Help Center/ Object Storage Service/ BrowserJS SDK Developer Guide (Ally Region)/ Bucket Management/ Management Bucket Policies
Updated on 2026-01-16 GMT+08:00
View PDF
Share

Management Bucket Policies

Besides bucket ACLs, bucket owners can use bucket policies to centrally control access to buckets and objects in buckets.

Setting a Bucket Policy

You can call ObsClient.setBucketPolicy to set bucket policies. Sample code is as follows:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    server: 'https://your-endpoint'
});
// Bucket name
const bucketName = 'bucketname';
// Bucket policy
const policy =  "{\"Statement\":[{\"Principal\":\"*\",\"Effect\":\"Allow\",\"Action\":\"ListBucket\",\"Resource\":\""+bucketName+"\"}]}";
//Set a bucket policy.
obsClient.setBucketPolicy({
       Bucket: bucketName,
       Policy: policy
}, function(err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});

For details about the format (JSON character string) of bucket policies, see the Object Storage Service API Reference.

Obtaining a Bucket Policy

You can call ObsClient.getBucketPolicy to obtain bucket policies. Sample code is as follows:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    server: 'https://your-endpoint'
});

// Obtain the bucket policy.
obsClient.getBucketPolicy({
       Bucket: 'bucketname',
}, function(err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
              if(result.CommonMsg.Status < 300 && result.InterfaceResult){
                     console.log('Policy-->' + result.InterfaceResult.Policy);
              }
       }
});

Deleting a Bucket Policy

You can call ObsClient.deleteBucketPolicy to delete a bucket policy. Sample code is as follows:

// Create an instance of ObsClient.
var obsClient = new ObsClient({
    // Hard-coded or plaintext AK/SK are risky. For security purposes, encrypt your AK/SK and store them in the configuration file or environment variables. In this example, the AK/SK are stored in environment variables for identity authentication. Before running this example, configure environment variables AccessKeyID and SecretAccessKey.
    // The front-end code does not have the process environment variable, so you need to use a module bundler like webpack to define the process variable.
    // Obtain an AK/SK pair on the management console.
    access_key_id: process.env.AccessKeyID,
    secret_access_key: process.env.SecretAccessKey,
    server: 'https://your-endpoint'
});

// Delete a bucket policy.
obsClient.deleteBucketPolicy({
       Bucket: 'bucketname'
}, function(err, result) {
       if(err){
              console.error('Error-->' + err);
       }else{
              console.log('Status-->' + result.CommonMsg.Status);
       }
});
Parent topic: Bucket Management