Creating a Bucket Policy with a Template

OBS Console provides bucket policy templates for eight typical scenarios. You can use these templates to quickly configure bucket policies.

Ways to Configure Bucket Policies

You can use OBS Console, APIs, SDKs, OBS Browser+, or obsutil to configure bucket policies.

Using OBS Console

In the navigation pane of OBS Console, choose Object Storage.
In the bucket list, click the bucket you want to operate. The Objects page is displayed.
In the navigation pane, choose Permissions > Bucket Policies.
Click Create.

Choose a policy template. For details about the parameters, see Bucket Policies.

Figure 1 Choosing the Public Read template

Figure 2 Choosing the Public Read/Write template

Figure 3 Choosing the Bucket Read-Only template

Figure 4 Choosing the Bucket Read/Write template

Figure 5 Choosing the Directory Read-Only template

Figure 6 Choosing the Directory Read/Write template

Figure 7 Choosing the Object Read-Only template

Figure 8 Choosing the Object Read/Write template

**Table 1** Bucket policy templates
Principal	Resource	Template	Actions Allowed	Advanced Settings
All accounts	Entire bucket (including the objects in it)	Public Read See Figure 1	Allows anonymous users to perform the following actions on a bucket and the objects in it: HeadBucket (to check whether the bucket exists and obtain the bucket metadata) GetBucketLocation (to get the bucket location) GetObject (to obtain object content and metadata) RestoreObject (to restore objects from Archive storage) GetObjectVersion (to obtain the content and metadata of a specified object version)	Excluding the specified actions is not allowed.
All accounts	Entire bucket (including the objects in it)	Public Read/Write See Figure 2	Allows anonymous users to perform the following actions on a bucket and the objects in it: ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) HeadBucket (to check whether the bucket exists and obtain the bucket metadata) GetBucketLocation (to get the bucket location) PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) ModifyObjectMetaData (to modify object metadata) ListBucketMultipartUploads (to list multipart uploads) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) RestoreObject (to restore objects from Archive storage) GetObjectVersion (to obtain the content and metadata of a specified object version) PutObjectAcl (to configure the object ACL) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL)	Excluding the specified actions is not allowed.
Current account/Other accounts/Delegated accounts	Entire bucket (including the objects in it)	Bucket Read-Only See Figure 3	Allows specified accounts to perform the following actions on a bucket and the objects in it: Get* (all GET actions) List* (all LIST actions) HeadBucket (to check whether the bucket exists and obtain the bucket metadata)	Excluding the specified actions is not allowed.
Current account/Other accounts/Delegated accounts	Entire bucket (including the objects in it)	Bucket Read/Write See Figure 4	Allows specified accounts to perform all actions excluding the following ones on a bucket and the objects in it: DeleteBucket (to delete the bucket) PutBucketPolicy (to configure a bucket policy) PutBucketAcl (to configure the bucket ACL)	The specified actions are excluded.
All accounts/Current account/Other accounts/Delegated accounts	Current bucket + Specified objects	Directory Read-Only See Figure 5	Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it: GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL) RestoreObject (to restore objects from Archive storage) ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) HeadBucket (to check whether the bucket exists and obtain the bucket metadata) GetBucketLocation (to get the bucket location) NOTE: If you apply the policy to All accounts, ListBucket and ListBucketVersions are not included in the template.	Excluding the specified actions is not allowed.
	Current bucket + Specified objects	Directory Read/Write See Figure 6	Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it: PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) ModifyObjectMetaData (to modify object metadata) ListBucketMultipartUploads (to list multipart uploads) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL) PutObjectAcl (to configure the object ACL) RestoreObject (to restore objects from Archive storage) ListBucket (to list objects in the bucket and obtain the bucket metadata) ListBucketVersions (to list object versions in the bucket) HeadBucket (to check whether the bucket exists and obtain the bucket metadata) GetBucketLocation (to get the bucket location)	Excluding the specified actions is not allowed.
All accounts/Current account/Other accounts/Delegated accounts	Specified objects	Object Read-Only See Figure 7	Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket: GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) GetObjectVersionAcl (to obtain the ACL of a specified object version) GetObjectAcl (to obtain the object ACL) RestoreObject (to restore objects from Archive storage)	Excluding the specified actions is not allowed.
	Specified objects	Object Read/Write See Figure 8	Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket: PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts) GetObject (to obtain object content and metadata) GetObjectVersion (to obtain the content and metadata of a specified object version) ModifyObjectMetaData (to modify object metadata) ListMultipartUploadParts (to list uploaded parts) AbortMultipartUpload (to abort multipart uploads) GetObjectVersionAcl (to obtain the ACL of an object version) GetObjectAcl (to obtain the object ACL) PutObjectAcl (to configure the object ACL) RestoreObject (to restore objects from Archive storage)	Excluding the specified actions is not allowed.

Complete the bucket policy configuration.

Some bucket policy templates require a configuration of principals or resources. You can also change the existing settings of a template, including the policy name, principals, resources, actions, and conditions. For details, see Bucket Policy Parameters.
Click Create in the lower right corner.