Equivalent of AWS s3 x-amz-acl header in Azure and Google Cloud

Question

In AWS S3 when uploading an object you can add "x-amz-acl=bucket-owner-full-control" to url (as query parameter) to make the object belong to the bucket and not the uploader. How do you achieve the same when using Cloud Storage or Azure Storage?

Answer 1

How do you achieve the same when using Cloud Storage or Azure Storage?

In Azure Storage, you don't have to do anything special. The ownership of objects (blobs) always lie with the storage account owner where the blob is being uploaded. They can delegate permissions to manage the blob to some other users but the ownership always remains with the account owner.

Answer 2

Firebase Storage is closer to Dropbox or Google Drive where the owner is technically the bucket, Should you want to track who the owner is, you can however use the metadata

var newMetadata = {
  customMetadata : {
      'owner': auth().currentUser.uid
      }
};
storageItemReference.updateMetadata(newMetadata)
  .then((metadata) => {
    // Updated metadata for your storage item is returned in the Promise
  }).catch((error) => {
    // Uh-oh, an error occurred!
  });

• https://firebase.google.com/docs/storage/web/file-metadata#custom_metadata

If you are finding that users are able to delete storage when they shouldn't, You can also control this behavior from Security Rules

service firebase.storage {
  match /b/{bucket}/o {
    // A read rule can be divided into read and list rules
    match /images/{imageId} {
      // Applies to single document read requests
      allow get: if <condition>;
      // Applies to list and listAll requests (Rules Version 2)
      allow list: if <condition>;

    // A write rule can be divided into create, update, and delete rules
    match /images/{imageId} {
      // Applies to writes to nonexistent files
      allow create: if <condition>;

      // Applies to updates to file metadata
      allow update: if <condition>;

      // Applies to delete operations
      allow delete: if <condition>;
    }
  }
 }
}

Source: https://firebase.google.com/docs/storage/security/core-syntax

Answer 3

For Google Cloud Storage, the equivalent of uploading an object with the x-amz-acl=bucket-owner-full-control is to upload an object with the x-goog-acl=bucket-owner-full-control header. Switching the amz to goog works for most headers. There's a translation table of S3 to GCS headers.

In addition, if you're looking to make sure that all objects in a bucket are accessible by only the bucket owner, you may find it more convenient to use Uniform Bucket Level Access . Once enabled, individual object ownership within the bucket no longer exists, and you no longer need to specify that header with each upload.

You can enable Uniform Bucket Level Access from the UI, the API, or via this command: gsutil uniformbucketlevelaccess set on gs://BUCKET_NAME