Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Object Storage Service/ OBS Bucket Policies Only Allow Access from the Specified Objects
Updated on 2025-08-25 GMT+08:00
View PDF
Share

OBS Bucket Policies Only Allow Access from the Specified Objects

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

obs-bucket-policy-grantee-check

Identifier

obs-bucket-policy-grantee-check

Description

If an OBS bucket has a policy that allows access from an object that is not one of the specified ones, this bucket is noncompliant.

Tag

obs, access-analyzer-verified

Trigger Type

Configuration change

Filter Type

obs.buckets

Configure Rule Parameters
  • principal: authorized identities, for example, domain/aaaa:user/111111 and domain/bbbb
  • sourceIp: authorized source IPs, for example 192.168.0.0/16
  • sourceVpc: authorized source VPCs. Enter VPC IDs, for example, vpcidaaaa.
  • sourceVpce: authorized VPC endpoints. Enter VPC endpoint IDs, for example, vpceidaaaa.

Note: The parameters should have the same format as the principals or conditions in OBS bucket policies.

Application Scenarios

A bucket policy applies to the configured OBS bucket and objects in the bucket. You can use bucket policies to control the access of IAM users or other account to your OBS buckets. You are advised to apply the principle of least privilege to ensure that a bucket policy only grants necessary permissions for certain tasks.

Solution

You can modify policies for noncompliant buckets through the visual editor or the JSON view to restrict access from other objects than the authorized ones.

Rule Logic

  • If an OBS bucket does not have any policies that allow access from an object except the specified ones, this bucket is compliant.
  • If an OBS bucket has a policy that allows access from an object that is not one of the specified ones, this bucket is noncompliant.
  • Note: The parameters specified in Configure Rule Parameters must have the same format as the principals or conditions in OBS bucket policies.
Parent topic: Object Storage Service