Creating a Custom Bucket Policy (JSON View)

1. In the navigation pane of OBS Console, choose Buckets.
2. In the bucket list, click the desired bucket. The Objects page is displayed.
3. In the navigation pane, choose Permissions > Bucket Policies.
4. In the upper right corner of the page, click JSON and then Edit.
5. Edit the bucket policy. Below is a bucket policy example in JSON:
   In the following example, configure the actual values for the parameters: test-obs-policy (the bucket policy name), account ID (the account ID), User ID (the IAM user ID), and test-bucket/test.txt (object test.txt in the test-bucket bucket). To obtain the account ID and IAM user ID, see Obtaining Account, IAM User, Project, User Group, Region, and Agency Information.

   {
      "Statement":[
          {
              "Sid":"test-obs-policy",
              "Effect":"Allow",
              "Principal":{
                  "ID":[
                      "domain/account ID", 
                      "domain/account ID:user/User ID" 
                  ]
              },
              "Action":[
                  "PutObject",
                  "GetObject"
              ],
              "Resource":[
                 "test-bucket/test.txt"
              ],
              "Condition":{
                  "IpAddress":{
                       "SourceIp": [
                           "114.115.1.0/24"
                       ]
                  }
              }
          }
      ]
    }

   Table 1 Parameters for creating a bucket policy in JSON

   Parameter	Description
   Sid	Bucket policy name
   Effect	Effect of the bucket policy. For details, see Bucket Policy Parameters.
   Principal	Users that the bucket policy applies to. You can obtain the user ID on the My Credentials page by logging in to the console as the user to be authorized. Principals should be configured as follows: domain/Domain ID (indicating that the principal is an account) domain/Domain ID:user/User ID (indicating that the principal is a user under an account) To grant permissions to a federated user (that uses a SAML identity provider), you need to configure the principal in the following format. domainIDxxx indicates the account ID of the federated user. provider-name indicates the name of the user's identity provider. "Principal": { "Federated": "domain/domainIDxxx:identity-provider/provider-name" } To grant permissions to a user group that a federated user (that uses a SAML identity provider) belongs to, you need to configure the principal in the following format. groupname indicates the name of the IAM user group that the federated user belongs to. "Principal": { "Federated": "domain/domainIDxxx:group/groupname" }
   Action	Actions that the bucket policy applies to. For details, see Bucket Policy Parameters.
   Resource	Resources that the bucket policy applies to. For details, see Bucket Policy Parameters.
   Condition	Conditions under which the bucket policy takes effect. For details, see Bucket Policy Parameters.

6. Click Save.

• IAM Permissions Control
• Configuring a Bucket Policy

1. Log in to OBS Browser+.
2. Select the bucket you want and choose More > Bucket Policy. The window shown in Figure 1 is displayed.
   Figure 1 Configuring a bucket policy
   

3. Enter a bucket policy in the following format.
   1. Grant permissions to an account. In the following example, the account with ID 783fc6652cf246c096ea836694f71855 is granted permission to obtain log management information for bucket logging.bucket3.

      {
          "Statement": [
              {
                  "Sid": "testing",
                  "Effect": "Allow",
                  "Principal": {
                      "ID": [
                          "domain/783fc6652cf246c096ea836694f71855:user/*"
                      ]
                  },
                  "Action": [
                      "GetBucketLogging"
                  ],
                  "Resource": [
                      "logging.bucket3"
                  ]
              }
          ]
      }

      Table 2 describes the parameters that you need to manually modify in the example above:

      Table 2 Parameter changes

      Item to Modify	Description
      GetBucketLogging	Value of the Action field that indicates all OBS-supported actions in the policy. The value is a case-insensitive string. The value can contain a wildcard character (*), for example, "Action":["List*", "Get*"], to apply all actions to the resources. You need to change the value as needed. For the actions supported by OBS, see Bucket Actions.
      Allow	Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value must be Allow or Deny.
      logging.bucket3	The bucket on which the policy works. You can change the bucket name as needed.
      783fc6652cf246c096ea836694f71855	ID of an account. You can change it as needed. You can obtain the account ID on the bucket's Basic Information page.

   2. Grant permissions to an IAM user. In the following example, the user (whose ID is 71f3901173514e6988115ea2c26d1999) under the account (whose ID is 219d520ceac84c5a98b237431a2cf4c2) is assigned the permission required to set log management for bucket logging.bucket3.

      {
          "Statement": [
              {
                  "Sid": "testing",
                  "Effect": "Allow",
                  "Principal": {
                      "ID": [
                          "domain/219d520ceac84c5a98b237431a2cf4c2:user/71f3901173514e6988115ea2c26d1999"
                      ]
                  },
                  "Action": [
                      "PutBucketLogging"
                  ],
                  "Resource": [
                      "logging.bucket3"
                  ]
              }
          ]
      }

      Table 3 describes the parameters that you need to manually modify in the example above:

      Table 3 Parameter changes

      Item to Modify	Description
      PutBucketLogging	Value of the Action field that indicates all OBS-supported actions in the policy. The value is a case-insensitive string. The value can contain a wildcard character (*), for example, "Action":["List*", "Get*"], to apply all actions to the resources. You need to change the value as needed. For the actions supported by OBS, see Bucket Actions.
      Allow	Value of the Effect field that indicates whether the permission in the policy is allowed or denied. The value must be Allow or Deny.
      logging.bucket3	The bucket on which the policy works. You can change the bucket name as needed.
      219d520ceac84c5a98b237431a2cf4c2	ID of an account. You can change it as needed. You can click next to the target bucket to obtain the Account ID on the Basic Information page.
      71f3901173514e6988115ea2c26d1999	ID of a user under the account. You can change it as needed. You can choose My Credentials from the username in the upper right corner of OBS Console to obtain the IAM User ID.

   For details about bucket policy parameters, see Bucket Policy Parameters.

Command Line Structure

• Windows

  obsutil bucketpolicy obs://bucket -method=put -localfile=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

• macOS or Linux

  ./obsutil bucketpolicy obs://bucket -method=put -localfile=xxx [-config=xxx] [-e=xxx] [-i=xxx] [-k=xxx] [-t=xxx]

Examples

• In Windows, run obsutil bucketpolicy obs://bucket -method=put -localfile=d:\temp\policy.json to apply a policy to the bucket bucket using the policy.json file.

  obsutil bucketpolicy obs://bucket -method=put -localfile=d:\temp\policy.json
  
  Start at 2024-09-30 07:59:28.8675681 +0000 UTC
  
  Put bucketPolicy succeed, requestId is [04050000016836C5DA6FB21F14A2A0C0]

Parameter Description