Allowing IAM Users to View Only Authorized Buckets

Updated on 2024-08-15 GMT+08:00

View PDF

Scenario

This topic explains how to use the Enterprise Project Management Service (EPS) to authorize an IAM user under an account to operate specific buckets, so that the user can view only the specified buckets and perform authorized operations on OBS Console. In this way, bucket permissions can be isolated.

In this case, the IAM user test-user is authorized to view only bucket example on OBS Console and has only the upload permission (obs:object:PutObject), object listing permission (obs:bucket:ListBucket), and bucket listing permission (obs:bucket:ListAllMyBuckets). With these permissions, user test-user can upload objects.

Recommended Configuration

Use EPS to isolate permissions.

Configuration Precautions

If an IAM user is authorized for an action through both IAM and EPS, the authorization result is subject to IAM configuration.
Examples:

1. If the bucket listing permission (obs:bucket:ListAllMyBuckets) is authorized through both IAM and EPS, the final permission authorization is subject to the IAM configuration. As a result, this authorization allows the user to list all buckets including those that do not belong to the enterprise project.

2. For the upload permission (obs:object:PutObject), if Allow is configured in IAM and Deny is configured in the enterprise project, Allow takes effect, that is, objects can be uploaded.
If the OBS Viewer permission is configured for an IAM user in IAM and this user's group is added to the enterprise project, the IAM user cannot list buckets after logging in to OBS.
After the configuration is complete, it is normal if the system still displays a message indicating that you do not have required permissions, because OBS Console also calls other APIs for advanced settings, but you can still perform the allowed read/write operations.

Procedure

Log in to the console and choose Enterprise > Project Management on the top navigation bar. Then, create an enterprise project named test-project using the authorized account by referring to Creating an Enterprise Project.
Add bucket example-001 to test-project, the project created in 1. For details, see Adding Resources to an Enterprise Project.

NOTE:

If you need the permissions on multiple buckets, migrate all the buckets to the enterprise project.

Figure 1 Adding buckets to an enterprise project
Click the Permissions tab and then Authorize User,

Figure 2 Authorizing permissions to an enterprise user
Go to the IAM console and find user test-user.

Figure 3 Finding user test-user
Click Authorize in the Operation column to go to the authorization page. Then select Select permissions for Authorization Method.

Figure 4 Authorization method of selecting permissions
Attach policies to test-user, so that the user has the permissions defined in the policies in the test-project enterprise project.
1. Choose available policies or create a custom policy. You can filter policies by choosing Custom policy from the drop-down list or click Create Policy on the right to create custom policies.
  - For details about how to create custom policies, see Creating a Custom Policy. The figure below shows the custom permissions configured in this example, including obs:object:PutObject (for uploading objects), obs:bucket:ListBucket (for listing objects in a bucket), and obs:bucket:ListAllMyBuckets (for listing buckets).
  - For details about OBS system-defined permissions, see Table 1.
    Figure 5 Configuring a custom policy
    
    NOTE:
    
    The policy you attach here must be different from that added to the user group in IAM. Otherwise, the permission authorization is subject to the settings in IAM.
2. Select the desired policies,
Figure 6 Adding a custom policy
Click Next and add user test-user (not in any user group) to the enterprise project.

Figure 7 Adding a user to an enterprise project
Click OK. The added permissions are displayed in the list in the enterprise project view on the Permissions > Authorization page.

Figure 8 Successful permission add

NOTE:

After finishing the configuration in EPS, you do not need to configure the IAM custom or system policies.

Verification

Log in to OBS Console as user test-user.
Check whether there is only example-001 in the bucket list.

Figure 9 Verifying the permission configuration
Click bucket example-001 to go to the overview page and choose Objects in the navigation pane. Other objects in the bucket are displayed.

Figure 10 Viewing objects in bucket example-001

NOTE:

After the configuration is complete, it is normal if the system still displays a message indicating that you do not have required permissions, because OBS Console also calls other APIs for advanced settings, but you can still perform the allowed read/write operations.
Upload file 111.txt to bucket example-001. The file upload succeeds, indicating that the permission configuration is successful.

Figure 11 Uploading objects

NOTE:

If some other permissions, such as downloading or deleting an object, are required, hover your cursor over the username and choose Identity and Access Management > Permissions > Policies/Roles, and then configure permissions in the custom policy.

Parent topic: Permission Configuration in Typical Scenarios

Previous topic: Granting Temporary Access to OBS

Next topic: Restricting Access to a Bucket for Specific IP Addresses

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot