number Diff line change
@@ -1,88 +1,5 @@
ACL
===

Cloud Storage uses access control lists (ACLs) to manage object and bucket access.
ACLs are the mechanism you use to share files with other users and allow
other users to access your buckets and files.

ACLs are suitable for fine-grained control, but you may prefer using IAM to
control access at the project level. See also:
`Cloud Storage Control Access to Data <https://cloud.google.com/storage/docs/access-control>`_


:class:`google.cloud.storage.bucket.Bucket` has a getting method that creates
an ACL object under the hood, and you can interact with that using
:func:`google.cloud.storage.bucket.Bucket.acl`:

.. code-block:: python

client = storage.Client()
bucket = client.get_bucket(bucket_name)
acl = bucket.acl

Adding and removing permissions can be done with the following methods
(in increasing order of granularity):

- :func:`ACL.all`
corresponds to access for all users.
- :func:`ACL.all_authenticated` corresponds
to access for all users that are signed into a Google account.
- :func:`ACL.domain` corresponds to access on a
per Google Apps domain (ie, ``example.com``).
- :func:`ACL.group` corresponds to access on a
per group basis (either by ID or e-mail address).
- :func:`ACL.user` corresponds to access on a
per user basis (either by ID or e-mail address).

And you are able to ``grant`` and ``revoke`` the following roles:

- **Reading**:
:func:`_ACLEntity.grant_read` and :func:`_ACLEntity.revoke_read`
- **Writing**:
:func:`_ACLEntity.grant_write` and :func:`_ACLEntity.revoke_write`
- **Owning**:
:func:`_ACLEntity.grant_owner` and :func:`_ACLEntity.revoke_owner`

You can use any of these like any other factory method (these happen to
be :class:`_ACLEntity` factories):

.. code-block:: python

acl.user("[email protected]").grant_read()
acl.all_authenticated().grant_write()

After that, you can save any changes you make with the
:func:`google.cloud.storage.acl.ACL.save` method:

.. code-block:: python

acl.save()


You can alternatively save any existing :class:`google.cloud.storage.acl.ACL`
object (whether it was created by a factory method or not) from a
:class:`google.cloud.storage.bucket.Bucket`:

.. code-block:: python

bucket.acl.save(acl=acl)


To get the list of ``entity`` and ``role`` for each unique pair, the
:class:`ACL` class is iterable:

.. code-block:: python

print(list(acl))
# [{'role': 'OWNER', 'entity': 'allUsers'}, ...]


This list of tuples can be used as the ``entity`` and ``role`` fields
when sending metadata for ACLs to the API.


ACL Module
----------
-----------

.. automodule:: google.cloud.storage.acl
:members:
Expand Down
File renamed without changes.
2 changes: 1 addition & 1 deletion docs/storage/buckets.rst → docs/storage/bucket.rst
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Buckets
Bucket
~~~~~~~

.. automodule:: google.cloud.storage.bucket
Expand Down
17 changes: 0 additions & 17 deletions docs/storage/modules.rst

This file was deleted.