使用和锁定保留政策

概览

本页面介绍了如何使用存储桶锁定功能,包括使用保留政策以及将其永久地锁定在存储桶上。

准备工作

请确保您已完成以下部分中的步骤,然后才能使用存储桶锁定功能。

获取所需角色

如需获得使用存储桶锁定所需的权限,请让您的管理员为您授予存储桶的 Storage Admin (roles/storage.admin) 角色。此预定义角色可提供使用存储桶锁定所需的权限。如需查看所需的确切权限,请展开所需权限部分:

所需权限

  • storage.buckets.get
  • storage.buckets.list
    • 仅当您计划使用Google Cloud 控制台执行本页面上的任务时,才需要此权限。
  • storage.buckets.update

您也可以使用自定义角色来获取这些权限。

如需了解如何授予存储桶的角色,请参阅将 IAM 与存储桶搭配使用

在存储桶上设置保留政策

如需在存储桶上添加、修改或移除保留政策,请执行以下操作:

控制台

  1. 在 Google Cloud 控制台中,转到 Cloud Storage 存储桶页面。

    进入“存储桶”

  2. 在存储桶列表中,点击要更改保留政策的存储桶的名称。

  3. 选择页面顶部附近的保护标签页。

  4. 保留政策部分中,设置保留政策:

    1. 如果当前没有适用于存储桶的保留政策,请点击 设置保留政策链接。选择保留期限的时间单位和时长。

    2. 如果某个保留政策当前应用于存储桶,它会显示在该部分中。点击修改以修改保留期限,或点击删除以完全移除保留政策。

    如需了解Google Cloud 控制台如何在不同时间单位之间进行转换,请参阅保留期限

如需了解如何在 Google Cloud 控制台中获取失败的 Cloud Storage 操作的详细错误信息,请参阅问题排查

命令行

使用带有相应标志的 gcloud storage buckets update 命令:

gcloud storage buckets update gs://BUCKET_NAME FLAG

其中:

  • BUCKET_NAME 是相关存储桶的名称,例如 my-bucket

  • FLAG 是存储桶的保留期限所需的设置。请采用以下某种格式:

    • --retention-period保留期限(如果要添加或更改保留政策)。例如 --retention-period=1d43200s
    • --clear-retention-period(如果要移除存储桶上的保留政策)。

如果成功,响应将如下所示:

Updating gs://my-bucket/...   Completed 1  

客户端库

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

namespace gcs = ::google::cloud::storage; using ::google::cloud::StatusOr; [](gcs::Client client, std::string const& bucket_name,    std::chrono::seconds period) {   StatusOr<gcs::BucketMetadata> original =       client.GetBucketMetadata(bucket_name);   if (!original) throw std::move(original).status();    StatusOr<gcs::BucketMetadata> patched = client.PatchBucket(       bucket_name,       gcs::BucketMetadataPatchBuilder().SetRetentionPolicy(period),       gcs::IfMetagenerationMatch(original->metageneration()));   if (!patched) throw std::move(patched).status();    if (!patched->has_retention_policy()) {     std::cout << "The bucket " << patched->name()               << " does not have a retention policy set.\n";     return;   }    std::cout << "The bucket " << patched->name()             << " retention policy is set to " << patched->retention_policy()             << "\n"; }

以下示例从存储桶中移除保留政策:

namespace gcs = ::google::cloud::storage; using ::google::cloud::StatusOr; [](gcs::Client client, std::string const& bucket_name) {   StatusOr<gcs::BucketMetadata> original =       client.GetBucketMetadata(bucket_name);   if (!original) throw std::move(original).status();    StatusOr<gcs::BucketMetadata> patched = client.PatchBucket(       bucket_name, gcs::BucketMetadataPatchBuilder().ResetRetentionPolicy(),       gcs::IfMetagenerationMatch(original->metageneration()));   if (!patched) throw std::move(patched).status();    if (!patched->has_retention_policy()) {     std::cout << "The bucket " << patched->name()               << " does not have a retention policy set.\n";     return;   }    std::cout << "The bucket " << patched->name()             << " retention policy is set to " << patched->retention_policy()             << ". This is unexpected, maybe a concurrent change by another"             << " application?\n"; }

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

 using Google.Cloud.Storage.V1; using System; using static Google.Apis.Storage.v1.Data.Bucket;  public class SetRetentionPolicySample {     /// <summary>     /// Sets the bucket's retention policy.     /// </summary>     /// <param name="bucketName">The name of the bucket.</param>     /// <param name="retentionPeriod">The duration in seconds that objects need to be retained. The retention policy enforces a minimum retention     /// time for all objects contained in the bucket, based on their creation time. Any     /// attempt to overwrite or delete objects younger than the retention period will     /// result in a PERMISSION_DENIED error. An unlocked retention policy can be modified     /// or removed from the bucket via a storage.buckets.update operation. A locked retention     /// policy cannot be removed or shortened in duration for the lifetime of the bucket.     /// Attempting to remove or decrease the period of a locked retention policy will result     /// in a PERMISSION_DENIED error.</param>     public RetentionPolicyData SetRetentionPolicy(         string bucketName = "your-unique-bucket-name",         long retentionPeriod = 10)     {         var storage = StorageClient.Create();         var bucket = storage.GetBucket(bucketName);         bucket.RetentionPolicy = new RetentionPolicyData { RetentionPeriod = retentionPeriod };          bucket = storage.UpdateBucket(bucket);          Console.WriteLine($"Retention policy for {bucketName} was set to {retentionPeriod}");         return bucket.RetentionPolicy;     } }

以下示例从存储桶中移除保留政策:

 using Google.Cloud.Storage.V1; using System;  public class RemoveRetentionPolicySample {     public void RemoveRetentionPolicy(string bucketName = "your-unique-bucket-name")     {         var storage = StorageClient.Create();         var bucket = storage.GetBucket(bucketName);         if (bucket.RetentionPolicy != null)         {             bool isLocked = bucket.RetentionPolicy.IsLocked ?? false;             if (isLocked)             {                 throw new Exception("Retention Policy is locked.");             }              bucket.RetentionPolicy.RetentionPeriod = null;             storage.UpdateBucket(bucket);              Console.WriteLine($"Retention period for {bucketName} has been removed.");         }     } }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

import ( 	"context" 	"fmt" 	"io" 	"time"  	"cloud.google.com/go/storage" )  // setRetentionPolicy sets the bucket retention period. func setRetentionPolicy(w io.Writer, bucketName string, retentionPeriod time.Duration) error { 	// bucketName := "bucket-name" 	// retentionPeriod := time.Second 	ctx := context.Background() 	client, err := storage.NewClient(ctx) 	if err != nil { 		return fmt.Errorf("storage.NewClient: %w", err) 	} 	defer client.Close()  	ctx, cancel := context.WithTimeout(ctx, time.Second*10) 	defer cancel()  	bucket := client.Bucket(bucketName) 	bucketAttrsToUpdate := storage.BucketAttrsToUpdate{ 		RetentionPolicy: &storage.RetentionPolicy{ 			RetentionPeriod: retentionPeriod, 		}, 	} 	if _, err := bucket.Update(ctx, bucketAttrsToUpdate); err != nil { 		return fmt.Errorf("Bucket(%q).Update: %w", bucketName, err) 	} 	fmt.Fprintf(w, "Retention policy for %v was set to %v\n", bucketName, bucketAttrsToUpdate.RetentionPolicy.RetentionPeriod) 	return nil } 

以下示例从存储桶中移除保留政策:

import ( 	"context" 	"fmt" 	"io" 	"time"  	"cloud.google.com/go/storage" )  // removeRetentionPolicy removes bucket retention policy. func removeRetentionPolicy(w io.Writer, bucketName string) error { 	// bucketName := "bucket-name" 	ctx := context.Background() 	client, err := storage.NewClient(ctx) 	if err != nil { 		return fmt.Errorf("storage.NewClient: %w", err) 	} 	defer client.Close()  	ctx, cancel := context.WithTimeout(ctx, time.Second*50) 	defer cancel()  	bucket := client.Bucket(bucketName) 	attrs, err := bucket.Attrs(ctx) 	if err != nil { 		return fmt.Errorf("Bucket(%q).Attrs: %w", bucketName, err) 	} 	if attrs.RetentionPolicy.IsLocked { 		return fmt.Errorf("retention policy is locked") 	}  	bucketAttrsToUpdate := storage.BucketAttrsToUpdate{ 		RetentionPolicy: &storage.RetentionPolicy{}, 	} 	if _, err := bucket.Update(ctx, bucketAttrsToUpdate); err != nil { 		return fmt.Errorf("Bucket(%q).Update: %w", bucketName, err) 	} 	fmt.Fprintf(w, "Retention period for %v has been removed\n", bucketName) 	return nil } 

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

 import com.google.cloud.storage.Bucket; import com.google.cloud.storage.Storage; import com.google.cloud.storage.Storage.BucketTargetOption; import com.google.cloud.storage.StorageException; import com.google.cloud.storage.StorageOptions; import java.time.Duration;  public class SetRetentionPolicy {   public static void setRetentionPolicy(       String projectId, String bucketName, Long retentionPeriodSeconds) throws StorageException {     // The ID of your GCP project     // String projectId = "your-project-id";      // The ID of your GCS bucket     // String bucketName = "your-unique-bucket-name";      // The retention period for objects in bucket     // Long retentionPeriodSeconds = 3600L; // 1 hour in seconds      Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();      // first look up the bucket so we will have its metageneration     Bucket bucket = storage.get(bucketName);     Bucket bucketWithRetentionPolicy =         storage.update(             bucket.toBuilder()                 .setRetentionPeriodDuration(Duration.ofSeconds(retentionPeriodSeconds))                 .build(),             BucketTargetOption.metagenerationMatch());      System.out.println(         "Retention period for "             + bucketName             + " is now "             + bucketWithRetentionPolicy.getRetentionPeriodDuration());   } }

以下示例从存储桶中移除保留政策:

 import com.google.cloud.storage.Bucket; import com.google.cloud.storage.Storage; import com.google.cloud.storage.StorageException; import com.google.cloud.storage.StorageOptions;  public class RemoveRetentionPolicy {   public static void removeRetentionPolicy(String projectId, String bucketName)       throws StorageException, IllegalArgumentException {     // The ID of your GCP project     // String projectId = "your-project-id";      // The ID of your GCS bucket     // String bucketName = "your-unique-bucket-name";      Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();      Bucket bucket =         storage.get(             bucketName, Storage.BucketGetOption.fields(Storage.BucketField.RETENTION_POLICY));     if (bucket.retentionPolicyIsLocked() != null && bucket.retentionPolicyIsLocked()) {       throw new IllegalArgumentException(           "Unable to remove retention policy as retention policy is locked.");     }      bucket.toBuilder().setRetentionPeriod(null).build().update();      System.out.println("Retention policy for " + bucketName + " has been removed");   } }

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

/**  * TODO(developer): Uncomment the following lines before running the sample.  */ // The ID of your GCS bucket // const bucketName = 'your-unique-bucket-name';  // The retention period for objects in bucket // const retentionPeriod = 3600; // 1 hour in seconds  // Imports the Google Cloud client library const {Storage} = require('@google-cloud/storage');  // Creates a client const storage = new Storage();  async function setRetentionPolicy() {   const [metadata] = await storage     .bucket(bucketName)     .setRetentionPeriod(retentionPeriod);   console.log(     `Bucket ${bucketName} retention period set for ${metadata.retentionPolicy.retentionPeriod} seconds.`   ); }  setRetentionPolicy().catch(console.error);

以下示例从存储桶中移除保留政策:

/**  * TODO(developer): Uncomment the following lines before running the sample.  */ // The ID of your GCS bucket // const bucketName = 'your-unique-bucket-name';  // Imports the Google Cloud client library const {Storage} = require('@google-cloud/storage');  // Creates a client const storage = new Storage();  async function removeRetentionPolicy() {   const [metadata] = await storage.bucket(bucketName).getMetadata();   if (metadata.retentionPolicy && metadata.retentionPolicy.isLocked) {     console.log(       'Unable to remove retention period as retention policy is locked.'     );     return null;   } else {     const results = await storage.bucket(bucketName).removeRetentionPeriod();     console.log(`Removed bucket ${bucketName} retention policy.`);     return results;   } }  removeRetentionPolicy().catch(console.error);

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

use Google\Cloud\Storage\StorageClient;  /**  * Sets a bucket's retention policy.  *  * @param string $bucketName The name of your Cloud Storage bucket.  *        (e.g. 'my-bucket')  * @param int $retentionPeriod The retention period for objects in bucket, in seconds.  *        (e.g. 3600)  */ function set_retention_policy(string $bucketName, int $retentionPeriod): void {     $storage = new StorageClient();     $bucket = $storage->bucket($bucketName);     $bucket->update([         'retentionPolicy' => [             'retentionPeriod' => $retentionPeriod         ]]);     printf('Bucket %s retention period set to %s seconds' . PHP_EOL, $bucketName,         $retentionPeriod); }

以下示例从存储桶中移除保留政策:

use Google\Cloud\Storage\StorageClient;  /**  * Removes a bucket's retention policy.  *  * @param string $bucketName The name of your Cloud Storage bucket.  *        (e.g. 'my-bucket')  */ function remove_retention_policy(string $bucketName): void {     $storage = new StorageClient();     $bucket = $storage->bucket($bucketName);     $bucket->reload();      if (array_key_exists('isLocked', $bucket->info()['retentionPolicy']) &&         $bucket->info()['retentionPolicy']['isLocked']) {         printf('Unable to remove retention period as retention policy is locked.' . PHP_EOL);         return;     }      $bucket->update([         'retentionPolicy' => []     ]);     printf('Removed bucket %s retention policy' . PHP_EOL, $bucketName); }

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

from google.cloud import storage   def set_retention_policy(bucket_name, retention_period):     """Defines a retention policy on a given bucket"""     # bucket_name = "my-bucket"     # retention_period = 10      storage_client = storage.Client()     bucket = storage_client.bucket(bucket_name)      bucket.retention_period = retention_period     bucket.patch()      print(         "Bucket {} retention period set for {} seconds".format(             bucket.name, bucket.retention_period         )     )  

以下示例从存储桶中移除保留政策:

from google.cloud import storage   def remove_retention_policy(bucket_name):     """Removes the retention policy on a given bucket"""     # bucket_name = "my-bucket"      storage_client = storage.Client()     bucket = storage_client.bucket(bucket_name)     bucket.reload()      if bucket.retention_policy_locked:         print(             "Unable to remove retention period as retention policy is locked."         )         return      bucket.retention_period = None     bucket.patch()      print(f"Removed bucket {bucket.name} retention policy")  

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

以下示例在存储桶上设置保留政策:

def set_retention_policy bucket_name:, retention_period:   # The ID of your GCS bucket   # bucket_name = "your-unique-bucket-name"    # The retention period for objects in bucket   # retention_period = 3600 # 1 hour in seconds    require "google/cloud/storage"    storage = Google::Cloud::Storage.new   bucket  = storage.bucket bucket_name    bucket.retention_period = retention_period    puts "Retention period for #{bucket_name} is now #{bucket.retention_period} seconds." end

以下示例从存储桶中移除保留政策:

def remove_retention_policy bucket_name:   # The ID of your GCS bucket   # bucket_name = "your-unique-bucket-name"    require "google/cloud/storage"    storage = Google::Cloud::Storage.new   bucket  = storage.bucket bucket_name    if !bucket.retention_policy_locked?     bucket.retention_period = nil     puts "Retention policy for #{bucket_name} has been removed."   else     puts "Policy is locked and retention policy can't be removed."   end end

REST API

JSON API

  1. 安装并初始化 gcloud CLI,以便为 Authorization 标头生成访问令牌。

  2. 创建一个包含以下信息的 JSON 文件:

    {   "retentionPolicy": {     "retentionPeriod": "TIME_IN_SECONDS"   } }

    其中 TIME_IN_SECONDS 是存储桶中的对象必须保留的时长(以秒为单位),例如 2678400。请参阅保留期限,了解系统如何以秒为单位来计量不同的时间单位。

    要从存储桶中移除保留政策,请在 JSON 文件中使用以下内容:

    {   "retentionPolicy": null }
  3. 使用 cURL,通过 PATCH Bucket 请求调用 JSON API:

    curl -X PATCH --data-binary @JSON_FILE_NAME \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ -H "Content-Type: application/json" \ "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME?fields=retentionPolicy"

    其中:

    • JSON_FILE_NAME 是您在第 2 步中创建的 JSON 文件的路径。
    • BUCKET_NAME 是相关存储桶的名称,例如 my-bucket

XML API

XML API 不能用于在现有存储桶上设置或移除保留政策。它只能用于为新存储桶设置保留政策

锁定存储桶

要锁定存储桶并永久限制对存储桶保留政策的修改,请执行以下操作:

控制台

  1. 在 Google Cloud 控制台中,转到 Cloud Storage 存储桶页面。

    进入“存储桶”

  2. 在存储桶列表中,点击要锁定保留政策的存储桶的名称。

  3. 选择页面顶部附近的保护标签页。

  4. 保留政策部分,点击锁定按钮。

    此时将出现锁定保留政策吗?对话框。

  5. 阅读永久说明。

  6. “存储桶名称”文本框中,键入存储桶的名称。

  7. 点击锁定政策

如需了解如何在 Google Cloud 控制台中获取失败的 Cloud Storage 操作的详细错误信息,请参阅问题排查

命令行

使用带有 --lock-retention-period 标志的 gcloud storage buckets update 命令:

gcloud storage buckets update gs://BUCKET_NAME --lock-retention-period

其中 BUCKET_NAME 是相关存储桶的名称,例如 my-bucket

如果成功,响应类似于以下示例:

Updating gs://my-bucket/...   Completed 1  

客户端库

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

namespace gcs = ::google::cloud::storage; using ::google::cloud::StatusOr; [](gcs::Client client, std::string const& bucket_name) {   StatusOr<gcs::BucketMetadata> original =       client.GetBucketMetadata(bucket_name);   if (!original) throw std::move(original).status();    StatusOr<gcs::BucketMetadata> updated_metadata =       client.LockBucketRetentionPolicy(bucket_name,                                        original->metageneration());   if (!updated_metadata) throw std::move(updated_metadata).status();    if (!updated_metadata->has_retention_policy()) {     std::cerr << "The bucket " << updated_metadata->name()               << " does not have a retention policy, even though the"               << " operation to set it was successful.\n"               << "This is unexpected, and may indicate that another"               << " application has modified the bucket concurrently.\n";     return;   }    std::cout << "Retention policy successfully locked for bucket "             << updated_metadata->name() << "\nNew retention policy is: "             << updated_metadata->retention_policy()             << "\nFull metadata: " << *updated_metadata << "\n"; }

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

 using Google.Cloud.Storage.V1; using System;  public class LockRetentionPolicySample {     /// <summary>     /// Locks the retention policy of a bucket. This is a one-way process: once a retention     /// policy is locked, it cannot be shortened, removed or unlocked, although it can     /// be increased in duration. The lock persists until the bucket is deleted.     /// </summary>     /// <param name="bucketName">The name of the bucket whose retention policy should be locked.</param>     public bool? LockRetentionPolicy(string bucketName = "your-unique-bucket-name")     {         var storage = StorageClient.Create();         var bucket = storage.GetBucket(bucketName);         storage.LockBucketRetentionPolicy(bucketName, bucket.Metageneration.Value);         bucket = storage.GetBucket(bucketName);         Console.WriteLine($"Retention policy for {bucketName} is now locked");         Console.WriteLine($"Retention policy effective as of {bucket.RetentionPolicy.EffectiveTime}");          return bucket.RetentionPolicy.IsLocked;     } }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

import ( 	"context" 	"fmt" 	"io" 	"time"  	"cloud.google.com/go/storage" )  // lockRetentionPolicy locks bucket retention policy. func lockRetentionPolicy(w io.Writer, bucketName string) error { 	// bucketName := "bucket-name" 	ctx := context.Background() 	client, err := storage.NewClient(ctx) 	if err != nil { 		return fmt.Errorf("storage.NewClient: %w", err) 	} 	defer client.Close()  	ctx, cancel := context.WithTimeout(ctx, time.Second*50) 	defer cancel()  	bucket := client.Bucket(bucketName) 	attrs, err := bucket.Attrs(ctx) 	if err != nil { 		return fmt.Errorf("Bucket(%q).Attrs: %w", bucketName, err) 	}  	conditions := storage.BucketConditions{ 		MetagenerationMatch: attrs.MetaGeneration, 	} 	if err := bucket.If(conditions).LockRetentionPolicy(ctx); err != nil { 		return fmt.Errorf("Bucket(%q).LockRetentionPolicy: %w", bucketName, err) 	}  	lockedAttrs, err := bucket.Attrs(ctx) 	if err != nil { 		return fmt.Errorf("Bucket(%q).Attrs: lockedAttrs: %w", bucketName, err) 	}  	fmt.Fprintf(w, "Retention policy for %v is now locked\n", bucketName) 	fmt.Fprintf(w, "Retention policy effective as of %v\n", lockedAttrs.RetentionPolicy.EffectiveTime) 	return nil } 

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

 import com.google.cloud.storage.Bucket; import com.google.cloud.storage.Storage; import com.google.cloud.storage.StorageException; import com.google.cloud.storage.StorageOptions; import java.util.Date;  public class LockRetentionPolicy {   public static void lockRetentionPolicy(String projectId, String bucketName)       throws StorageException {     // The ID of your GCP project     // String projectId = "your-project-id";      // The ID of your GCS bucket     // String bucketName = "your-unique-bucket-name";      Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();     Bucket bucket =         storage.get(bucketName, Storage.BucketGetOption.fields(Storage.BucketField.METAGENERATION));     Bucket lockedBucket =         bucket.lockRetentionPolicy(Storage.BucketTargetOption.metagenerationMatch());      System.out.println("Retention period for " + bucketName + " is now locked");     System.out.println(         "Retention policy effective as of " + new Date(lockedBucket.getRetentionEffectiveTime()));   } }

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

/**  * TODO(developer): Uncomment the following lines before running the sample.  */ // The ID of your GCS bucket // const bucketName = 'your-unique-bucket-name';  // Imports the Google Cloud client library const {Storage} = require('@google-cloud/storage');  // Creates a client const storage = new Storage();  async function lockRetentionPolicy() {   // Gets the current metageneration value for the bucket, required by   // lock_retention_policy   const [unlockedMetadata] = await storage.bucket(bucketName).getMetadata();    // Warning: Once a retention policy is locked, it cannot be unlocked. The   // retention period can only be increased   const [lockedMetadata] = await storage     .bucket(bucketName)     .lock(unlockedMetadata.metageneration);   console.log(`Retention policy for ${bucketName} is now locked`);   console.log(     `Retention policy effective as of ${lockedMetadata.retentionPolicy.effectiveTime}`   );    return lockedMetadata; }  lockRetentionPolicy().catch(console.error);

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

use Google\Cloud\Storage\StorageClient;  /**  * Locks a bucket's retention policy.  *  * @param string $bucketName The name of your Cloud Storage bucket.  *        (e.g. 'my-bucket')  */ function lock_retention_policy(string $bucketName): void {     $storage = new StorageClient();     $bucket = $storage->bucket($bucketName);     $bucket->reload();     $bucket->lockRetentionPolicy();     printf('Bucket %s retention policy locked' . PHP_EOL, $bucketName); }

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

from google.cloud import storage   def lock_retention_policy(bucket_name):     """Locks the retention policy on a given bucket"""     # bucket_name = "my-bucket"      storage_client = storage.Client()     # get_bucket gets the current metageneration value for the bucket,     # required by lock_retention_policy.     bucket = storage_client.get_bucket(bucket_name)      # Warning: Once a retention policy is locked it cannot be unlocked     # and retention period can only be increased.     bucket.lock_retention_policy()      print(f"Retention policy for {bucket_name} is now locked")     print(         f"Retention policy effective as of {bucket.retention_policy_effective_time}"     )  

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

def lock_retention_policy bucket_name:   # The ID of your GCS bucket   # bucket_name = "your-unique-bucket-name"    require "google/cloud/storage"    storage = Google::Cloud::Storage.new   bucket  = storage.bucket bucket_name    # Warning: Once a retention policy is locked it cannot be unlocked   # and retention period can only be increased.   # Uses Bucket#metageneration as a precondition.   bucket.lock_retention_policy!    puts "Retention policy for #{bucket_name} is now locked."   puts "Retention policy effective as of #{bucket.retention_effective_at}." end

REST API

JSON API

  1. 安装并初始化 gcloud CLI,以便为 Authorization 标头生成访问令牌。

  2. 使用 cURL,通过 POST Bucket 请求调用 JSON API:

    curl -X POST \ -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME/lockRetentionPolicy?ifMetagenerationMatch=BUCKET_METAGENERATION_NUMBER"

    其中:

    • BUCKET_NAME 是相关存储桶的名称,例如 my-bucket
    • BUCKET_METAGENERATION_NUMBER 是存储桶的 metageneration 值,例如 8。通过 GET Bucket 请求调用 JSON API,您可以找到存储桶的 metageneration 值。

XML API

您不能使用 XML API 来锁定存储桶。 请改用其他 Cloud Storage 工具,例如 Google Cloud 控制台。

查看存储桶的保留政策和锁定状态

要查看在存储桶上设置了什么保留政策以及是否该保留政策已锁定,请执行以下操作:

控制台

  1. 在 Google Cloud 控制台中,转到 Cloud Storage 存储桶页面。

    进入“存储桶”

  2. 点击您要查看其状态的存储桶的名称。

    如果存储桶具有保留政策,则保留期限会显示在该存储桶的保护字段中。如果保留政策未锁定,则保留期限旁边会出现一个处于解锁状态的锁形图标。如果保留政策被锁定,则保留期限旁边会出现一个处于锁定状态的锁形图标。

命令行

使用带有 --format 标志的 gcloud storage buckets describe 命令:

gcloud storage buckets describe gs://BUCKET_NAME --format="default(retention_policy)"

其中 BUCKET_NAME 是您要查看保留政策的存储桶的名称。例如 my-bucket

如果成功并且存储桶存在保留政策,则响应类似于以下内容:

retention_policy:   effectiveTime: '2022-10-04T18:51:22.161000+00:00'   retentionPeriod: '129600'

如果成功且存储桶不存在保留政策,则响应类似于以下内容:

null

客户端库

C++

如需了解详情,请参阅 Cloud Storage C++ API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

namespace gcs = ::google::cloud::storage; using ::google::cloud::StatusOr; [](gcs::Client client, std::string const& bucket_name) {   StatusOr<gcs::BucketMetadata> bucket_metadata =       client.GetBucketMetadata(bucket_name);   if (!bucket_metadata) throw std::move(bucket_metadata).status();    if (!bucket_metadata->has_retention_policy()) {     std::cout << "The bucket " << bucket_metadata->name()               << " does not have a retention policy set.\n";     return;   }    std::cout << "The bucket " << bucket_metadata->name()             << " retention policy is set to "             << bucket_metadata->retention_policy() << "\n"; }

C#

如需了解详情,请参阅 Cloud Storage C# API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

 using Google.Cloud.Storage.V1; using System; using static Google.Apis.Storage.v1.Data.Bucket;  public class GetRetentionPolicySample {     public RetentionPolicyData GetRetentionPolicy(string bucketName = "your-unique-bucket-name")     {         var storage = StorageClient.Create();         var bucket = storage.GetBucket(bucketName);          if (bucket.RetentionPolicy != null)         {             Console.WriteLine("Retention policy:");             Console.WriteLine($"Period: {bucket.RetentionPolicy.RetentionPeriod}");             Console.WriteLine($"Effective time: {bucket.RetentionPolicy.EffectiveTime}");             bool isLocked = bucket.RetentionPolicy.IsLocked ?? false;             Console.WriteLine($"Policy locked: {isLocked}");         }         return bucket.RetentionPolicy;     } }

Go

如需了解详情,请参阅 Cloud Storage Go API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

import ( 	"context" 	"fmt" 	"io" 	"time"  	"cloud.google.com/go/storage" )  // getRetentionPolicy gets bucket retention policy. func getRetentionPolicy(w io.Writer, bucketName string) (*storage.BucketAttrs, error) { 	// bucketName := "bucket-name" 	ctx := context.Background() 	client, err := storage.NewClient(ctx) 	if err != nil { 		return nil, fmt.Errorf("storage.NewClient: %w", err) 	} 	defer client.Close()  	ctx, cancel := context.WithTimeout(ctx, time.Second*10) 	defer cancel()  	attrs, err := client.Bucket(bucketName).Attrs(ctx) 	if err != nil { 		return nil, fmt.Errorf("Bucket(%q).Attrs: %w", bucketName, err) 	} 	if attrs.RetentionPolicy != nil { 		fmt.Fprintln(w, "Retention Policy") 		fmt.Fprintf(w, "period: %v\n", attrs.RetentionPolicy.RetentionPeriod) 		fmt.Fprintf(w, "effective time: %v\n", attrs.RetentionPolicy.EffectiveTime) 		fmt.Fprintf(w, "policy locked: %v\n", attrs.RetentionPolicy.IsLocked) 	} 	return attrs, nil } 

Java

如需了解详情,请参阅 Cloud Storage Java API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

 import com.google.cloud.storage.Bucket; import com.google.cloud.storage.Storage; import com.google.cloud.storage.StorageException; import com.google.cloud.storage.StorageOptions; import java.util.Date;  public class GetRetentionPolicy {   public static void getRetentionPolicy(String projectId, String bucketName)       throws StorageException {     // The ID of your GCP project     // String projectId = "your-project-id";      // The ID of your GCS bucket     // String bucketName = "your-unique-bucket-name";      Storage storage = StorageOptions.newBuilder().setProjectId(projectId).build().getService();     Bucket bucket =         storage.get(             bucketName, Storage.BucketGetOption.fields(Storage.BucketField.RETENTION_POLICY));      System.out.println("Retention Policy for " + bucketName);     System.out.println("Retention Period: " + bucket.getRetentionPeriod());     if (bucket.retentionPolicyIsLocked() != null && bucket.retentionPolicyIsLocked()) {       System.out.println("Retention Policy is locked");     }     if (bucket.getRetentionEffectiveTime() != null) {       System.out.println("Effective Time: " + new Date(bucket.getRetentionEffectiveTime()));     }   } }

Node.js

如需了解详情,请参阅 Cloud Storage Node.js API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

/**  * TODO(developer): Uncomment the following lines before running the sample.  */ // The ID of your GCS bucket // const bucketName = 'your-unique-bucket-name';  // Imports the Google Cloud client library const {Storage} = require('@google-cloud/storage');  // Creates a client const storage = new Storage();  async function getRetentionPolicy() {   const [metadata] = await storage.bucket(bucketName).getMetadata();   if (metadata.retentionPolicy) {     const retentionPolicy = metadata.retentionPolicy;     console.log('A retention policy exists!');     console.log(`Period: ${retentionPolicy.retentionPeriod}`);     console.log(`Effective time: ${retentionPolicy.effectiveTime}`);     if (retentionPolicy.isLocked) {       console.log('Policy is locked');     } else {       console.log('Policy is unlocked');     }   } }  getRetentionPolicy().catch(console.error);

PHP

如需了解详情,请参阅 Cloud Storage PHP API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

use Google\Cloud\Storage\StorageClient;  /**  * Gets a bucket's retention policy.  *  * @param string $bucketName The name of your Cloud Storage bucket.  *        (e.g. 'my-bucket')  */ function get_retention_policy(string $bucketName): void {     $storage = new StorageClient();     $bucket = $storage->bucket($bucketName);     $bucket->reload();      printf('Retention Policy for ' . $bucketName . PHP_EOL);     printf('Retention Period: ' . $bucket->info()['retentionPolicy']['retentionPeriod'] . PHP_EOL);     if (array_key_exists('isLocked', $bucket->info()['retentionPolicy']) &&         $bucket->info()['retentionPolicy']['isLocked']) {         printf('Retention Policy is locked' . PHP_EOL);     }     if ($bucket->info()['retentionPolicy']['effectiveTime']) {         printf('Effective Time: ' . $bucket->info()['retentionPolicy']['effectiveTime'] . PHP_EOL);     } }

Python

如需了解详情,请参阅 Cloud Storage Python API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

from google.cloud import storage   def get_retention_policy(bucket_name):     """Gets the retention policy on a given bucket"""     # bucket_name = "my-bucket"      storage_client = storage.Client()     bucket = storage_client.bucket(bucket_name)     bucket.reload()      print(f"Retention Policy for {bucket_name}")     print(f"Retention Period: {bucket.retention_period}")     if bucket.retention_policy_locked:         print("Retention Policy is locked")      if bucket.retention_policy_effective_time:         print(             f"Effective Time: {bucket.retention_policy_effective_time}"         )  

Ruby

如需了解详情,请参阅 Cloud Storage Ruby API 参考文档

如需向 Cloud Storage 进行身份验证,请设置应用默认凭证。如需了解详情,请参阅为客户端库设置身份验证

def get_retention_policy bucket_name:   # The ID of your GCS bucket   # bucket_name = "your-unique-bucket-name"    require "google/cloud/storage"    storage = Google::Cloud::Storage.new   bucket  = storage.bucket bucket_name    puts "Retention policy:"   puts "period: #{bucket.retention_period}"   puts "effective time: #{bucket.retention_effective_at}"   puts "policy locked: #{bucket.retention_policy_locked?}" end

REST API

JSON API

  1. 安装并初始化 gcloud CLI,以便为 Authorization 标头生成访问令牌。

  2. 使用 cURL,通过包含所需 fieldsGET Bucket 请求调用 JSON API:

    curl -X GET -H "Authorization: Bearer $(gcloud auth print-access-token)" \ "https://storage.googleapis.com/storage/v1/b/BUCKET_NAME?fields=retentionPolicy"

    其中 BUCKET_NAME 是相关存储桶的名称,例如 my-bucket

    如果存储桶上设置了保留政策,则响应类似于以下示例:

    {   "retentionPolicy": {       "retentionPeriod": "TIME_IN_SECONDS",       "effectiveTime": "DATETIME",       "isLocked": "BOOLEAN"    }, }

XML API

XML API 不能用于查看存储桶上的保留政策。请改用其他 Cloud Storage 工具,例如Google Cloud 控制台。

后续步骤