Overview

Updated on 2025-02-07 GMT+08:00

View PDF

If you have ACL permissions on buckets of other users, you can add them through OBS Browser+ as external buckets. By doing so, you can access these external buckets locally using your account.

By default, after user A has added a bucket of user B and uploaded an object to the bucket, user B cannot download the object.

You can grant read and write permissions to a bucket through the bucket ACL or bucket policy. Permissions controlled by a bucket ACL are as follows:

**Table 1** Permissions controlled by a bucket ACL
Bucket ACL Permission	Option	Mapped Action in a Custom Bucket Policy
Access to bucket	Read	HeadBucket ListBucket ListBucketVersions ListBucketMultipartUploads
Access to bucket	Write	PutObject DeleteObject DeleteObjectVersion
Access to ACL	Read	GetBucketAcl
Access to ACL	Write	PutBucketAcl

Permissions controlled by a standard bucket policy are as follows:

**Table 2** Permissions controlled by a standard bucket policy
Parameter	Public Read	Public Read and Write
Effect	Select Allow.	Select Allow.
Principal	* (Any user)	* (Any user)
Resources	* (All objects in a bucket)	* (All objects in a bucket)
Actions	GetObject GetObjectVersion HeadBucket ListBucket	GetObject GetObjectVersion PutObject DeleteObject DeleteObjectVersion HeadBucket ListBucket
Conditions	N/A	N/A

If a custom bucket policy is used to authorize such permissions, the HeadBucket, ListBucket, GetObject, and GetObjectVersion actions must be allowed. More actions can be allowed according to your actual needs.

The following are some restrictions when you (the user who adds the bucket) operate the external bucket:

You cannot restore Archive objects that are not yours in the external bucket. You can view the object restore status only when the owner of those Archive objects grants you the read permission for the objects.
You can perform only authorized actions on existing objects in the external bucket. If you want to perform additional operations on an object, you need to get corresponding permissions granted by the object owner.
If you upload an object to the external bucket, the object ACL permissions will be automatically granted to the bucket owner, including the read permission for the object and the read and write permissions for the object ACL.
The encrypted objects you uploaded to the external bucket cannot be accessed by the bucket owner, because the bucket owner does not have the key.
To download an object from the external bucket, you must have the read permission for the object. You cannot download encrypted objects from the external bucket.

Parent topic: External Bucket Adding

Previous topic: External Bucket Adding

Next topic: Adding an External Bucket

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot