Bucket Policy Parameters

Sid

ID of the statement. The value is a string that describes the statement.

Optional

Principal

Domains and users that a statement applies to. The value can be a wildcard (*), indicating all users. To grant permissions to all users in a domain, set Principal to domain/domainid:user/*. To grant permissions to a specific user in a domain, set Principal to domain/domainid:user/userId or domain/domainid:user/userName.

If you configure a bucket inventory on OBS Console, a policy is automatically generated for the bucket. In the generated bucket policy, the value of Principal is {"Service": "obs"}. For details, see Bucket Inventories.

Optional. Select either Principal or NotPrincipal.

NotPrincipal

Users that the statement does not apply to. Its value has the same format as Principal.

The following gives an example that denies all operations performed by users except the specified IAM user.

domain_id indicates the account ID, and use_id indicates the IAM user ID. For details about how to obtain an account ID and IAM user ID, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

{
    "Statement": [
        {
            "Effect": "Deny", 
            "Action": ["*"], 
            "Resource": [
                "examplebucket/*", 
                "examplebucket"
            ], 
            "NotPrincipal": {
                "ID": [
                    "domain/domain_id:user/use_id", 
                    "domain/domain_id:root"
                ]
            }
        }
     ]
}

Optional. Select either NotPrincipal or Principal.

Action

Actions that the statement applies to. This parameter specifies a set of all the operations supported by OBS. Its values are case insensitive. The value can be a wildcard character (*) that indicates all operations. For example: "Action":["List*","Get*"].

Optional. Select either Action or NotAction.

NotAction

Actions that are not controlled by this statement. Its value has the same format as Action.

Optional. Select either Action or NotAction.

Effect

Whether the permission in a statement is Allow or Deny.

Mandatory

Resource

Resources that the statement will apply to. You can use a wildcard (*) to indicate all resources.

Optional. Select either Resource or NotResource.

NotResource

Resources that the statement will not apply to. Its value has the same format as Resource.

Optional. Select either Resource or NotResource.

Condition

Conditions for the statement to take effect.

Optional

String

StringEquals

Strict matching. Short version: streq

StringNotEquals

Strict negated matching. Short version: strneq

StringEqualsIgnoreCase

Strict matching, ignoring case. Short version: streqi

StringNotEqualsIgnoreCase

Strict negated matching, ignoring case. Short version: strneqi

StringLike

Loose case-sensitive matching. The values can include a multi-character match wildcard (*) or a single-character match wildcard (?) anywhere in the string. Short version: strl

StringNotLike

Negated loose case-sensitive matching. The values can include a multi-character match wildcard (*) or a single-character match wildcard (?) anywhere in the string. Short version: strnl

Numeric

NumericEquals

Matching. Short version: numeq

Numeric indicates a data type expressed in numbers.

NumericNotEquals

Negated matching. Short version: numneq

NumericLessThan

"Less than" matching. Short version: numlt

NumericLessThanEquals

"Less than or equals" matching. Short version: numlteq

NumericGreaterThan

"Greater than" matching. Short version: numgt

NumericGreaterThanEquals

"Greater than or equals" matching. Short version: numgteq

Date

(The date format must comply with the ISO 8601 standard, for example, 2015-07-01T12:00:00Z.)

DateEquals

Matching a specific date. Short version: dateeq

DateNotEquals

Negated matching. Short version: dateneq

DateLessThan

The date is earlier than a specific date. Short version: datelt

DateLessThanEquals

The date is earlier than or equal to a specific date. Short version: datelteq

DateGreaterThan

The date is later than a specific date. Short version: dategt

DateGreaterThanEquals

The date is later than or equal to a specific date. Short version: dategteq

Boolean

Bool

Strict Boolean matching

IP address

IpAddress

Specified IP address or range

NotIpAddress

All IP addresses excluding the specified IP address or range

ForAllValues

(For all values in the request)

Tests whether the value of every member of the request set is a subset of the condition key set. The condition returns true if every key value in the request matches at least one value in the policy.

This example shows how to use the ForAllValues with the StringEquals condition operator. The policy applies only when a requester has resource tag aa, bb, or cc.

If a requester initiates an image sharing request to aa and cc, the request is allowed because the requested attributes all match values specified in the policy.

If a requester initiates an image sharing request to aa, bb, cc, and dd, the request is denied because dd is not within the list of the allowed organization paths.

"Condition": {
    "ForAllValues:StringEquals": {
        "g:ResourceTag/test": [
            "aa",
            "bb",
            "cc"
        ]
    }
}

ForAnyValue

(For any value in the request)

Tests whether at least one member of the set of request values matches at least one member of the set of condition key values. The condition returns true if any one of the key values in the request matches any one of the condition values in the policy. For no matching key or a null dataset, the condition returns false.

This example shows how to use the ForAnyValue with the StringEquals condition operator. The policy applies when a requester has any of the following resource tags: aa, bb, or cc.

If a requester initiates an image sharing request to aa and dd, the request is allowed because the request contains one match (aa).

If a requester initiates an image sharing request to dd and ee, the request is denied because dd and ee are not within the list of the allowed organization paths.

"Condition": {
    "ForAnyValue:StringEquals": {
        "g:ResourceTag/test": [
            "aa",
            "bb",
            "cc"
         ]
    }
}

g:CalledVia

String

Yes

Used to control access across services. Requests for OBS may be forwarded through a chain of services. g:CalledVia records an ordered list of each service in the chain, as shown in Figure 1. For example, if a user requests to download an object from OBS through ModelArts, g:CalledVia records service.ModelArts.

Figure 1 g:CalledVia

The following gives an example that allows only requests made by ModelArts to make API calls for downloading objects from OBS.

    "Condition": {
        "ForAnyValue:StringEquals": {
            "g:CalledVia": "service.ModelArts"
	 }
    }

g:CalledViaFirst

String

No

It refers to the first element in g:CalledVia, which means the first service that forwards a user's request.

g:CalledViaLast

String

No

It refers to the last element in g:CalledVia, which means the last service that forwards a user's request.

g:ViaService

Boolean

No

Whether the request was initiated by the cloud service on behalf of the user through the Impersonate protocol. The value of this key is true only when g:CalledVia is not an empty string.

• true: The request is initiated by a cloud service.
• false: The request is not initiated by a cloud service.

g:PrincipalIsService

Boolean

No

Whether the requesting principal is a cloud service. You can use this key to control whether only cloud services can access the specified APIs.

g:PrincipalServiceName

String

No

Name of the cloud service. This condition key is present only when the requester is a cloud service.

The following example allows the policy to be applied only when the requester is ModelArts.

    "Condition": {
        "StringEquals": {
            "g:PrincipalServiceName": "service.ModelArts"
        }
    }

g:CurrentTime

Date

No

When a request was received. The time is in ISO 8601 format, for example, 2012-11-11T23:59:59Z.

CurrentTime

Date

No

Same as g:CurrentTime

EpochTime

Numeric

No

Time when the request was received by the server, which was expressed as seconds since 1970.01.01 00:00:00 UTC, regardless of the leap seconds

g:TokenIssueTime

Date

No

Time when the STSToken in the access credentials was issued

g:DomainName

String

No

Account name of the requester. To obtain an account name, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

g:DomainId

String

No

Account ID of the requester. To obtain an account ID, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

g:PrincipalAccount

String

No

Same attribute as g:DomainId

g:PrincipalType

String

No

Type of the principal, which can be User, AssumedAgency, or ExternalUser. When long-term IAM credentials are used for access, the value is User. When an IAM assumed-agency session is used for access, the value is AssumedAgency. When a virtual federated user is used for access, the value is ExternalUser.

g:PrincipalUrn

String

No

URN of the requester. Different principals have different URN formats.

IAM users: iam::<domain-id>:user:<user-name>

IAM agencies: sts::<domain-id>:assumed-agency:<agency-name>/<session-name>

Virtual federated users: sts::<domain-id>:external-user:<idp-id>/<session-name>

For details about how to obtain the parameters, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information. The session name is the entered enterprise username of the delegating party when you obtain the temporary access keys and security token of an agency.

g:PrincipalId

String

No

ID of the requesting principal. Different principals have different ID formats.

IAM users: <user-id>

IAM agencies: <agency-id>:<session-name>

Virtual federated users: <idp-id>:<session-name>

For details about how to obtain the parameters, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information. The session name is the entered enterprise username of the delegating party when you obtain the temporary access keys and security token of an agency.

g:UserName

String

No

IAM username of the requester. For details about how to obtain an IAM username, see Obtaining an IAM Username.

g:UserId

String

No

IAM user ID of the requester. For details about how to obtain an IAM user ID, see Obtaining an IAM User ID.

g:PrincipalOrgId

String

No

ID of the organization to which the principal belongs. You can use this condition key to specify that only principals in the specified organization can access the specified APIs. This condition key is present only when the principal is part of an organization.

g:PrincipalOrgPath

String

No

Organization path for the requesting account. You can use this key to control that only accounts at specified levels in the organization can access the specified APIs. This condition key is present only when the requester is part of an organization. An account's organization path is in the following format:

<organization-id>/<root-id>/(<ou-id>/)*<account-id>

g:ResourceOrgId

String

No

ID of the organization to which the bucket owner account belongs

g:ResourceOrgPath

String

No

Path of the bucket owner account in the organization

g:ResourceAccount

String

No

Account ID of the bucket owner. For details about how to obtain an account ID, see Obtaining an Account ID.

g:MFAPresent

Boolean

No

Whether multi-factor authentication (MFA) is used to obtain a token

• true: MFA authentication is used.
• false: MFA authentication is not used.

g:MFAAge

Numeric

No

Validity period (in seconds) of STS security tokens obtained through MFA authentication. This condition must be used together with g:MFAPresent. This condition key is present only when you log in to the console through MFA authentication or when you use the assumed-agency session obtained through MFA to make a request.

g:Referer

String

No

HTTP referer header in a request. As this key is specified by the client, it should not be used to prevent unauthorized parties from making direct requests.

Referer

String

No

Same as g:Referer

g:RequestedRegion

String

No

Region that was called in a request. If the target cloud service is a global service, set this parameter to NULL. If the target cloud service is a regional service, set this parameter to the ID of the region, for example, cn-north-4. This condition key is present only when certain region-specific services are requested.

g:RequestTag/<tag-key>

String

No

Tag contained in a request. <tag-key> is case-insensitive. If a requester adds a tag when making an API call (for example, adding a tag for an existing bucket or adding a tag when creating a bucket), you can use this condition key to check whether the request contains the tag. You need to manually enter a tag key.

g:ResourceTag/<tag-key>

String

No

Tag attached to the requested resource. You can use this key to control that only resources with specified tags can be accessed. <tag-key> is case-insensitive. You need to manually enter a tag key.

g:TagKeys

String

Yes

List of tag keys in a request

The following example allows the policy to be applied when the tag included in a request is either group or country.

    "Condition": {
        "ForAnyValue:StringNotEquals": {
            "g:TagKeys": ["group", "country"]
        }
     }

g:SecureTransport

Boolean

No

Whether the request was sent using SSL

• true: SSL is used.
• false: SSL is not used.

SecureTransport

Boolean

No

Same as g:SecureTransport

TlsVersion

Numeric

No

TLS version used in the request

Restrictions on using TlsVersion:

• TlsVersion cannot be used for parallel file systems.
• If a client uses OBS Console, OBS Browser+, or SDKs to access OBS, the used TLS version cannot be earlier than 1.2, or the requests will be denied. Note that when a user accesses OBS through the console, OBS detects the TLS version used by the console system, rather than the TLS version of the original request.
• TlsVersion cannot be used in the getBucketLocation API.

The following gives an example that denies object download requests initiated by clients whose TLS version is earlier than 1.2.

    "Condition":{
        "NumericLessThan":{
            "TlsVersion": "1.2"
        }
    }

g:SourceIdentity

String

No

The source_identity field that was set in the temporary IAM credential STSToken. The source_identity field is specified when a user obtains a temporary IAM credential for the first time through the AssumeAgency API of STS and cannot be changed in subsequent agency switching.

g:SourceIp

IP address

No

Public IP address that made the request to access OBS. If a proxy or NAT is used for access, the public IP address that made the request will change. OBS then checks the last-hop public IP address of the request for accessing the server.

SourceIp

IP address

No

IP address that made the request. When SourceIp is used, the IP address provided by the customer is preferentially identified. If no IP address is provided, the previous-hop IP address is identified. Using SourceIp may cause IP address spoofing.

SourceVpc

String

No

ID of the VPC that initiated the request. For details about how to obtain a VPC ID, see Obtaining a VPC ID.

g:SourceVpce

String

No

ID of the VPC endpoint that initiated the request. For details about how to obtain a VPC endpoint ID, see Obtaining a VPC Endpoint ID.

SourceVpce

String

No

Same as g:SourceVpce

g:VpcSourceIp

IP address

No

Source IP address of a request initiated in a VPC

g:UserAgent

String

No

HTTP User-Agent header in a request. As this key is specified by the client, it should not be used to prevent unauthorized parties from making direct requests.

UserAgent

String

No

Same as g:UserAgent

g:EnterpriseProjectId

String

No

ID of the enterprise project for the request or the requested resource. For details about how to obtain an enterprise project ID, see How Do I Obtain an Enterprise Project ID?

ServiceAgency

String

No

Name of the IAM agency that delegates cloud services to access OBS. For details about how to obtain an agency name, see Obtaining an Agency Name.

g:SourceAccount

String

No

Account of the resource for which a service-to-service request was initiated

g:SourceUrn

String

No

URN of the resource for which a service-to-service request was initiated

ListBucket

prefix

Type: String. Lists objects with the specified prefix.

If prefix, delimiter, and max-keys are configured for a bucket policy, the List requests must contain the matched key-value pair.

For example, if a bucket policy (with the condition operator set to NumericEquals, the key to max-keys, and the value to 100) is configured to allow all accounts to read data from a bucket, the List requests from all accounts must have ?max-keys=100 at the end of the bucket domain name. The listed objects are the first 100 objects in alphabetic order.

delimiter

Type: String. Groups objects in a bucket.

max-keys

Type: Numeric. Sets the maximum number of objects. Returned objects are listed in alphabetic order.

ListBucketVersions

prefix

Type: String. Lists multi-version objects with the specified prefix.

delimiter

Type: String. Groups objects of different versions in a bucket.

max-keys

Type: Numeric. Sets the maximum number of objects. Returned objects are listed in alphabetic order.

PutBucketAcl

x-obs-acl

Type: String. Configures the bucket ACL. When modifying a bucket ACL, you can use the request that contains a canned ACL setting in its header. Value options of a canned ACL setting: private|public-read|public-read-write|bucketowner-read|log-delivery-write.

None

PutObject

x-obs-acl

Type: String. Configures the object ACL. When uploading an object, you can use the request that contains a canned ACL setting in its header. Value options of a canned ACL setting: private|public-read|public-read-write|bucketowner-read|bucket-owner-full-control|log-delivery-write.

x-obs-copy-source

Type: String. Specifies names of the source bucket and the source object. Format: /bucketname/keyname

x-obs-metadata-directive

Type: String. Specifies whether to copy the metadata of the source object or replace with the metadata in the request. The value can be COPY or REPLACE.

x-obs-server-side-encryption

Type: String. Specifies that objects in a bucket are encrypted using SSE-KMS before they are stored. The value is kms.

PutObjectAcl

x-obs-acl

Type: String. Configures the object ACL. When uploading an object, you can use the request that contains a canned ACL setting in its header. Value options of a canned ACL setting: private|public-read|public-read-write|bucketowner-read|bucket-owner-full-control|log-delivery-write.

GetObjectVersion

versionId

Type: String. Obtains the object with the specified version ID.

GetObjectVersionAcl

versionId

Type: String. Obtains the ACL of the object with the specified version ID.

PutObjectVersionAcl

versionId

Type: String. Specifies a version ID.

x-obs-acl

Type: String. Configures the ACL of the object with the specified version ID. When uploading an object, you can use the request that contains a canned ACL setting in its header. Value options of a canned ACL setting: private|public-read|public-read-write|bucketowner-read|bucket-owner-full-control|log-delivery-write.

DeleteObjectVersion

versionId

Type: String. Deletes the object with the specified version ID.