Permissions Management

Updated on 2025-01-26 GMT+08:00

View PDF

You can use Identity and Access Management (IAM) to manage OBS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use OBS resources but prevent them from being able to delete resources or perform any high-risk operations.

If your account does not require individual IAM users for permissions management, skip this section.

OBS Permissions

By default, new IAM users do not have any permissions assigned. You can assign permissions to these users by adding them to one or more groups and attaching policies to the groups. IAM provides preset system policies that define common permissions for different services, such as full control access and read-only. You can directly use these preset policies.

OBS is a global service deployed and accessed without specifying any physical region. OBS permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.

Policy Types

RBAC policy: An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all the required permissions, including permissions for accessing and managing that service. RBAC policies do not support operation-specific permission control.
Fine-grained policy: A fine-grained policy consists of API-based permissions for operations on specific resource types. Fine-grained policies, as the name suggests, allow for more fine-grained control than RBAC policies. Users with such fine-grained permissions can only perform specific operations on services.

NOTE:

Due to data caching, an RBAC policy or a fine-grained policy involving OBS actions will take effect 10 to 15 minutes after it is attached to a user, an enterprise project, or a user group.

Table 1 lists all system policies of OBS.

**Table 1** OBS system policies
Policy	Description	Policy Type
Tenant Administrator	Allows you to perform any operation on all cloud resources under the account. OBS policies are configured under Global service > OBS.	RBAC policy
Tenant Guest	Allows you to perform read-only operations on all cloud resources under the account. OBS policies are configured under Global service > OBS.	RBAC policy
OBS Buckets Viewer	Allows you to list buckets, obtain basic bucket information and bucket metadata, and list objects. OBS policies are configured under Global service > OBS.	RBAC policy
OBS Viewer	Allows you to list buckets, obtain basic bucket information and bucket metadata, and list objects. This policy is a system-defined policy of fine-grained authorization. Users with fine-grained authorization can use this policy and can create custom policy template based on this policy. OBS policies are configured under Global service > OBS.	Fine-grained policy
OBS Operator	Allows you to perform all operations defined in OBS Viewer and to perform basic object operations, such as uploading objects, downloading objects, deleting objects, and obtaining object ACLs. This policy is a system-defined policy of fine-grained authorization. Users with fine-grained authorization can use this policy and can create custom policy template based on this policy. OBS policies are configured under Global service > OBS.	Fine-grained policy

The following table lists operations that can be performed under each set of OBS permission.

**Table 2** Permissions and the allowed operations on OBS resources
Operation	Tenant Administrator	Tenant Guest	OBS Buckets Viewer	OBS Viewer	OBS Operator
Listing buckets	Supported	Supported	Supported	Supported	Supported
Creating buckets	Supported	Not supported	Not supported	Not supported	Not supported
Deleting buckets	Supported	Not supported	Not supported	Not supported	Not supported
Obtaining basic bucket information	Supported	Supported	Supported	Supported	Supported
Controlling bucket access	Supported	Not supported	Not supported	Not supported	Not supported
Managing bucket policies	Supported	Not supported	Not supported	Not supported	Not supported
Changing bucket storage classes	Supported	Not supported	Not supported	Not supported	Not supported
Listing objects	Supported	Supported	Supported	Supported	Supported
Listing objects with multiple versions	Supported	Supported	Not supported	Not supported	Not supported
Uploading files	Supported	Not supported	Not supported	Not supported	Supported
Creating folders	Supported	Not supported	Not supported	Not supported	Supported
Deleting objects	Supported	Not supported	Not supported	Not supported	Supported
Deleting folders	Supported	Not supported	Not supported	Not supported	Supported
Downloading objects	Supported	Supported	Not supported	Not supported	Supported
Deleting object versions	Supported	Not supported	Not supported	Not supported	Supported
Downloading object versions	Supported	Supported	Not supported	Not supported	Supported
Changing object storage classes	Supported	Not supported	Not supported	Not supported	Not supported
Restoring objects	Supported	Not supported	Not supported	Not supported	Not supported
Undeleting objects	Supported	Not supported	Not supported	Not supported	Supported
Deleting fragments	Supported	Not supported	Not supported	Not supported	Supported
Controlling object access	Supported	Not supported	Not supported	Not supported	Not supported
Configuring object metadata	Supported	Not supported	Not supported	Not supported	Not supported
Obtaining object metadata	Supported	Supported	Not supported	Not supported	Supported
Managing versioning	Supported	Not supported	Not supported	Not supported	Not supported
Managing logging	Supported	Not supported	Not supported	Not supported	Not supported
Managing event notifications	Supported	Not supported	Not supported	Not supported	Not supported
Managing tags	Supported	Not supported	Not supported	Not supported	Not supported
Managing lifecycle rules	Supported	Not supported	Not supported	Not supported	Not supported
Managing static website hosting	Supported	Not supported	Not supported	Not supported	Not supported
Managing CORS rules	Supported	Not supported	Not supported	Not supported	Not supported
Managing URL validation	Supported	Not supported	Not supported	Not supported	Not supported
Managing domain names	Supported	Not supported	Not supported	Not supported	Not supported
Appending data to objects	Supported	Not supported	Not supported	Not supported	Supported
Configuring object ACL	Supported	Not supported	Not supported	Not supported	Not supported
Configuring the ACL for an object version	Supported	Not supported	Not supported	Not supported	Not supported
Obtaining object ACL information	Supported	Supported	Not supported	Not supported	Supported
Obtaining the ACL of a specific object version	Supported	Supported	Not supported	Not supported	Supported
Initiating a multipart upload	Supported	Not supported	Not supported	Not supported	Supported
Listing uploaded parts	Supported	Supported	Not supported	Not supported	Supported
Canceling multipart uploads	Supported	Not supported	Not supported	Not supported	Supported

OBS Resource Permissions Management

Access to OBS buckets and objects can be controlled by IAM user permissions, bucket policies, and ACLs.

For more information, see Overview.

Parent topic: Service Overview

Previous topic: Application Scenarios

Next topic: Constraints

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot