This policy allows users to perform any operation on OBS using the API, SDKs, OBS Console, or tools.
-When a user logs in to OBS Console, the user accesses resources of other services, such as audit information in CTS, acceleration domain names in CDN, and keys in KMS. Therefore, in addition to the OBS permissions, you need to grant users the permissions for other services. CDN is a global service, while CTS, SMN, and KMS are regional ones. You need to configure the
Tenant Guest permission for the global project and regional projects based on the services and regions that you use.
{
+Example Custom Policies
- Example 1: Grant permissions that allow full access to OBS.
This policy allows users to perform any operation on OBS using the API, SDKs, OBS Console, or tools.
+If a user logs in to OBS Console and also accesses resources of other services, such as audit information in CTS, acceleration domain names in CDN, and keys in KMS, in addition to the OBS permissions, you need to grant users the permissions to access these services. CDN is a global service. CTS, SMN, and KMS are regional services. You need to configure the
Tenant Guest permission for the global project and regional projects based on the services and regions that you use.
{
"Version": "1.1",
"Statement": [
{
@@ -770,7 +815,7 @@
]
}
- Example 2: Grant the read-only permission on a bucket to users (any directory).
This policy allows users to list and download all objects in bucket
obs-example.
{
+- Example 2: Grant permissions that allow read-only access to a bucket (any directory).
This policy allows users to list and download all objects from bucket
obs-example.
{
"Version": "1.1",
"Statement": [
{
@@ -787,7 +832,7 @@
]
}
- Example 3: Grant the read-only permission on a bucket to users (specified directory).
This policy allows users to only download objects in the
my-project/ directory of bucket
obs-example. Objects in other directories can be listed but cannot be downloaded.
{
+- Example 3: Grant permissions that allow read-only access to a bucket (a specified directory).
This policy allows users to download objects only from the
my-project/ directory of bucket
obs-example. Objects in other directories can be listed but cannot be downloaded.
{
"Version": "1.1",
"Statement": [
{
@@ -804,7 +849,7 @@
]
}
- Example 4: Grant the read and write permissions on a bucket to users (specified directory).
This policy allows users to list, download, upload, and delete objects in the
my-project directory of bucket
obs-example.
{
+- Example 4: Grant permissions that allow read and write access to a bucket (a specified directory).
This policy allows users to list, download, upload, and delete objects in the
my-project directory of bucket
obs-example.
{
"Version": "1.1",
"Statement": [
{
@@ -824,7 +869,7 @@
]
}
- Example 5: Grant all permissions on a bucket to users.
This policy allows users to perform any operation on bucket
obs-example.
{
+- Example 5: Grant permissions that allow full access to a bucket.
This policy allows users to perform any operation on bucket
obs-example.
{
"Version": "1.1",
"Statement": [
{
@@ -840,20 +885,20 @@
]
}
- Example 6: Deny a user the permission to upload objects.
A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.
-The following method can be used if you need to assign permissions of the OBS OperateAccess policy to a user but also forbid the user from uploading objects. Create a custom policy for denying object upload, and assign both policies to the user. Then the user can perform all OBS OperateAccess permissions except uploading objects. The following is an example of a deny policy:
-{
- "Version": "1.1",
- "Statement": [
- {
- "Effect": "Deny",
- "Action": [
- "obs:object:PutObject"
- ]
- }
- ]
+ - Example 6: Deny object upload.
A policy with only Deny statements must be used together other policies. If the policy assigned to a user contains both Allow and Deny statements, the Deny statement take precedence over the Allow statement.
+If you need to assign OBS OperateAccess permissions to a user but prevent the user from uploading objects, you can create a custom policy to deny object upload, and assign this custom policy and OBS OperateAccess to the user. Then the user can perform all operations allowed by OBS OperateAccess except for uploading objects. The following is an example of a deny policy:
+{
+ "Version": "1.1",
+ "Statement": [
+ {
+ "Effect": "Deny",
+ "Action": [
+ "obs:object:PutObject"
+ ]
+ }
+ ]
}
- - Example 7: Grant users the permissions required to change a bucket's storage class and to delete certain objects in the bucket.
This policy allows users to change the storage class of bucket obs-example and to delete object my-object.txt in the bucket.
+ - Example 7: Grant the permissions to change a bucket's storage class and delete certain objects from the bucket.
This policy allows users to change the storage class of bucket obs-example and to delete object my-object.txt from the bucket.
{
"Version": "1.1",
"Statement": [
@@ -882,7 +927,7 @@
Bucket Policies
-Overview
A bucket policy applies to an OBS bucket and objects in the bucket. By leveraging bucket policies, the owner of a bucket can authorize IAM users or other accounts the permissions to operate the bucket and objects in the bucket.
-
- Creating a bucket and obtaining a bucket list are service-level operations. To obtain such operation permissions, you need to configure IAM permissions.
- Due to data caching, after a bucket policy is configured, it takes 5 minutes at most for the policy to take effect.
+
Overview
A bucket policy applies to an OBS bucket and the objects in the bucket. Bucket policies let a bucket owner grant IAM users or other accounts permissions on the bucket and its objects.
+
- Creating a bucket and obtaining a bucket list are service-level operations. To obtain such operation permissions, you need to configure IAM permissions.
- Due to data caching, it takes 5 minutes at most for a bucket policy to take effect.
Bucket Policy Overview
A bucket policy is attached to a bucket and objects in the bucket. An OBS bucket owner can use bucket policies to grant IAM users, other accounts, or anonymous users the permissions to operate buckets and objects in the buckets. OBS provides standard and advanced bucket policies.
@@ -71,11 +71,11 @@
Custom Bucket Policy:
The following three modes are provided to facilitate quick configuration of a custom bucket policy:
-
- Read-only: With the Read-only mode, you only need to specify the Principal (authorized users). Then the authorized users have the read permission for the bucket and objects in the bucket, and can perform all GET operations on these resources.
- Read and write: With the Read and write mode, you only need to specify the Principal (authorized users). Then the authorized users have the full control permissions for the bucket and objects in the bucket, and can perform any operation on these resources.
- Customized: With the Customized mode, you can define the specific operation permissions that you want to authorize to users and accounts by configuring the parameters of Effect, Principal, Resources, Actions, and Conditions. For details, see Bucket Policy Parameters.
+
- Read-only: With the Read-only mode, you only need to specify the Principal (authorized users). Then the authorized users have the read permission for the bucket and objects in the bucket, and can perform all GET operations on these resources.
- Read and write: With the Read and write mode, you only need to specify the Principal (authorized users). Then the authorized users have the full control permissions for the bucket and objects in the bucket, and can perform any operation on these resources.
- Customized: With the Customized mode, you can define the specific operation permissions that you want to authorize to users and accounts by configuring the parameters of Effect, Principal, Resources, Actions, and Conditions. For details, see Bucket Policy Parameters.
On OBS Console, when you use the custom bucket policy to authorize other users with resource operation permissions, you also need to authorize the users with the bucket read permission ListBucket (leave the resource name blank to indicate that the policy takes effect on the entire bucket). Otherwise, the users have no permission to access the bucket.
-
Bucket Policy Application Scenarios
- You can use bucket policies to grant other accounts the permissions to access OBS resources.
- You can configure bucket policies to grant IAM users various access permissions to different buckets.
+
Application Scenarios of a Bucket Policy
- Grant other accounts the permissions to access OBS resources.
- Grant IAM users the permissions to access buckets.
Policy Structure and Syntax
A bucket policy is in JSON format. The format is as follows:
{
"Statement" : [
@@ -89,33 +89,33 @@
]
}
-
Example:
{
- "Statement":[
- {
+Example:
{
+ "Statement":[
+ {
"Sid": "ExampleStatementID1",
- "Principal":{
- "ID":[
+ "Principal":{
+ "ID":[
"domain/account ID",
"domain/account ID:user/User ID"
- ]
- },
- "Effect":"Allow",
- "Action":[
- "CreateBucket",
- "DeleteBucket"
- ],
- "Resource":"000-02/key01",
- "Condition":{
- "NumericNotEquals":{
- "Referer":"sdf"
- },
- "StringNotLike":{
- "Delimiter":"ouio"
- }
- }
- }
- ]
- }
+ ]
+ },
+ "Effect":"Allow",
+ "Action":[
+ "CreateBucket",
+ "DeleteBucket"
+ ],
+ "Resource":"000-02/key01",
+ "Condition":{
+ "NumericNotEquals":{
+ "Referer":"sdf"
+ },
+ "StringNotLike":{
+ "Delimiter":"ouio"
+ }
+ }
+ }
+ ]
+ }
A bucket policy comprises one or more statements. Each statement contains the following elements:
@@ -158,14 +158,14 @@
