Introduction to OBS Access Control

OBS Permission Control Model

OBS provides multiple permission control mechanisms, including IAM permissions, bucket policies, object ACLs, and bucket ACLs. Table 1 describes the mechanisms and application scenarios.

Figure 1 OBS permission control mechanisms

Relationship Between OBS Permissions and IAM Permissions

OBS provides multiple permission control mechanisms, including time-limited access to objects, object ACLs, bucket ACLs, and bucket policies. Some service-level permissions (for example, creating a bucket and listing all buckets) cannot be configured through OBS and can only be configured on IAM. OBS permissions apply only to resources (buckets and objects). To grant both OBS service-level and resource-level permissions, you must use IAM permissions or both IAM and OBS permissions.

Figure 2 Relationship between OBS permissions and IAM permissions

OBS Permission Control Elements

The following factors determine the authorization result:

• Principal (authorized user)
• Effect
• Resource
• Action
• Condition

For details about elements, see Bucket Policy Parameters.

Table 2 describes elements in different permission control mechanisms.

How to Select IAM Permissions, Bucket Policies, and ACLs

Based on the advantages and disadvantages of the three elements, you are advised to preferentially use IAM permissions and bucket policies.

• Select IAM permissions in the following scenarios:
  • Grant the same permissions to numerous IAM users under the same account.
  • Grant the same permissions to all OBS resources or multiple buckets.
  • Configure OBS service-level permissions, such as creating and listing buckets.
  • Restrict the permissions of temporary access keys used for temporarily authorized access to OBS.
• Select bucket policies in the following scenarios:
  • Grant permissions across accounts or grant permissions to anonymous users.
  • Grant different permissions to different IAM users under the same account.
• Still do not know what to select?

  Identify the problem you are most concerned with:

  • What the user can do - IAM permissions recommended

    You can search for an IAM user and check the permissions of the user group to which the user belongs to know what the user can do.

  • Who can access the bucket? — Use bucket policies.

    You can query the bucket and check the bucket policy to know who can access the bucket.

It is better for you to use the same method for access control, because as the number of IAM permissions and bucket policies increase, access maintenance will become increasingly difficult.

Relationship Between Bucket ACLs and Bucket Policies

Bucket ACLs are used to control basic read and write access to buckets. Custom settings of bucket policies support more actions that can be performed on buckets. Bucket ACLs supplement bucket policies. In many cases, bucket policies can replace bucket ACLs to manage access to buckets. Relationship Between Bucket Policies and Bucket ACLs shows the mapping between bucket ACL access permissions and bucket policy actions.

OBS Permission Control Principles

• Least privilege

  Never grant IAM users more than the minimum level of access needed to complete a task. For example, if an IAM user only needs to upload and download objects to a directory, you do not need to assign the user the read and write permissions for the entire bucket.

• Separation of duties

  Management of resources or of permissions can be assigned to different IAM users. For example, you can let one IAM user assign permissions, and let other IAM users manage OBS resources.

• Restriction by condition

  To enhance the security of the resources in a bucket, specific conditions can be configured to control when a permission is applied. For example, a bucket policy with conditions contained can be configured for OBS to accept requests only from a specific IP address.

How Do Access Control Mechanisms Work When They Conflict?

In the OBS permission control elements, there are allow and deny effects, which indicate the permission to allow or deny an operation.

Based on the least-privilege principle, decisions default to deny, and an explicit deny statement always takes precedence over an allow statement. For example, IAM permissions grant a user access to an object, a bucket policy denies the user's access to that object, and there is no ACL. Then access will be denied.

If no method specifies an allow statement, then the request will be denied by default. Only if no method specifies a deny statement and one or more methods specify an allow statement, will the request be allowed. For example, if a bucket has multiple bucket policies with allow statements, adding such a new bucket policy applies the allowed permissions to the bucket, but adding a new bucket policy with a deny statement will make the permissions work differently. The deny statement will take precedence over allow statements, even if the denied permissions are allowed in other bucket policies.

Figure 3 Authorization process

Figure 4 describes how bucket policies, IAM permissions, and ACLs work (allow or deny) when you grant the IAM users of your account the access to OBS buckets and resources in the buckets. ACLs are applied to accounts and do not control IAM users' read and write permissions for the buckets and the sources in the buckets under their account.

Figure 4 Working mechanisms (allow or deny) of bucket policies and IAM permissions in the same account

Figure 5 describes how bucket policies, IAM permissions, and ACLs work (allow or deny) when you grant any other Huawei Cloud account and the IAM users of this account the access to OBS buckets and resources in the buckets.

Figure 5 Working mechanisms (allow or deny) of bucket policies, IAM permissions, and ACLs in cross-account access grant scenarios

• If both the bucket policy and IAM policy are set to Default Deny, but the ACL is set to Allow, the final result is Deny. ACLs are used to supplement bucket policies.

Concepts

• Account: An account that is automatically created during your registration with Huawei Cloud. This account has full access control over its resources and IAM users.
• IAM user: A user created by the administrator in IAM. An IAM user may be an employee, a system, or an application. An IAM user has access permissions to specified resources. IAM users have identity credentials (passwords and access keys) and can log in to the management console or call APIs.
• Anonymous user: A common visitor who has not registered with Huawei Cloud.
• A log delivery user group: A user group who only delivers access logs of buckets and objects to the specified target bucket. OBS does not create or upload any file to a bucket automatically. If you want to record access logs for a bucket, you must grant the log delivery user group required permissions, so that OBS can write the access logs to the specified bucket. This user group is only used to record internal logs of OBS.