vpruthi/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity
doc-exports/docs/obs/perms-cfg/obs_40_0003.html
zhangyue 32b9354795 OBS PERMS DOC 
Reviewed-by: Sabelnikov, Dmitriy <dmitriy.sabelnikov@t-systems.com>
Reviewed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com>
Co-authored-by: zhangyue <zhangyue164@huawei.com>
Co-committed-by: zhangyue <zhangyue164@huawei.com>
2023-04-18 07:48:10 +00:00

889 lines
71 KiB
HTML
Raw Blame History

<a name="obs_40_0003"></a><a name="obs_40_0003"></a>
<h1 class="topictitle1">IAM Permissions</h1>
<div id="body1588766432188"><div class="section" id="obs_40_0003__section8489111318501"><h4 class="sectiontitle">IAM Permissions Overview</h4><p id="obs_40_0003__p6942143264820">By default, newly created IAM users do not have any permissions. You need to add the user to one or more groups, and attach permission policies or roles to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.</p>
<p id="obs_40_0003__p1456812431508">IAM permissions take effect on all OBS buckets and objects. To grant an IAM user the permission to operate OBS resources, you need to assign one or more OBS permission sets to the user group to which the user belongs.</p>
<p id="obs_40_0003__p9631520165012">OBS is a global service because it is available for all physical regions. IAM permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.</p>
<p id="obs_40_0003__p28301569268">You can grant permissions to users by roles and policies.</p>
<ul id="obs_40_0003__ul6830126162610"><li id="obs_40_0003__li1682355416298">Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. This mechanism provides only a limited number of service-level roles for authorization. When using roles to grant permissions, you need to also assign other roles on which the permissions depend to take effect. However, roles are not an ideal choice for fine-grained authorization and secure access control.</li><li id="obs_40_0003__li14830365263">Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions. This mechanism allows for more flexible policy-based authorization, meeting requirements for secure access control. For example, you can grant OBS users only the permissions for managing a certain type of OBS resources. </li></ul>
<div class="note" id="obs_40_0003__note1018554855215"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="obs_40_0003__p13185164825218">Due to data caching, a role and policy involving OBS actions will take effect 10 to 15 minutes after it is attached to a user, an enterprise project, and user group.</p>
</div></div>
<p id="obs_40_0003__p4554141720431">IAM presets system permissions for each cloud service so that you can quickly configure basic permissions. <a href="#obs_40_0003__table143320246431">Table 1</a> describes all system permissions of OBS.</p>
<p id="obs_40_0003__p19243941181716">Custom policies can be created to supplement the system-defined policies of OBS.</p>
<div class="tablenoborder"><a name="obs_40_0003__table143320246431"></a><a name="table143320246431"></a><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table143320246431" frame="border" border="1" rules="all"><caption><b>Table 1 </b>OBS system permissions</caption><thead align="left"><tr id="obs_40_0003__row13332624144312"><th align="left" class="cellrowborder" valign="top" width="21.18788121187881%" id="mcps1.3.1.10.2.5.1.1"><p id="obs_40_0003__p7332132484320">Role/Policy Name</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="50.38496150384961%" id="mcps1.3.1.10.2.5.1.2"><p id="obs_40_0003__p5332824174310">Description</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="15.778422157784222%" id="mcps1.3.1.10.2.5.1.3"><p id="obs_40_0003__p033272494312">Type</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="12.64873512648735%" id="mcps1.3.1.10.2.5.1.4"><p id="obs_40_0003__p1612261564417">Dependency</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row92218311275"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p82223315277">Tenant Administrator</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p4466456182919"><span style="color:#3D3F43;">Users with this permission can perform all operations on all services except IAM.</span></p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p13307349152715">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p1730724915271">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row6159933152717"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p26447396278">Tenant Guest</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p201591334273"><span style="color:#3D3F43;">Users with this permission can perform read-only operations on all services except IAM.</span></p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p1684219494278">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p0842749152715">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row03951422204919"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p71016102325">OBS Administrator</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p1910111102324">Users with this permission are OBS administrators and can perform any operations on all OBS resources under the account.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p157071737143313">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p3396922114915">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row333212434317"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p143321924104311">OBS Buckets Viewer</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p1733310247431">Users with this permission can list buckets, obtain basic bucket information, and obtain bucket metadata.</p>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p20333192411434">System-defined role</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p5122161564420">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row7333132416439"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p23331324114313">OBS ReadOnlyAccess</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p193331246430">Users with this permission can list buckets, obtain basic bucket information, obtain bucket metadata, and list objects (not the objects that have been versioned).</p>
<div class="note" id="obs_40_0003__note864512387375"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="obs_40_0003__p136452384379">If a user with this permission fails to list objects on OBS Console, there may be multiple versions of objects in the bucket. In this case, you need to grant the user the <strong id="obs_40_0003__b48819478457">obs:bucket:ListBucketVersions</strong> permission so that the user can view different versions of objects on OBS Console.</p>
</div></div>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p123331524164312">System-defined policy</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p9122215164414">N/A</p>
</td>
</tr>
<tr id="obs_40_0003__row3333202464311"><td class="cellrowborder" valign="top" width="21.18788121187881%" headers="mcps1.3.1.10.2.5.1.1 "><p id="obs_40_0003__p1333112420434">OBS OperateAccess</p>
</td>
<td class="cellrowborder" valign="top" width="50.38496150384961%" headers="mcps1.3.1.10.2.5.1.2 "><p id="obs_40_0003__p145991616552">Users with this permission can perform all OBS ReadOnlyAccess operations and perform basic object operations, such as uploading objects, downloading objects, deleting objects, and obtaining object ACLs.</p>
<div class="note" id="obs_40_0003__note84579519419"><span class="notetitle"> NOTE: </span><div class="notebody"><p id="obs_40_0003__p9457205144115">If a user with this permission fails to list objects on OBS Console, there may be multiple versions of objects in the bucket. In this case, you need to grant the user the <strong id="obs_40_0003__b1569722243510">obs:bucket:ListBucketVersions</strong> permission so that the user can view different versions of objects on OBS Console.</p>
</div></div>
</td>
<td class="cellrowborder" valign="top" width="15.778422157784222%" headers="mcps1.3.1.10.2.5.1.3 "><p id="obs_40_0003__p933316249432">System-defined policy</p>
</td>
<td class="cellrowborder" valign="top" width="12.64873512648735%" headers="mcps1.3.1.10.2.5.1.4 "><p id="obs_40_0003__p51221615164410">N/A</p>
</td>
</tr>
</tbody>
</table>
</div>
<p id="obs_40_0003__p9504334163519">The following table lists the common operations supported by each system-defined policy or role of OBS. Select the policies or roles as required.</p>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table487418345322" frame="border" border="1" rules="all"><caption><b>Table 2 </b>Permissions and the allowed operations on OBS resources</caption><thead align="left"><tr id="obs_40_0003__row18752034153214"><th align="left" class="cellrowborder" valign="top" width="15.45154515451545%" id="mcps1.3.1.12.2.8.1.1"><p id="obs_40_0003__p19875183413211">Operation</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="12.96129612961296%" id="mcps1.3.1.12.2.8.1.2"><p id="obs_40_0003__p1787543415321">Tenant Administrator</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="14.371437143714372%" id="mcps1.3.1.12.2.8.1.3"><p id="obs_40_0003__p17875183453217">Tenant Guest</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.57135713571357%" id="mcps1.3.1.12.2.8.1.4"><p id="obs_40_0003__p202931642123616">OBS Administrator</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.521352135213519%" id="mcps1.3.1.12.2.8.1.5"><p id="obs_40_0003__p1875143419322">OBS Buckets Viewer</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="16.16161616161616%" id="mcps1.3.1.12.2.8.1.6"><p id="obs_40_0003__p13549121722913">OBS ReadOnlyAccess</p>
</th>
<th align="left" class="cellrowborder" valign="top" width="13.96139613961396%" id="mcps1.3.1.12.2.8.1.7"><p id="obs_40_0003__p083112213323">OBS OperateAccess</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row38751334123213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p4875334173218">Listing buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p158751234193220">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17875934133211">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p061715283373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p3875123473211">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p16261055154514">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p9735558184514">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row1687563493217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287513414329">Creating buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p3875203413327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1587593413213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p9617828113717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1487512349322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1126555174515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p773518587457">No</p>
</td>
</tr>
<tr id="obs_40_0003__row11875183410322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p13875134133219">Deleting buckets</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1687515347324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17875434193217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p17617152818371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p387503415322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p0261155134515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p973565816451">No</p>
</td>
</tr>
<tr id="obs_40_0003__row987573417327"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p148751134173213">Obtaining basic bucket information</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p138751334113219">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1087523483213">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p761782813717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p987573463218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p22613559455">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p7735145813458">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row4876113433212"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p4876183473211">Controlling bucket access</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p9876193415323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p17876133418322">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p17617182820378">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p987673410324">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p52618555455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p11735135815455">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1387615347325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p15876133413320">Managing bucket policies</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p6876113418328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p88761434143216">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561716286378">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p9876113443216">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p112635504510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p10735195814513">No</p>
</td>
</tr>
<tr id="obs_40_0003__row16876634103218"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p0876153433214">Modifying bucket storage classes</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p387643423218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p6876103423217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p2617428183716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p16876634123220">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p8266551456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1173565854520">No</p>
</td>
</tr>
<tr id="obs_40_0003__row158761634103210"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p188762034103218">Listing objects</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p587663411323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p287673417327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p46171428163719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17876634183219">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p626855134514">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1873515588450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row28761934203219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p18876123453215">Listing versioned objects</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p38777342320">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p158771134153210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p961752819376">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1787710348327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p7275553453">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p107351958134510">No</p>
</td>
</tr>
<tr id="obs_40_0003__row08771934103210"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287723417322">Uploading a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p187753413215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p78771134103215">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p861722843718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1687713413215">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p10271555154517">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673555814511">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row13877153414323"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1877103443215">Creating a folder</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p11877173419320">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p087733433213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p16181728113710">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p13877634133219">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1275556452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p573555844520">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row6877234123218"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p987713349327">Deleting a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p158772342328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1687853413212">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p196181428183716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12878334153217">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p17271955194518">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1373635820450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row2087803443216"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287811343321">Deleting a folder</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p148782034193217">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p187813423210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p4618628203719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p387833412329">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p527855124510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p67361558174516">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row887883443219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p178781234133217">Downloading a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1487873419324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p138781034103212">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1661882815373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p14878534183210">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1527105513456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p373695864516">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row148786344325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p38781534163214">Deleting files with multiple versions</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p168781734153213">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p287893433210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p4618328123711">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1587833473213">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p4271557451">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p2073645813450">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row2087817349322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287993411325">Downloading files with multiple versions</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p188795346321">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p7879103419329">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p46189285373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p48791134133216">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p72735544520">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673675854512">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row987919344325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p287953463220">Modifying object storage classes</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p18879193483210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p10879134153219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p2618192853712">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1087913419325">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p52775554519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1673635813455">No</p>
</td>
</tr>
<tr id="obs_40_0003__row108790349328"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p7879203433218">Restoring files</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p9879173411327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p2087913346324">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p176181128163718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p11879173416321">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p327105554519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p197361358144518">No</p>
</td>
</tr>
<tr id="obs_40_0003__row2879153418326"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288033410329">Undeleting a file</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1488018348328">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p19880634143210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p9618228113716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1888093443212">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172715594514">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p0736358134518">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row688093443220"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288014346328">Deleting fragments</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p118801634153215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p12880734183213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p96181328103719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p48801334173211">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p027855114515">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p073695844510">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row11880123463217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1288043414323">Controlling object access</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p288003415323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p0880173453213">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p196180281371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17880113415327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172765514452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p10736558184514">No</p>
</td>
</tr>
<tr id="obs_40_0003__row588113349321"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p2088123463216">Configuring object metadata</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p888133416323">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p4881113417323">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1861852863716">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p6881183420322">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p132714554456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p4736558194518">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1061717483135"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p1078225161310">Obtaining object metadata</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1617174815139">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1261116718143">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p6618132811375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1611977144">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p7611157161420">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p106181748161316">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row1388123473217"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p16881234133216">Managing versioning</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p7881143473210">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1588193483217">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p106181028103713">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p5881133413214">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p172716550455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p7736105844519">No</p>
</td>
</tr>
<tr id="obs_40_0003__row18810349322"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p118811434163214">Managing logging</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p388173433219">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p98812348327">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p0618142816375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1888283463214">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p5274556452">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p14736858104517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row288263473212"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p158825342326">Managing event notifications</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p78824343324">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1288273415323">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1361862803712">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1588219345328">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1027655194510">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p873616582451">No</p>
</td>
</tr>
<tr id="obs_40_0003__row19882153413329"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p88821934163215">Managing tags</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p2882134113215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p16882143443218">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1761832820375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p188213343323">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p15271155174520">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1173645864510">No</p>
</td>
</tr>
<tr id="obs_40_0003__row288263463213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p3882193423217">Managing lifecycle rules</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1088223415325">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p11882163414328">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1861832819377">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1188283453213">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p16272551455">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p18736358184515">No</p>
</td>
</tr>
<tr id="obs_40_0003__row68823341324"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p198821634123215">Managing static website hosting</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p78821434163215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p16882143423219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1061832812375">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p10882123413323">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p11279553457">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1273613580459">No</p>
</td>
</tr>
<tr id="obs_40_0003__row1088313342325"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p2088320347328">Managing CORS rules</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p14883134103218">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p1188310342324">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1261813289371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p16883834163217">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p18277558451">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p11736858154517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row128831834163213"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p14883143420323">Managing URL validation</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p108838346326">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p98831834153211">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p5618928153719">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p168837347327">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p927195517456">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1073613588458">No</p>
</td>
</tr>
<tr id="obs_40_0003__row2883153453215"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p5883113413216">Managing domain names</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p11883113410327">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p988393443219">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561952817373">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p19883143423210">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p11272055164516">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p2736458164517">No</p>
</td>
</tr>
<tr id="obs_40_0003__row14833159185118"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p168336590517">Configuring an object ACL</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p1783405916516">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p346217589522">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p561919289374">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p94628586521">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p43499418535">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p93491644538">No</p>
</td>
</tr>
<tr id="obs_40_0003__row61481058105113"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p121484582512">Configuring the ACL for an object of a specified version</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p314895845112">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p19462135805210">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p3619152815379">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p17462105818522">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p2266585316">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p92618575312">No</p>
</td>
</tr>
<tr id="obs_40_0003__row46051438185219"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p144112452527">Obtaining an object ACL </p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p760623825215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p8462958195214">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1361919282379">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p164629580527">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p12239139125315">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1324020935316">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row15514134118523"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p341154595212">Obtaining the ACL of a specified object version</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p951417411526">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p194621658125215">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p10619628153711">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12462558175212">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p10240109205312">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p1324010912535">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row34981656105416"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p849865615548">Performing a multipart upload</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p74519365510">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p445163185519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p1061982843717">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p12451365516">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p194683145518">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p19463316556">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row46882362507"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p5688836145016">Listing uploaded parts</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p399713018513">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p168936318512">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p8619328123718">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p789315313510">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p4336201016519">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p15830773515">Yes</p>
</td>
</tr>
<tr id="obs_40_0003__row17345184735011"><td class="cellrowborder" valign="top" width="15.45154515451545%" headers="mcps1.3.1.12.2.8.1.1 "><p id="obs_40_0003__p9345114714501">Canceling a multipart upload</p>
</td>
<td class="cellrowborder" valign="top" width="12.96129612961296%" headers="mcps1.3.1.12.2.8.1.2 "><p id="obs_40_0003__p352114115111">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="14.371437143714372%" headers="mcps1.3.1.12.2.8.1.3 "><p id="obs_40_0003__p55481942513">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.57135713571357%" headers="mcps1.3.1.12.2.8.1.4 "><p id="obs_40_0003__p5619182816371">Yes</p>
</td>
<td class="cellrowborder" valign="top" width="13.521352135213519%" headers="mcps1.3.1.12.2.8.1.5 "><p id="obs_40_0003__p1954844135115">No</p>
</td>
<td class="cellrowborder" valign="top" width="16.16161616161616%" headers="mcps1.3.1.12.2.8.1.6 "><p id="obs_40_0003__p1983401014513">No</p>
</td>
<td class="cellrowborder" valign="top" width="13.96139613961396%" headers="mcps1.3.1.12.2.8.1.7 "><p id="obs_40_0003__p9395148115110">Yes</p>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="obs_40_0003__section01904185241"><h4 class="sectiontitle">Application Scenarios of IAM Permissions</h4><p id="obs_40_0003__p101714434165">IAM permissions are used to authorize IAM users under an account.</p>
<ul id="obs_40_0003__ul319124042416"><li id="obs_40_0003__li244101111715">Controlling access to cloud resources as a whole under an account</li><li id="obs_40_0003__li81911640122419">Controlling access to all OBS buckets and objects under an account</li><li id="obs_40_0003__li15991209568">Controlling access to specified OBS resources under an account</li></ul>
</div>
<div class="section" id="obs_40_0003__section9268135516548"><h4 class="sectiontitle">Policy Structure and Syntax</h4><p id="obs_40_0003__p232429165515">A policy consists of a version and statements. Each policy can have multiple statements.</p>
<div class="fignone" id="obs_40_0003__fig96590586581"><span class="figcap"><b>Figure 1 </b>Policy structure</span><br><span><img id="obs_40_0003__image116601758135815" src="en-us_image_0257849924.png"></span></div>
<p id="obs_40_0003__p88641011565">Policy syntax example:</p>
<pre class="screen" id="obs_40_0003__screen4200121482012">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:bucket:HeadBucket",
"obs:bucket:ListBucket",
"obs:bucket:GetBucketLocation"
],
"Resource": [
"obs:*:*:bucket:*"
],
"Condition": {
"StringEndWithIfExsits": {
"g:UserName": ["specialCharacter"]
},
"Bool": {
"g:MFAPresent": ["true"]
}
}
}
]
}</pre>
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="obs_40_0003__table987212714414" frame="border" border="1" rules="all"><caption><b>Table 3 </b>Policy syntax parameters</caption><thead align="left"><tr id="obs_40_0003__row19873102713411"><th align="left" class="cellrowborder" valign="top" width="22.09%" id="mcps1.3.3.6.2.3.1.1"><p id="obs_40_0003__p178737272043"><strong id="obs_40_0003__b82986207184949">Parameter</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="77.91%" id="mcps1.3.3.6.2.3.1.2"><p id="obs_40_0003__p1887302718414">Description</p>
</th>
</tr>
</thead>
<tbody><tr id="obs_40_0003__row17873027842"><td class="cellrowborder" valign="top" width="22.09%" headers="mcps1.3.3.6.2.3.1.1 "><p id="obs_40_0003__p48732027743">Version</p>
</td>
<td class="cellrowborder" valign="top" width="77.91%" headers="mcps1.3.3.6.2.3.1.2 "><div class="p" id="obs_40_0003__p829912213615">The version number of a policy.<ul id="obs_40_0003__ul1484412128619"><li id="obs_40_0003__li577602617611"><strong id="obs_40_0003__b133624981884949">1.0</strong>: RBAC policies. An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all of the permissions required for that service.</li><li id="obs_40_0003__li1840484141"><strong id="obs_40_0003__b145719358384949">1.1</strong>: Fine-grained policies. A fine-grained policy consists of API-based permissions for operations on specific resource types. Fine-grained policies, as the name suggests, allow for more fine-grained control on specific operations and resources than RBAC policies. For example: You can restrict an IAM user to access only the objects in a specific directory of an OBS bucket.</li></ul>
</div>
</td>
</tr>
<tr id="obs_40_0003__row187317273414"><td class="cellrowborder" valign="top" width="22.09%" headers="mcps1.3.3.6.2.3.1.1 "><p id="obs_40_0003__p108731927249">Statement</p>
</td>
<td class="cellrowborder" valign="top" width="77.91%" headers="mcps1.3.3.6.2.3.1.2 "><div class="p" id="obs_40_0003__p17113185672413">Detailed descriptions of a policy, including <strong id="obs_40_0003__b134931682460">Effect</strong>, <strong id="obs_40_0003__b115371712124616">Action</strong>, <strong id="obs_40_0003__b1141191914460">Resource</strong>, and <strong id="obs_40_0003__b26891622184613">Condition</strong>. <strong id="obs_40_0003__b1330205445413">Resource</strong> and <strong id="obs_40_0003__b208415414184949">Condition</strong> are optional.<ul id="obs_40_0003__ul1802181615716"><li id="obs_40_0003__li480221610716"><strong id="obs_40_0003__b244516503192">Effect</strong><p id="obs_40_0003__p1880291618711">The valid values for <strong id="obs_40_0003__b139199271284949">Effect</strong> are <strong id="obs_40_0003__b111932433884949">Allow</strong> and <strong id="obs_40_0003__b133550218884949">Deny</strong>. System policies contain only <strong id="obs_40_0003__b116709871584949">Allow</strong> statements. For custom policies containing both <strong id="obs_40_0003__b69691813284949">Allow</strong> and <strong id="obs_40_0003__b92522532484949">Deny</strong> statements, the <strong id="obs_40_0003__b199531072884949">Deny</strong> statements take precedence.</p>
</li><li id="obs_40_0003__li980219163715"><strong id="obs_40_0003__b15985205113194">Action</strong><p id="obs_40_0003__p14803201610710">Actions allowed on resources. An action is in the format of <em id="obs_40_0003__i120632589084949">Service name</em>:<em id="obs_40_0003__i120545427484949">Resource type</em>:<em id="obs_40_0003__i92529442184949">Action</em>. A policy can contain one or more actions. You can use a wildcard (*) to indicate all of the services, resource types, or actions depending on their location in the action. There are two types of OBS resources: buckets and objects.</p>
</li><li id="obs_40_0003__li0244165152812"><strong id="obs_40_0003__b18514665284949">Resource</strong><p id="obs_40_0003__p1323103805814">Resources on which the policy takes effect. A resource is in the format of <em id="obs_40_0003__i31557539484949">Service name</em>:<em id="obs_40_0003__i86549574084949">Region</em>:<em id="obs_40_0003__i131716051184949">Domain ID</em>:<em id="obs_40_0003__i161483073384949">Resource type</em>:<em id="obs_40_0003__i13452511584949">Resource path</em>. You can use a wildcard (*) to indicate all of the services, regions, domain IDs, resource types, or resource paths depending on their location in the resource. In the JSON view, if <strong id="obs_40_0003__b33829267284949">Resource</strong> is not specified, the policy takes effect for all resources.</p>
<p id="obs_40_0003__p171041029163018">The value of <strong id="obs_40_0003__b69749580084949">Resource</strong> supports uppercase (A to Z), lowercase (a to z) letters, digits (0 to 9), and the following characters: <strong id="obs_40_0003__b772156113211">-_*./\</strong>. If the value contains invalid characters, use the wildcard character (*).</p>
<p id="obs_40_0003__p8573162614402">OBS is a global service. Therefore, set <strong id="obs_40_0003__b147214396817">Region</strong> to <strong id="obs_40_0003__b69433475811">*</strong>. <strong id="obs_40_0003__b156221650585">Domain ID</strong> indicates the ID of the resource owner. Set it to <strong id="obs_40_0003__b106796591589">*</strong> to indicate the ID of the account to which the resources belong.</p>
<p id="obs_40_0003__p117043393813">Examples:</p>
<ul id="obs_40_0003__ul1640191817385"><li id="obs_40_0003__li22311821183817"><strong id="obs_40_0003__b66660796384949">obs:*:*:bucket:*</strong>: all OBS buckets</li><li id="obs_40_0003__li18771111553812"><strong id="obs_40_0003__b209160870784949">obs:*:*:object:my-bucket/my-object/*</strong>: all objects in the <strong id="obs_40_0003__b52520622584949">my-object</strong> directory of the <strong id="obs_40_0003__b98542963184949">my-bucket</strong> bucket</li></ul>
</li><li id="obs_40_0003__li1543682323113"><strong id="obs_40_0003__b9519356111915">Condition</strong><p id="obs_40_0003__p661315382320">When creating a custom policy, you can add condition elements to control when the policy takes effect. A condition consists of a condition key and an operator. Condition keys are either global or service-level and are used in the condition elements of a policy statement. Global condition keys (starting with <strong id="obs_40_0003__b13570192819160">g:</strong>) are available for actions of all services, while service-level condition keys (starting with a service name acronym like <strong id="obs_40_0003__b257622817165">obs:</strong>) are available only for actions of a specific service. An operator is used together with a condition key to form a complete condition statement.</p>
<p id="obs_40_0003__p127971145181115">OBS has a group of predefined condition keys that can be used in IAM. For example, to define an allow permission, you can use the condition key <strong id="obs_40_0003__b36524646184949">obs:SourceIp</strong> to filter matching requesters by IP address.</p>
<p id="obs_40_0003__p0759173317410">The condition keys and operators supported by OBS are the same as those in the bucket policy. When configuring condition keys in IAM, start the condition keys and operators with <strong id="obs_40_0003__b190245174384949">obs:</strong>. For detailed condition information, see <a href="obs_40_0041.html">Bucket Policy Parameters</a>.</p>
<p id="obs_40_0003__p47313304358">The value of <strong id="obs_40_0003__b91382117984949">Condition</strong> can contain only uppercase letters (A to Z), lowercase letters (a to z), digits (0 to 9), and the following characters: <strong id="obs_40_0003__b19672154383717">-,./_@#$%&amp;</strong>. If the value contains unsupported characters, consider using the condition operators (such as StringLike and StringStartWith) for fuzzy match.</p>
<p id="obs_40_0003__p2065131212304">Examples:</p>
<ul id="obs_40_0003__ul1651171243020"><li id="obs_40_0003__li196519122305"><strong id="obs_40_0003__b151819712569">StringEndWithIfExists":{"g:UserName":["specialCharacter"]}</strong>: The statement is valid for users whose names end with <strong id="obs_40_0003__b2519127155610">specialCharacter</strong>.</li><li id="obs_40_0003__li8928125071114"><strong id="obs_40_0003__b116743742484949">"StringLike":{"obs:prefix":["private/"]}</strong>: When listing objects in a bucket, you need to set prefix to <strong id="obs_40_0003__b72382026184949">private/</strong> or include <strong id="obs_40_0003__b25112974184949">private/</strong>.</li></ul>
</li></ul>
</div>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="section" id="obs_40_0003__section2423153122212"><h4 class="sectiontitle">Configuring IAM Permissions</h4><ul id="obs_40_0003__ul534752615475"><li id="obs_40_0003__li7215183192717"><a href="https://docs.otc.t-systems.com/en-us/usermanual/obs/obs_03_0122.html" target="_blank" rel="noopener noreferrer">Creating a User and Granting OBS Permissions</a></li><li id="obs_40_0003__li12684748112818"><a href="https://docs.otc.t-systems.com/en-us/usermanual/iam/en-us_topic_0274187246.html" target="_blank" rel="noopener noreferrer">Creating a Custom Policy</a></li></ul>
</div>
<div class="section" id="obs_40_0003__section13402164013368"><h4 class="sectiontitle">Example Custom Policies</h4><ul id="obs_40_0003__ul10182135619226"><li id="obs_40_0003__li157689265447"><strong id="obs_40_0003__b208951715115712">Example 1: Grant all OBS permissions to users.</strong><p id="obs_40_0003__p46653263312">This policy allows users to perform any operation on OBS using the API, SDKs, OBS Console, or tools.</p>
<div class="p" id="obs_40_0003__p339253017318">When a user logs in to OBS Console, the user accesses resources of other services, such as audit information in CTS, acceleration domain names in CDN, and keys in KMS. Therefore, in addition to the OBS permissions, you need to grant users the permissions for other services. CDN is a global service, while CTS, SMN, and KMS are regional ones. You need to configure the <strong id="obs_40_0003__b639233210195">Tenant Guest</strong> permission for the global project and regional projects based on the services and regions that you use.<pre class="screen" id="obs_40_0003__screen55823101111">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:*:*"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li1499001214237"><strong id="obs_40_0003__b17460142710573">Example 2: Grant the read-only permission on a bucket to users (any directory).</strong><div class="p" id="obs_40_0003__p0659712132814">This policy allows users to list and download all objects in bucket <strong id="obs_40_0003__b184697701884949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen1715419122288">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:bucket:ListBucket"
],
"Resource": [
"obs:*:*:object:obs-example/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li1178134122714"><strong id="obs_40_0003__b111181932135715">Example 3: Grant the read-only permission on a bucket to users (specified directory).</strong><div class="p" id="obs_40_0003__p1316275917297">This policy allows users to only download objects in the <strong id="obs_40_0003__b6650276684949">my-project/</strong> directory of bucket <strong id="obs_40_0003__b158239804384949">obs-example</strong>. Objects in other directories can be listed but cannot be downloaded.<pre class="screen" id="obs_40_0003__screen1570175817291">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:bucket:ListBucket"
],
"Resource": [
"obs:*:*:object:obs-example/my-project/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li7252849112918"><strong id="obs_40_0003__b64743715717">Example 4: Grant the read and write permissions on a bucket to users (specified directory).</strong><div class="p" id="obs_40_0003__p15698820153316">This policy allows users to list, download, upload, and delete objects in the <strong id="obs_40_0003__b111284578884949">my-project</strong> directory of bucket <strong id="obs_40_0003__b193695910384949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen16250020173311">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:object:GetObject",
"obs:object:ListMultipartUploadParts",
"obs:bucket:ListBucket",
"obs:object:DeleteObject",
"obs:object:PutObject"
],
"Resource": [
"obs:*:*:object:obs-example/my-project/*",
"obs:*:*:bucket:obs-example"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li13633157133316"><strong id="obs_40_0003__b125809423570">Example 5: Grant all permissions on a bucket to users.</strong><div class="p" id="obs_40_0003__p101733273710">This policy allows users to perform any operation on bucket <strong id="obs_40_0003__b177251530384949">obs-example</strong>.<pre class="screen" id="obs_40_0003__screen1740510316374">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:*:*"
],
"Resource": [
"obs:*:*:bucket:obs-example",
"obs:*:*:object:obs-example/*"
]
}
]
}</pre>
</div>
</li><li id="obs_40_0003__li838854165119"><strong id="obs_40_0003__b778424912574">Example 6: Deny a user the permission to upload objects.</strong><p id="obs_40_0003__p106331061322">A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.</p>
<p id="obs_40_0003__p66331861212">The following method can be used if you need to assign permissions of the <strong id="obs_40_0003__b23646550484949">OBS OperateAccess</strong> policy to a user but also forbid the user from uploading objects. Create a custom policy for denying object upload, and assign both policies to the user. Then the user can perform all <strong id="obs_40_0003__b52187483984949">OBS OperateAccess</strong> permissions except uploading objects. The following is an example of a deny policy:</p>
<pre class="screen" id="obs_40_0003__screen963476425">{
"Version": "1.1",
"Statement": [
{
"Effect": "Deny",
"Action": [
"obs:object:PutObject"
]
}
]
}</pre>
</li><li id="obs_40_0003__li208291459112"><strong id="obs_40_0003__b520410311504">Example 7: Grant users the permissions required to change a bucket's storage class and to delete certain objects in the bucket.</strong><p id="obs_40_0003__p5531191010211">This policy allows users to change the storage class of bucket <strong id="obs_40_0003__b965327936">obs-example</strong> and to delete object <strong id="obs_40_0003__b10590531940">my-object.txt</strong> in the bucket.</p>
<pre class="screen" id="obs_40_0003__screen197811723101">{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"obs:bucket:ListAllMyBuckets",
"obs:bucket:ListBucket"
]
},
{
"Effect": "Allow",
"Action": [
"obs:object:DeleteObject",
"obs:bucket:PutBucketStoragePolicy"
],
"Resource": [
"OBS:*:*:object:obs-example/my-object.txt",
"OBS:*:*:bucket:obs-example"
]
}
]
}</pre>
</li></ul>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="obs_40_0002.html">Permission Control Mechanisms</a></div>
</div>
</div>
View Git Blame Copy Permalink