Help Center/ Object Storage Service/ User Guide/ Permissions Control/ Configuring a Bucket Policy/ Creating a Bucket Policy with a Template
Updated on 2026-11-02 GMT+08:00
View PDF
Share

Creating a Bucket Policy with a Template

OBS Console offers bucket policy templates for common scenarios. You can use the templates to quickly configure bucket policies.

Ways to Configure Bucket Policies

You can use templates to create bucket policies using OBS Console, but not using APIs, SDKs, OBS Browser+, or obsutil.

Using OBS Console

  1. In the navigation pane of OBS Console, choose Buckets.
  2. In the bucket list, click the desired bucket. The Objects page is displayed.
  3. In the navigation pane, choose Permissions > Bucket Policies.
  4. Click Create.
  5. Choose a policy template. For details about the parameters, see Bucket Policies.

    Figure 1 Choosing the Public Read template
    Figure 2 Choosing the Public Read/Write template
    Figure 3 Choosing the Bucket Read-Only template
    Figure 4 Choosing the Bucket Read/Write template
    Figure 5 Choosing the Directory Read-Only template
    Figure 6 Choosing the Directory Read/Write template
    Figure 7 Choosing the Object Read-Only template
    Figure 8 Choosing the Object Read/Write template
    Table 1 Bucket policy templates

    Principal

    Resource

    Template

    Actions Allowed

    Advanced Settings

    All accounts

    Entire bucket (including the objects in it)

    Public Read

    See Figure 1.

    Allows anonymous users to perform the following actions on a bucket and the objects in it:

    HeadBucket (to check whether the bucket exists and obtain the bucket metadata)

    GetBucketLocation (to get the bucket location)

    GetObject (to obtain object content and metadata)

    RestoreObject (to restore Archive objects)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    Excluding the specified actions is not allowed.

    Public Read/Write

    See Figure 2.

    Allows anonymous users to perform the following actions on a bucket and the objects in it:

    ListBucket (to list objects in the bucket and obtain the bucket metadata)

    ListBucketVersions (to list object versions in the bucket)

    HeadBucket (to check whether the bucket exists and obtain the bucket metadata)

    GetBucketLocation (to get the bucket location)

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    ModifyObjectMetaData (to modify object metadata)

    ListBucketMultipartUploads (to list multipart uploads)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    RestoreObject (to restore Archive objects)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    PutObjectAcl (to configure the object ACL)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    Excluding the specified actions is not allowed.

    Current account/Other accounts/Delegated accounts

    Entire bucket (including the objects in it)

    Bucket Read-Only

    See Figure 3.

    Allows specified accounts to perform the following actions on a bucket and the objects in it:

    Get* (all GET actions)

    List* (all LIST actions)

    HeadBucket (to check whether the bucket exists and obtain the bucket metadata)

    Excluding the specified actions is not allowed.

    Bucket Read/Write

    See Figure 4.

    Allows specified accounts to perform all actions excluding the following ones on a bucket and the objects in it:

    DeleteBucket (to delete the bucket)

    PutBucketPolicy (to configure a bucket policy)

    PutBucketAcl (to configure the bucket ACL)

    Excluding the specified actions is allowed.

    All accounts/Current account/Other accounts/Delegated accounts

    Current bucket + Specified objects

    Directory Read-Only

    See Figure 5.

    Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it:

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    RestoreObject (to restore Archive objects)

    ListBucket (to list objects in the bucket and obtain the bucket metadata). This action is not included in the template if you apply the policy to All accounts.

    ListBucketVersions (to list object versions in the bucket). This action is not included in the template if you apply the policy to All accounts.

    HeadBucket (to check whether the bucket exists and obtain the bucket metadata)

    GetBucketLocation (to get the bucket location)

    Excluding the specified actions is not allowed.

    Directory Read/Write

    See Figure 6.

    Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it:

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    ModifyObjectMetaData (to modify object metadata)

    ListBucketMultipartUploads (to list multipart uploads)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    PutObjectAcl (to configure the object ACL)

    RestoreObject (to restore Archive objects)

    ListBucket (to list objects in the bucket and obtain the bucket metadata)

    ListBucketVersions (to list object versions in the bucket)

    HeadBucket (to check whether the bucket exists and obtain the bucket metadata)

    GetBucketLocation (to get the bucket location)

    Excluding the specified actions is not allowed.

    All accounts/Current account/Other accounts/Delegated accounts

    Specified objects

    Object Read-Only

    See Figure 7.

    Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket:

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    RestoreObject (to restore Archive objects)

    Excluding the specified actions is not allowed.

    Object Read/Write

    See Figure 8.

    Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket:

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    ModifyObjectMetaData (to modify object metadata)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    GetObjectVersionAcl (to obtain the ACL of an object version)

    GetObjectAcl (to obtain the object ACL)

    PutObjectAcl (to configure the object ACL)

    RestoreObject (to restore Archive objects)

    Excluding the specified actions is not allowed.

  6. Complete the bucket policy configuration.

    Some bucket policy templates require a configuration of principals or resources. You can also change the existing settings of a template, including the policy name, principals, resources, actions, and conditions. For details, see Bucket Policy Parameters.

  7. Click Create in the lower right corner.
Parent Topic: Configuring a Bucket Policy