Index: tools/telemetry/third_party/gsutilz/gslib/addlhelp/acls.py |
diff --git a/tools/telemetry/third_party/gsutilz/gslib/addlhelp/acls.py b/tools/telemetry/third_party/gsutilz/gslib/addlhelp/acls.py |
index b9ac443f75d67259f214dbb8976c4a5ff95fd808..12c43c070451730cf9cfabbb03f3665aa790e71e 100644 |
--- a/tools/telemetry/third_party/gsutilz/gslib/addlhelp/acls.py |
+++ b/tools/telemetry/third_party/gsutilz/gslib/addlhelp/acls.py |
@@ -34,22 +34,23 @@ _DETAILED_HELP_TEXT = (""" |
<B>BUCKET VS OBJECT ACLS</B> |
In Google Cloud Storage, the bucket ACL works as follows: |
- - Users granted READ access are allowed to list the bucket contents. |
+ - Users granted READ access are allowed to list the bucket contents and read |
+ bucket metadata other than its ACL. |
- - Users granted WRITE access are allowed READ access and also are |
- allowed to write and delete objects in that bucket -- including |
- overwriting previously written objects. |
+ - Users granted WRITE access are allowed READ access and also are allowed to |
+ write and delete objects in that bucket, including overwriting previously |
+ written objects. |
- - Users granted OWNER access are allowed WRITE access and also |
- are allowed to read and write the bucket's ACL. |
+ - Users granted OWNER access are allowed WRITE access and also are allowed to |
+ read and write the bucket's ACL. |
The object ACL works as follows: |
- Users granted READ access are allowed to read the object's data and |
metadata. |
- - Users granted OWNER access are allowed READ access and also |
- are allowed to read and write the object's ACL. |
+ - Users granted OWNER access are allowed READ access and also are allowed to |
+ read and write the object's ACL. |
A couple of points are worth noting, that sometimes surprise users: |
@@ -60,13 +61,13 @@ _DETAILED_HELP_TEXT = (""" |
object ACL matters for that purpose. This is different from how things |
work in Linux file systems, where both the file and directory permission |
control file read access. It also means, for example, that someone with |
- OWNER over the bucket may not have read access to objects in |
- the bucket. This is by design, and supports useful cases. For example, |
- you might want to set up bucket ownership so that a small group of |
- administrators have OWNER on the bucket (with the ability to |
- delete data to control storage costs), but not grant those users read |
- access to the object data (which might be sensitive data that should |
- only be accessed by a different specific group of users). |
+ OWNER over the bucket may not have read access to objects in the bucket. |
+ This is by design, and supports useful cases. For example, you might want |
+ to set up bucket ownership so that a small group of administrators have |
+ OWNER on the bucket (with the ability to delete data to control storage |
+ costs), but not grant those users read access to the object data (which |
+ might be sensitive data that should only be accessed by a different |
+ specific group of users). |
<B>CANNED ACLS</B> |