Configuring a Bucket Policy

Updated on 2025-02-07 GMT+08:00

View PDF

Bucket policies define the access control over resources (buckets and objects) in OBS.

Procedure

Log in to OBS Browser+.
Select the bucket you want and choose More > Bucket Policy. The window shown in Figure 1 is displayed.

Figure 1 Configuring a bucket policy

Enter a bucket policy in the following format.

Grant permissions to an account. In the following example, the account (whose account ID is 783fc6652cf246c096ea836694f71855) is granted the permission required to obtain the log management information about bucket logging.bucket3.

{
    "Statement": [
        {
            "Sid": "testing",
            "Effect": "Allow",
            "Principal": {
                "ID": [
                    "domain/783fc6652cf246c096ea836694f71855:user/*"
                ]
            },
            "Action": [
                "GetBucketLogging"
            ],
            "Resource": [
                "logging.bucket3"
            ]
        }
    ]
}

Table 1 describes the parameters that you need to manually modify in the example above:

**Table 1** Parameter changes
Item to Modify	Description
GetBucketLogging	Value of the Action field that indicates all OBS-supported actions in the policy. The value is a case-insensitive string. The value can contain a wildcard character (), for example, "Action":["List", "Get"]*, to apply all actions to the resources. You need to change the value as needed. For the actions supported by OBS, see Bucket Actions.
Allow	Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value must be Allow or Deny.
logging.bucket3	The bucket on which the policy works. You can change the bucket name as needed.
783fc6652cf246c096ea836694f71855	ID of an account. You can change it as needed. You can obtain the account ID on the bucket's Basic Information page.

Grant permissions to an IAM user. In the following example, the user (whose ID is 71f3901173514e6988115ea2c26d1999) under the account (whose ID is 219d520ceac84c5a98b237431a2cf4c2) is assigned the permission required to set log management for bucket logging.bucket3.

{
    "Statement": [
        {
            "Sid": "testing",
            "Effect": "Allow",
            "Principal": {
                "ID": [
                    "domain/219d520ceac84c5a98b237431a2cf4c2:user/71f3901173514e6988115ea2c26d1999"
                ]
            },
            "Action": [
                "PutBucketLogging"
            ],
            "Resource": [
                "logging.bucket3"
            ]
        }
    ]
}

Table 2 describes the parameters that you need to manually modify in the example above:

**Table 2** Parameter changes
Item to Modify	Description
PutBucketLogging	Value of the Action field that indicates all OBS-supported actions in the policy. The value is a case-insensitive string. The value can contain a wildcard character (), for example, "Action":["List", "Get"]*, to apply all actions to the resources. You need to change the value as needed. For the actions supported by OBS, see Bucket Actions.
Allow	Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value must be Allow or Deny.
logging.bucket3	The bucket on which the policy works. You can change the bucket name as needed.
219d520ceac84c5a98b237431a2cf4c2	ID of an account. You can change it as needed. You can click next to the target bucket to obtain the Account ID on the Basic Information page.
71f3901173514e6988115ea2c26d1999	ID of a user under the account. You can change it as needed. You can choose My Credentials from the username in the upper right corner of OBS Console to obtain the IAM User ID.

For details about bucket policy parameters, see Bucket Policy Parameters.

Parent topic: Bucket Policies

Previous topic: Overview

Next topic: External Bucket Adding

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot