Granting Temporary Access to OBS

Updated on 2024-08-15 GMT+08:00

View PDF

Scenario

This case describes how to use temporary access keys (temporary AK/SK and security token) to access OBS in temporary authorization mode.

Assume that you want to enable an IAM user (user name: APPServer) to access the APPClient folder in bucket hi-company and apply for two different temporary access keys to distribute to APP-1 and APP-2. APP-1 can only access files in APPClient/APP-1. APP-2 can access only the files in APPClient/APP-2.

Procedure

Log in to Huawei Cloud and click Console in the upper right corner.
On the console, hover your cursor over the username in the upper right corner, and choose Identity and Access Management from the drop-down list.
Create an IAM user APPServer. For details, see Creating an IAM User.

Create a user-defined policy that allows access to the AppClient folder in bucket hi-company.

In the navigation pane, choose Permissions > Policies/Roles > Create Custom Policy.

Configure parameters for a custom policy.

NOTE:

Before configuring an IAM policy, you need to understand what permissions are required. An IAM user only has the permissions defined by the policy. In this example, user APPServer only has full permissions on objects in the APPClient folder.

Figure 1 Configuring a custom policy

**Table 1** Parameters for configuring a custom policy
Parameter	Description
Policy Name	Enter a policy name.
Policy View	Set this parameter based on your own habits. JSON is used here.
Policy Content	{ "Version": "1.1", "Statement": [ { "Action": [ "obs:object:" ], "Resource": [ "obs:::object:hi-company/APPClient/" ], "Effect": "Allow" } ] }
Scope	The default value is Global services.

Click OK. The custom policy is created.

Create a user group and assign permissions.

Add the created custom policy to the user group by following the instructions in the IAM document.
Add the IAM user (APPServer) you want to authorize to the created user group by referring to Adding Users to or Removing Users from a User Group.

NOTE:

Due to data caching, it takes about 10 to 15 minutes for a custom policy to take effect after the authorization.

The IAM user (APPServer) obtains temporary access keys (temporary access keys and security token) for APP-1 and APP-2.

To obtain temporary access keys with different permissions, you need to set a temporary policy by adding the policy parameter in the request body. For details, see Obtaining a Temporary Access Key and Security Token Through a Token.

The following is a sample request for obtaining a pair of temporary access keys. The temporary policy parameters are displayed in bold.

A sample request for obtaining a pair of temporary access keys for the device app APP-1:

{
    "auth": {
	"identity": {
	    "policy": {
		"Version": "1.1",
		"Statement": [
		    {
			"Action": [
			    "obs:object:*"
			],
			"Resource": [
			    "obs:*:*:object:hi-company/APPClient/APP-1/*"
			],
			"Effect": "Allow"
		    }
		]
	    },
	    "token": {
		"duration-seconds": 900
		
	    },
	    "methods": [
		"token"
	    ]
	}
    }
}

A sample request for obtaining a pair of temporary access keys for the device app APP-2:

{
    "auth": {
	"identity": {
	    "policy": {
		"Version": "1.1",
		"Statement": [
		    {
			"Action": [
			    "obs:object:*"
			],
			"Resource": [
			    "obs:*:*:object:hi-company/APPClient/APP-2/*"
			],
			"Effect": "Allow"
		    }
		]
	    },
	    "token": {
		"duration-seconds": 900
		
	    },
	    "methods": [
		"token"
	    ]
	}
    }
}

Verification

After APP-1 and APP-2 have the temporary access keys, they can access OBS through OBS APIs or SDKs. APP-1 can access only files in the APPClient/APP-1 folder, and APP-2 can access only files in the APPClient/APP-2 folder.

Parent topic: Permission Configuration in Typical Scenarios

Previous topic: Temporarily Sharing Objects with All Accounts

Next topic: Allowing IAM Users to View Only Authorized Buckets

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot