vpruthi/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity
doc-exports/docs/obs/perms-cfg/obs_40_0003.html
zhangyue 2c8baf104e OBS PERM DOC 
Reviewed-by: Sabelnikov, Dmitriy <dmitriy.sabelnikov@t-systems.com>
Co-authored-by: zhangyue <zhangyue164@huawei.com>
Co-committed-by: zhangyue <zhangyue164@huawei.com>
2024-10-29 16:45:36 +00:00

934 lines
74 KiB
HTML
Raw Blame History

<a name="obs_40_0003"></a><a name="obs_40_0003"></a>
<h1 class="topictitle1">IAM Permissions</h1>
<div id="body1588766432188"><div class="section" id="obs_40_0003__section8489111318501"><h4 class="sectiontitle">IAM Permissions Overview</h4><p id="obs_40_0003__p6942143264820">By default, newly created IAM users do not have any permissions. You need to add the user to one or more groups, and attach permission policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.</p>
<p id="obs_40_0003__p1456812431508">IAM permissions apply to all OBS buckets and objects. To grant an IAM user the permission to operate OBS resources, you need to assign one or more OBS permission sets to the user group that the user belongs to.</p>
<p id="obs_40_0003__p9631520165012">OBS is a global service because it is available in all physical regions. If users in the global project are assigned IAM permissions, they do not need to switch regions to access OBS.</p>
<p id="obs_40_0003__p28301569268">You can grant permissions to users by roles and policies.</p>
<ul id="obs_40_0003__ul6830126162610"><li id="obs_40_0003__li1682355416298">Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism only provides a limited number of service-level roles for authorization. When using roles to grant permissions, you also need to assign other dependency roles. However, roles are not the best choice for fine-grained authorization and secure access control.</li><li id="obs_40_0003__li14830365263">Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant OBS users only the permissions to manage a certain type of OBS resources. </li></ul>
<div class="note" id="obs_40_0003__note1018554855215"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="obs_40_0003__p13185164825218">Due to data caching, a role and policy involving OBS actions will take effect 10 to 15 minutes after it is attached to a user, an enterprise project, or a user group.</p>
</div></div>
<p id="obs_40_0003__p4554141720431">IAM presets system permissions for each cloud service so that you can quickly configure basic permissions. <a href="#obs_40_0003__table143320246431">Table 1</a> describes all system permissions of OBS.</p>
<p id="obs_40_0003__p19243941181716">Custom policies can be created to supplement the system-defined policies of OBS.</p>
<div class="tablenoborder"><a name="obs_40_0003__table143320246431"></a><a name="table143320246431"></a><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table143320246431" frame="border" border="1" rules="all"><caption><b>Table 1 </b>OBS system permissions</caption><thead align="left"><tr id="obs_40_0003__row13332624144312"><th align="left" class="cellrowborder" valign="top" width="21.18788121187881%" id="mcps1.3.1.10.2.5.1.1"><p id="obs_40_0003__p7332132484320">Role/Policy Name</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="50.38496150384961%" id="mcps1.3.1.10.2.5.1.2"><p id="obs_40_0003__p5332824174310">Description</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="15.778422157784222%" id="mcps1.3.1.10.2.5.1.3"><p id="obs_40_0003__p033272494312">Type</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="12.64873512648735%" id="mcps1.3.1.10.2.5.1.4"><p id="obs_40_0003__p1612261564417">Dependency</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row92218311275"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p82223315277">Tenant Administrator</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p4466456182919">Users with this permission can perform all operations on all services except IAM.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p13307349152715">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p1730724915271">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row6159933152717"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p26447396278">Tenant Guest</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p201591334273">Users with this permission can perform read-only operations on all services except IAM.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p1684219494278">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p0842749152715">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row03951422204919"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p71016102325">OBS Administrator</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p1910111102324">Users with this permission are OBS administrators and can perform any operations on all OBS resources under the account.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p157071737143313">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p3396922114915">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row333212434317"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p143321924104311">OBS Buckets Viewer</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p1733310247431">Users with this permission can list buckets, obtain basic information about buckets, and obtain bucket metadata.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p20333192411434">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p5122161564420">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row7333132416439"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p23331324114313">OBS ReadOnlyAccess</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p193331246430">Users with this permission can list buckets, obtain basic information about buckets, obtain bucket metadata, and list objects (not the objects that have been versioned).</p>
<div class="note" id="obs_40_0003__note864512387375"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="obs_40_0003__p136452384379">If a user with this permission fails to list objects on OBS Console, there may be multiple versions of objects in the bucket. In this case, you need to grant the user the <strong id="obs_40_0003__b48819478457">obs:bucket:ListBucketVersions</strong> permission so that the user can view different versions of objects on OBS Console.</p>
</div></div>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p123331524164312">System-defined policy</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p9122215164414">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row3333202464311"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p1333112420434">OBS OperateAccess</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p145991616552">Users with this permission can perform all OBS ReadOnlyAccess operations and perform basic operations on objects, such as uploading, downloading, and deleting objects, and obtaining object ACLs.</p>
<div class="note" id="obs_40_0003__note84579519419"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="obs_40_0003__p9457205144115">If a user with this permission fails to list objects on OBS Console, there may be multiple versions of objects in the bucket. In this case, you need to grant the user the <strong id="obs_40_0003__b1569722243510">obs:bucket:ListBucketVersions</strong> permission so that the user can view different versions of objects on OBS Console.</p>
</div></div>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p933316249432">System-defined policy</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p51221615164410">N/A</p>
</td>
</tr>
</tbody>
</table>
</div>
<p id="obs_40_0003__p9504334163519">The following table lists the common operations supported by system-defined permissions for OBS. You can refer to this table to select the permissions as required.</p>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table487418345322" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Permissions and allowed operations on OBS resources</caption><thead align="left"><tr id="obs_40_0003__row18752034153214"><th align="left" class="cellrowborder" valign="top" width="15.45154515451545%" id="mcps1.3.1.12.2.8.1.1"><p id="obs_40_0003__p19875183413211">Operation</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="12.96129612961296%" id="mcps1.3.1.12.2.8.1.2"><p id="obs_40_0003__p1787543415321">Tenant Administrator</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="14.371437143714372%" id="mcps1.3.1.12.2.8.1.3"><p id="obs_40_0003__p17875183453217">Tenant Guest</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.57135713571357%" id="mcps1.3.1.12.2.8.1.4"><p id="obs_40_0003__p202931642123616">OBS Administrator</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.521352135213519%" id="mcps1.3.1.12.2.8.1.5"><p id="obs_40_0003__p1875143419322">OBS Buckets Viewer</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="16.16161616161616%" id="mcps1.3.1.12.2.8.1.6"><p id="obs_40_0003__p13549121722913">OBS ReadOnlyAccess</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.96139613961396%" id="mcps1.3.1.12.2.8.1.7"><p id="obs_40_0003__p083112213323">OBS OperateAccess</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row38751334123213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p4875334173218">Listing buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p158751234193220">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17875934133211">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p061715283373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p3875123473211">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p16261055154514">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p9735558184514">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row1687563493217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287513414329">Creating buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p3875203413327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1587593413213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p9617828113717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1487512349322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1126555174515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p773518587457">No</p>
</td>
</tr>
<tr id="obs_40_0003__row11875183410322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p13875134133219">Deleting buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1687515347324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17875434193217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p17617152818371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p387503415322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p0261155134515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p973565816451">No</p>
</td>
</tr>
<tr id="obs_40_0003__row987573417327"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p148751134173213">Obtaining basic information about buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p138751334113219">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1087523483213">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p761782813717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p987573463218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p22613559455">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p7735145813458">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row4876113433212"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p4876183473211">Controlling bucket access</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p9876193415323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17876133418322">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p17617182820378">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p987673410324">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p52618555455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p11735135815455">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1387615347325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p15876133413320">Managing bucket policies</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p6876113418328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p88761434143216">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561716286378">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p9876113443216">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p112635504510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p10735195814513">No</p>
</td>
</tr>
<tr id="obs_40_0003__row16876634103218"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p0876153433214">Modifying bucket storage classes</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p387643423218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p6876103423217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p2617428183716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p16876634123220">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p8266551456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1173565854520">No</p>
</td>
</tr>
<tr id="obs_40_0003__row158761634103210"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p188762034103218">Listing objects</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p587663411323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p287673417327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p46171428163719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17876634183219">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p626855134514">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1873515588450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row28761934203219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p18876123453215">Listing versioned objects</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p38777342320">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p158771134153210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p961752819376">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1787710348327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p7275553453">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p107351958134510">No</p>
</td>
</tr>
<tr id="obs_40_0003__row08771934103210"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287723417322">Uploading a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p187753413215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p78771134103215">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p861722843718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1687713413215">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p10271555154517">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673555814511">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row13877153414323"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1877103443215">Creating a folder</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p11877173419320">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p087733433213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p16181728113710">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p13877634133219">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1275556452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p573555844520">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row6877234123218"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p987713349327">Deleting a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p158772342328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1687853413212">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p196181428183716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12878334153217">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p17271955194518">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1373635820450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row2087803443216"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287811343321">Deleting a folder</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p148782034193217">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p187813423210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p4618628203719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p387833412329">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p527855124510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p67361558174516">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row887883443219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p178781234133217">Downloading a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1487873419324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p138781034103212">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1661882815373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p14878534183210">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1527105513456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p373695864516">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row148786344325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p38781534163214">Deleting files with multiple versions</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p168781734153213">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p287893433210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p4618328123711">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1587833473213">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p4271557451">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p2073645813450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row2087817349322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287993411325">Downloading files with multiple versions</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p188795346321">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p7879103419329">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p46189285373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p48791134133216">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p72735544520">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673675854512">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row987919344325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287953463220">Modifying object storage classes</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p18879193483210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p10879134153219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p2618192853712">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1087913419325">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p52775554519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673635813455">No</p>
</td>
</tr>
<tr id="obs_40_0003__row108790349328"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p7879203433218">Restoring files</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p9879173411327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p2087913346324">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p176181128163718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p11879173416321">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p327105554519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p197361358144518">No</p>
</td>
</tr>
<tr id="obs_40_0003__row2879153418326"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288033410329">Undeleting a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1488018348328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p19880634143210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p9618228113716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1888093443212">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172715594514">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p0736358134518">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row688093443220"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288014346328">Deleting fragments</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p118801634153215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p12880734183213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p96181328103719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p48801334173211">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p027855114515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p073695844510">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row11880123463217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288043414323">Controlling access to objects</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p288003415323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p0880173453213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p196180281371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17880113415327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172765514452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p10736558184514">No</p>
</td>
</tr>
<tr id="obs_40_0003__row588113349321"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p2088123463216">Configuring object metadata</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p888133416323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p4881113417323">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1861852863716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p6881183420322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p132714554456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p4736558194518">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1061717483135"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1078225161310">Obtaining object metadata</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1617174815139">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1261116718143">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p6618132811375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1611977144">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p7611157161420">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p106181748161316">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row1388123473217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p16881234133216">Managing versioning</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p7881143473210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1588193483217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p106181028103713">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p5881133413214">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172716550455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p7736105844519">No</p>
</td>
</tr>
<tr id="obs_40_0003__row18810349322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p118811434163214">Managing logging</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p388173433219">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p98812348327">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p0618142816375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1888283463214">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p5274556452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p14736858104517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row288263473212"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p158825342326">Managing event notifications</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p78824343324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1288273415323">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1361862803712">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1588219345328">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1027655194510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p873616582451">No</p>
</td>
</tr>
<tr id="obs_40_0003__row19882153413329"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p88821934163215">Managing tags</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p2882134113215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p16882143443218">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1761832820375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p188213343323">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p15271155174520">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1173645864510">No</p>
</td>
</tr>
<tr id="obs_40_0003__row288263463213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p3882193423217">Managing lifecycle rules</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1088223415325">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p11882163414328">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1861832819377">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1188283453213">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p16272551455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p18736358184515">No</p>
</td>
</tr>
<tr id="obs_40_0003__row68823341324"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p198821634123215">Managing static website hosting</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p78821434163215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p16882143423219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1061832812375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p10882123413323">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p11279553457">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1273613580459">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1088313342325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p2088320347328">Managing CORS rules</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p14883134103218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1188310342324">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1261813289371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p16883834163217">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p18277558451">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p11736858154517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row128831834163213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p14883143420323">Managing URL validation</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p108838346326">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p98831834153211">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p5618928153719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p168837347327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p927195517456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1073613588458">No</p>
</td>
</tr>
<tr id="obs_40_0003__row2883153453215"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p5883113413216">Managing domain names</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p11883113410327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p988393443219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561952817373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p19883143423210">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p11272055164516">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p2736458164517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row178830342321"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p188831134143213">Managing cross-region replication</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p158831634103220">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1588393403211">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p18619142814379">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1688312348327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p02710556454">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p177362582458">No</p>
</td>
</tr>
<tr id="obs_40_0003__row14833159185118"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p168336590517">Configuring an object ACL</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1783405916516">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p346217589522">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561919289374">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p94628586521">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p43499418535">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p93491644538">No</p>
</td>
</tr>
<tr id="obs_40_0003__row61481058105113"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p121484582512">Configuring ACL for an object of a specified version</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p314895845112">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p19462135805210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p3619152815379">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17462105818522">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p2266585316">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p92618575312">No</p>
</td>
</tr>
<tr id="obs_40_0003__row46051438185219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p144112452527">Obtaining an object ACL </p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p760623825215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p8462958195214">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1361919282379">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p164629580527">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p12239139125315">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1324020935316">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row15514134118523"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p341154595212">Obtaining the ACL of a specific object version</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p951417411526">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p194621658125215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p10619628153711">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12462558175212">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p10240109205312">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1324010912535">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row34981656105416"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p849865615548">Performing a multipart upload</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p74519365510">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p445163185519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1061982843717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12451365516">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p194683145518">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p19463316556">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row46882362507"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p5688836145016">Listing uploaded parts</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p399713018513">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p168936318512">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p8619328123718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p789315313510">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p4336201016519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p15830773515">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row17345184735011"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p9345114714501">Canceling a multipart upload</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p352114115111">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p55481942513">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p5619182816371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1954844135115">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1983401014513">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p9395148115110">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row1964311293372"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1064392913719">Configuring requester-pays</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p13643829123713">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p9643172913371">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p26191128193714">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1464382914376">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p564372911372">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p96431529143719">No</p>
</td>
</tr>
<tr id="obs_40_0003__row13404324373"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1940173263716">Obtaining requester-pays configuration information</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p4401332143717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p9405328377">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1461919284371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17401732153714">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p134093215372">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p54053210377">No</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="obs_40_0003__section01904185241"><h4 class="sectiontitle">Application Scenarios of IAM Permissions</h4><p id="obs_40_0003__p101714434165">IAM permissions control IAM users under an account to access:</p>
<ul id="obs_40_0003__ul319124042416"><li id="obs_40_0003__li244101111715">All cloud resources.</li><li id="obs_40_0003__li81911640122419">All OBS buckets and objects.</li><li id="obs_40_0003__li15991209568">Specified OBS resources.</li></ul>
</div>
<div class="section" id="obs_40_0003__section9268135516548"><h4 class="sectiontitle">Policy Structure and Syntax</h4><p id="obs_40_0003__p232429165515">A policy consists of a version and one or more statements.</p>
<div class="fignone" id="obs_40_0003__fig96590586581"><span class="figcap"><b>Figure 1 </b>Policy structure</span><br><span><img id="obs_40_0003__image116601758135815" src="en-us_image_0257849924.png"></span></div>
<p id="obs_40_0003__p88641011565">Policy syntax example:</p>
<pre class="screen" id="obs_40_0003__screen4200121482012">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:bucket:HeadBucket",
"obs:bucket:ListBucket",
"obs:bucket:GetBucketLocation"
],
"Resource": [
"obs:*:*:bucket:*"
],
"Condition": {
"StringEndWithIfExsits": {
"g:UserName": ["specialCharacter"]
},
"Bool": {
"g:MFAPresent": ["true"]
}
}
}
]
}</pre>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table987212714414" frame="border" border="1" rules="all"><caption><b>Table 3 </b>Policy syntax parameters</caption><thead align="left"><tr id="obs_40_0003__row19873102713411"><th align="left" class="cellrowborder" valign="top" width="22.09%" id="mcps1.3.3.6.2.3.1.1"><p id="obs_40_0003__p178737272043"><strong id="obs_40_0003__b82986207184949">Parameter</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="77.91%" id="mcps1.3.3.6.2.3.1.2"><p id="obs_40_0003__p1887302718414">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row17873027842"><td class="cellrowborder" valign="top" width="22.09%" headers="mcps1.3.3.6.2.3.1.1 "><p id="obs_40_0003__p48732027743">Version</p>
</td>
<td class="cellrowborder" valign="top" width="77.91%" headers="mcps1.3.3.6.2.3.1.2 "><div class="p" id="obs_40_0003__p829912213615">The version number of a policy.<ul id="obs_40_0003__ul1484412128619"><li id="obs_40_0003__li577602617611"><strong id="obs_40_0003__b133624981884949">1.0</strong>: RBAC policy. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.</li><li id="obs_40_0003__li1840484141"><strong id="obs_40_0003__b145719358384949">1.1</strong>: Fine-grained policy. A fine-grained policy consists of API-based permissions for operations on specific resource types. Fine-grained policies, as the name suggests, allow for more fine-grained control on specific operations and resources than RBAC policies. For example, you can restrict an IAM user to access only the objects in a specific directory of an OBS bucket.</li></ul>
</div>
</td>
</tr>
<tr id="obs_40_0003__row187317273414"><td class="cellrowborder" valign="top" width="22.09%" headers="mcps1.3.3.6.2.3.1.1 "><p id="obs_40_0003__p108731927249">Statement</p>
</td>
<td class="cellrowborder" valign="top" width="77.91%" headers="mcps1.3.3.6.2.3.1.2 "><div class="p" id="obs_40_0003__p17113185672413">Descriptions of a policy, including <strong id="obs_40_0003__b134931682460">Effect</strong>, <strong id="obs_40_0003__b115371712124616">Action</strong>, <strong id="obs_40_0003__b1141191914460">Resource</strong> (optional), and <strong id="obs_40_0003__b26891622184613">Condition</strong> (optional).<ul id="obs_40_0003__ul1802181615716"><li id="obs_40_0003__li480221610716"><strong id="obs_40_0003__b244516503192">Effect</strong><p id="obs_40_0003__p1880291618711">The value of <strong id="obs_40_0003__b139199271284949">Effect</strong> can be <strong id="obs_40_0003__b111932433884949">Allow</strong> or <strong id="obs_40_0003__b133550218884949">Deny</strong>. System policies contain only <strong id="obs_40_0003__b116709871584949">Allow</strong> statements. For custom policies containing both <strong id="obs_40_0003__b69691813284949">Allow</strong> and <strong id="obs_40_0003__b92522532484949">Deny</strong> statements, <strong id="obs_40_0003__b199531072884949">Deny</strong> statements take precedence over <strong id="obs_40_0003__b1290518132535">Allow</strong> statements.</p>
</li><li id="obs_40_0003__li980219163715"><strong id="obs_40_0003__b15985205113194">Action</strong><p id="obs_40_0003__p14803201610710">Actions allowed on resources. An action is in the format of <em id="obs_40_0003__i120632589084949">Service name</em>:<em id="obs_40_0003__i120545427484949">Resource type</em>:<em id="obs_40_0003__i92529442184949">Action</em>. A policy can contain one or more actions. You can use a wildcard (*) to indicate all services, resource types, or actions. There are two types of OBS resources: buckets and objects.</p>
</li><li id="obs_40_0003__li0244165152812"><strong id="obs_40_0003__b18514665284949">Resource</strong><p id="obs_40_0003__p1323103805814">Resources on which the policy takes effect. A resource is in the format of <em id="obs_40_0003__i31557539484949">Service name</em>:<em id="obs_40_0003__i86549574084949">Region</em>:<em id="obs_40_0003__i131716051184949">Domain ID</em>:<em id="obs_40_0003__i161483073384949">Resource type</em>:<em id="obs_40_0003__i13452511584949">Resource path</em>. You can use a wildcard (*) to indicate all services, regions, domain IDs, resource types, or resource paths. In the JSON view, if <strong id="obs_40_0003__b33829267284949">Resource</strong> is not specified, the policy applies to all resources.</p>
<p id="obs_40_0003__p171041029163018">The value of <strong id="obs_40_0003__b69749580084949">Resource</strong> can only contain uppercase (A to Z), lowercase (a to z) letters, digits (0 to 9), and the following characters: <strong id="obs_40_0003__b772156113211">-_*./\</strong>. If you want to specify unsupported characters, use the wildcard character (*).</p>
<p id="obs_40_0003__p8573162614402">OBS is a global service. Therefore, set <em id="obs_40_0003__i6381411152112">Region</em> to <strong id="obs_40_0003__b69433475811">*</strong>. <em id="obs_40_0003__i011318205217">Domain ID</em> indicates the ID of the resource owner. Set it to <strong id="obs_40_0003__b106796591589">*</strong> to indicate the ID of the account that the resources belong to.</p>
<p id="obs_40_0003__p117043393813">Examples:</p>
<ul id="obs_40_0003__ul1640191817385"><li id="obs_40_0003__li22311821183817"><strong id="obs_40_0003__b66660796384949">obs:*:*:bucket:*</strong>: all OBS buckets</li><li id="obs_40_0003__li18771111553812"><strong id="obs_40_0003__b4229528122512">obs:*:*:object:my-bucket/my-object/*</strong>: all objects in the <span class="filepath" id="obs_40_0003__filepath123019282258"><b>my-object</b></span> directory of bucket <strong id="obs_40_0003__b1823011288259">my-bucket</strong></li></ul>
</li><li id="obs_40_0003__li1543682323113"><strong id="obs_40_0003__b9519356111915">Condition</strong><p id="obs_40_0003__p661315382320">When creating a custom policy, you can add conditions to control when the policy takes effect. A condition consists of a condition key and an operator. Condition keys are either global or service-level. Global condition keys (starting with <strong id="obs_40_0003__b13570192819160">g:</strong>) are available for actions on all services, while service-level condition keys (starting with a service name acronym like <strong id="obs_40_0003__b257622817165">obs:</strong>) are available only for actions on a specific service. An operator is used together with a condition key to form a complete condition statement.</p>
<p id="obs_40_0003__p127971145181115">OBS has predefined a group of condition keys for use in IAM. For example, you can use the condition key <strong id="obs_40_0003__b36524646184949">obs:SourceIp</strong> to allow access from a specific IP address.</p>
<p id="obs_40_0003__p0759173317410">The condition keys and operators supported by OBS are the same as those in the bucket policy. When configuring condition keys in IAM, start the condition keys and operators with <strong id="obs_40_0003__b190245174384949">obs:</strong>. For detailed conditions, see <a href="obs_40_0041.html">Bucket Policy Parameters</a>.</p>
<p id="obs_40_0003__p47313304358">The value of <strong id="obs_40_0003__b91382117984949">Condition</strong> can only contain uppercase letters (A to Z), lowercase letters (a to z), digits (0 to 9), and the following characters: <strong id="obs_40_0003__b19672154383717">-,./_@#$%&amp;</strong>. If you want to specify unsupported characters, use the condition operators (like StringMatch) for fuzzy match.</p>
<p id="obs_40_0003__p2065131212304">Examples:</p>
<ul id="obs_40_0003__ul1651171243020"><li id="obs_40_0003__li196519122305"><strong id="obs_40_0003__b151819712569">StringEndWithIfExists":{"g:UserName":["specialCharacter"]}</strong>: The statement is valid for users whose names end with <strong id="obs_40_0003__b2519127155610">specialCharacter</strong>.</li><li id="obs_40_0003__li8928125071114"><strong id="obs_40_0003__b116743742484949">"StringLike":{"obs:prefix":["private/"]}</strong>: When listing objects in a bucket, you need to set prefix to <strong id="obs_40_0003__b72382026184949">private/</strong> or include <strong id="obs_40_0003__b25112974184949">private/</strong>.</li></ul>
</li></ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="obs_40_0003__section2423153122212"><h4 class="sectiontitle">Configuring IAM Permissions</h4><ul id="obs_40_0003__ul534752615475"><li id="obs_40_0003__li7215183192717"><a href="https://docs.otc.t-systems.com/en-us/usermanual/obs/obs_03_0122.html" target="_blank" rel="noopener noreferrer">Creating a User and Granting OBS Permissions</a></li><li id="obs_40_0003__li12684748112818"><a href="https://docs.otc.t-systems.com/en-us/usermanual/iam/iam_01_0016.html" target="_blank" rel="noopener noreferrer">Creating a Custom Policy</a></li></ul>
</div>
<div class="section" id="obs_40_0003__section13402164013368"><h4 class="sectiontitle">Example Custom Policies</h4><ul id="obs_40_0003__ul10182135619226"><li id="obs_40_0003__li157689265447"><strong id="obs_40_0003__b208951715115712">Example 1: Grant permissions that allow full access to OBS.</strong><p id="obs_40_0003__p46653263312">This policy allows users to perform any operation on OBS using the API, SDKs, OBS Console, or tools.</p>
<div class="p" id="obs_40_0003__p339253017318">If a user logs in to OBS Console and also accesses resources of other services, such as audit information in CTS, acceleration domain names in CDN, and keys in KMS, in addition to the OBS permissions, you need to grant users the permissions to access these services. CDN is a global service. CTS, SMN, and KMS are regional services. You need to configure the <strong id="obs_40_0003__b639233210195">Tenant Guest</strong> permission for the global project and regional projects based on the services and regions that you use.<pre class="screen" id="obs_40_0003__screen55823101111">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:*:*"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li1499001214237"><strong id="obs_40_0003__b17460142710573">Example 2: Grant permissions that allow read-only access to a bucket (any directory).</strong><div class="p" id="obs_40_0003__p0659712132814">This policy allows users to list and download all objects from bucket <strong id="obs_40_0003__b184697701884949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen1715419122288">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:bucket:ListBucket"
],
"Resource": [
"obs:*:*:object:obs-example/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li1178134122714"><strong id="obs_40_0003__b111181932135715">Example 3: Grant permissions that allow read-only access to a bucket (a specified directory).</strong><div class="p" id="obs_40_0003__p1316275917297">This policy allows users to download objects only from the <strong id="obs_40_0003__b6650276684949">my-project/</strong> directory of bucket <strong id="obs_40_0003__b158239804384949">obs-example</strong>. Objects in other directories can be listed but cannot be downloaded.<pre class="screen" id="obs_40_0003__screen1570175817291">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:bucket:ListBucket"
],
"Resource": [
"obs:*:*:object:obs-example/my-project/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li7252849112918"><strong id="obs_40_0003__b64743715717">Example 4: Grant permissions that allow read and write access to a bucket (a specified directory).</strong><div class="p" id="obs_40_0003__p15698820153316">This policy allows users to list, download, upload, and delete objects in the <strong id="obs_40_0003__b111284578884949">my-project</strong> directory of bucket <strong id="obs_40_0003__b193695910384949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen16250020173311">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:object:ListMultipartUploadParts",
"obs:bucket:ListBucket",
"obs:object:DeleteObject",
"obs:object:PutObject"
],
"Resource": [
"obs:*:*:object:obs-example/my-project/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li13633157133316"><strong id="obs_40_0003__b125809423570">Example 5: Grant permissions that allow full access to a bucket.</strong><div class="p" id="obs_40_0003__p101733273710">This policy allows users to perform any operation on bucket <strong id="obs_40_0003__b177251530384949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen1740510316374">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:*:*"
],
"Resource": [
"obs:*:*:bucket:obs-example",
"obs:*:*:object:obs-example/*"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li838854165119"><strong id="obs_40_0003__b19313332185120">Example 6: Deny object upload.</strong><p id="obs_40_0003__p106331061322">A policy with only <strong id="obs_40_0003__b9257181419529">Deny</strong> statements must be used together other policies. If the policy assigned to a user contains both <strong id="obs_40_0003__b171318545304">Allow</strong> and <strong id="obs_40_0003__b1071425410300">Deny</strong> statements, the <strong id="obs_40_0003__b87141654203020">Deny</strong> statement take precedence over the <strong id="obs_40_0003__b127141554153019">Allow</strong> statement.</p>
<p id="obs_40_0003__p66331861212">If you need to assign <strong id="obs_40_0003__b23646550484949">OBS OperateAccess</strong> permissions to a user but prevent the user from uploading objects, you can create a custom policy to deny object upload, and assign this custom policy and <strong id="obs_40_0003__b75819166573">OBS OperateAccess</strong> to the user. Then the user can perform all operations allowed by <strong id="obs_40_0003__b52187483984949">OBS OperateAccess</strong> except for uploading objects. The following is an example of a deny policy:</p>
<pre class="screen" id="obs_40_0003__screen963476425">{
"Version": "1.1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"obs:object:PutObject"
]
}
]
}</pre>
</li><li id="obs_40_0003__li208291459112"><strong id="obs_40_0003__b520410311504">Example 7: Grant the permissions to change a bucket's storage class and delete certain objects from the bucket.</strong><p id="obs_40_0003__p5531191010211">This policy allows users to change the storage class of bucket <strong id="obs_40_0003__b965327936">obs-example</strong> and to delete object <strong id="obs_40_0003__b10590531940">my-object.txt</strong> from the bucket.</p>
<pre class="screen" id="obs_40_0003__screen197811723101">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:bucket:ListAllMyBuckets",
"obs:bucket:ListBucket"
]
},
{
"Effect": "Allow",
"Action": [
"obs:object:DeleteObject",
"obs:bucket:PutBucketStoragePolicy"
],
"Resource": [
"OBS:*:*:object:obs-example/my-object.txt",
"OBS:*:*:bucket:obs-example"
]
}
]
}</pre>
</li></ul>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="obs_40_0002.html">Permission Control Methods</a></div>
</div>
</div>
View Git Blame Copy Permalink