对象存储服务 OBS

云服务在IAM预置了常用的权限，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。

除IAM服务外，Organizations服务中的服务控制策略（Service Control Policy，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。

SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM身份策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。

IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：IAM服务与Organizations服务权限访问控制的区别。

本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。

如何使用这些元素编辑IAM自定义身份策略，请参考创建自定义身份策略。
如何使用这些元素编辑SCP自定义策略，请参考创建SCP。

操作（Action）

操作（Action）即为身份策略中支持的授权项。

“访问级别”列描述如何对操作进行分类（List、Read和Write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
“资源类型”列指每个操作是否支持资源级权限。
- 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在身份策略语句的Resource元素中指定所有资源类型（“*”）。
- 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。
- 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。
关于OBS定义的资源类型的详细信息请参见资源类型（Resource）。
“条件键”列包括了可以在身份策略语句的Condition元素中支持指定的键值。
- 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
- 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
- 如果此列条件键没有值（-），表示此操作不支持指定条件键。
关于OBS定义的条件键的详细信息请参见条件（Condition）。
“别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见身份策略兼容性说明。

您可以在身份策略语句的Action元素中指定以下OBS的相关操作。

表1 OBS支持的授权项
授权项	描述	访问级别	资源类型（*为必须）	条件键	别名
obs:object:abortMultipartUpload	授予取消多段上传任务的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:abortMultipartUpload	授予取消多段上传任务的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:deleteObject	授予删除非指定版本对象的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:deleteObject	授予删除非指定版本对象的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:deleteObjectTagging	授予删除对象标签的权限。	Tagging	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:object:deleteObjectTagging	授予删除对象标签的权限。	Tagging	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:deleteObjectVersionTagging	授予删除指定对象版本标签的权限。	Tagging	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key> obs:versionId	-
obs:object:deleteObjectVersionTagging	授予删除指定对象版本标签的权限。	Tagging	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:deleteObjectVersion	授予删除指定版本对象的权限。	Write	object *	obs:versionId g:EnterpriseProjectId	-
obs:object:deleteObjectVersion	授予删除指定版本对象的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObject	授予下载非指定版本对象的权限。	Read	object *	g:EnterpriseProjectId	-
obs:object:getObject	授予下载非指定版本对象的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectTagging	授予下载对象标签的权限。	Read	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:object:getObjectTagging	授予下载对象标签的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectVersionTagging	授予下载指定对象版本标签的权限。	Read	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key> obs:versionId	-
obs:object:getObjectVersionTagging	授予下载指定对象版本标签的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectAcl	授予不指定版本获取对象的ACL的权限。	Read	object *	g:EnterpriseProjectId	-
obs:object:getObjectAcl	授予不指定版本获取对象的ACL的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectRetention	授予获取对象保留配置的权限。	Read	object *	g:EnterpriseProjectId	-
obs:object:getObjectRetention	授予获取对象保留配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectVersion	授予下载指定版本对象的权限。	Read	object *	g:EnterpriseProjectId obs:versionId	-
obs:object:getObjectVersion	授予下载指定版本对象的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:getObjectVersionAcl	授予获取指定版本对象的ACL的权限。	Read	object *	obs:versionId g:EnterpriseProjectId	-
obs:object:getObjectVersionAcl	授予获取指定版本对象的ACL的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:listMultipartUploadParts	授予获取一个多段上传任务所属的所有段信息的权限。	List	object *	g:EnterpriseProjectId	-
obs:object:listMultipartUploadParts	授予获取一个多段上传任务所属的所有段信息的权限。	List	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:modifyObjectMetadata	授予修改、删除或添加桶中已经上传的对象元数据的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:modifyObjectMetadata	授予修改、删除或添加桶中已经上传的对象元数据的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:putObject	授予上传对象的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:putObject	授予上传对象的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:x-obs-acl obs:x-obs-copy-source obs:x-obs-metadata-directive obs:x-obs-server-side-encryption	-
obs:object:putObjectTagging	授予上传对象标签的权限。	Tagging	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:object:putObjectTagging	授予上传对象标签的权限。	Tagging	-	g:RequestTag/<tag-key> g:TagKeys obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:putObjectVersionTagging	授予上传指定对象版本标签的权限。	Tagging	object *	g:EnterpriseProjectId g:ResourceTag/<tag-key> obs:versionId	-
obs:object:putObjectVersionTagging	授予上传指定对象版本标签的权限。	Tagging	-	g:RequestTag/<tag-key> g:TagKeys obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:putObjectAcl	授予设置或修改非指定版本对象ACL的权限。	Permission_management	object *	g:EnterpriseProjectId	-
obs:object:putObjectAcl	授予设置或修改非指定版本对象ACL的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:x-obs-acl	-
obs:object:putObjectRetention	授予设置对象保留配置的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:putObjectRetention	授予设置对象保留配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:object:putObjectVersionAcl	授予设置或修改指定版本对象ACL的权限。	Permission_management	object *	obs:versionId g:EnterpriseProjectId	-
obs:object:putObjectVersionAcl	授予设置或修改指定版本对象ACL的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:x-obs-acl	-
obs:object:restoreObject	授予恢复归档或深度归档对象的权限。	Write	object *	g:EnterpriseProjectId	-
obs:object:restoreObject	授予恢复归档或深度归档对象的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:createBucket	授予创建新桶的权限。	Write	bucket *	-	-
obs:bucket:createBucket	授予创建新桶的权限。	Write	-	g:EnterpriseProjectId obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:BucketEncrypted obs:x-obs-acl	-
obs:bucket:deleteBucket	授予删除桶的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucket	授予删除桶的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketCustomDomainConfiguration	授予删除桶的自定义域名的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketCustomDomainConfiguration	授予删除桶的自定义域名的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketInventoryConfiguration	授予删除桶的清单配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketInventoryConfiguration	授予删除桶的清单配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketPolicy	授予删除桶策略的权限。	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketPolicy	授予删除桶策略的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketTagging	授予删除桶标签的权限。	Tagging	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketTagging	授予删除桶标签的权限。	Tagging	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketWebsite	授予删除桶的网站配置信息的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketWebsite	授予删除桶的网站配置信息的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteDirectColdAccessConfiguration	授予删除桶的归档直读配置信息的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteDirectColdAccessConfiguration	授予删除桶的归档直读配置信息的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteReplicationConfiguration	授予删除桶的复制配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteReplicationConfiguration	授予删除桶的复制配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketAcl	授予获取桶ACL的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketAcl	授予获取桶ACL的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketObjectLockConfiguration	授予查询桶WORM默认保护策略和保护期限的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketObjectLockConfiguration	授予查询桶WORM默认保护策略和保护期限的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketCORS	授予查询桶的CORS配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketCORS	授予查询桶的CORS配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketCustomDomainConfiguration	授予查询桶的自定义域名的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketCustomDomainConfiguration	授予查询桶的自定义域名的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketInventoryConfiguration	授予查询桶的清单配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketInventoryConfiguration	授予查询桶的清单配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketLocation	授予查询桶区域位置信息的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketLocation	授予查询桶区域位置信息的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketLogging	授予查询桶的日志管理配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketLogging	授予查询桶的日志管理配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketPolicy	授予获取桶策略的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketPolicy	授予获取桶策略的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketQuota	授予获取桶空间配额。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketQuota	授予获取桶空间配额。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketStorage	授予查询桶对象个数及对象占用空间的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketStorage	授予查询桶对象个数及对象占用空间的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketStoragePolicy	授予获取桶的默认存储类型信息。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketStoragePolicy	授予获取桶的默认存储类型信息。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketTagging	授予获取桶的标签的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketTagging	授予获取桶的标签的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketVersioning	授予获取桶的多版本状态的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketVersioning	授予获取桶的多版本状态的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketWebsite	授予获取桶设置的网站配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketWebsite	授予获取桶设置的网站配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getDirectColdAccessConfiguration	授予获取指定桶的归档对象状态的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getDirectColdAccessConfiguration	授予获取指定桶的归档对象状态的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getEncryptionConfiguration	授予获取桶的加密配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getEncryptionConfiguration	授予获取桶的加密配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getLifecycleConfiguration	授予获取桶的生命周期配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getLifecycleConfiguration	授予获取桶的生命周期配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getReplicationConfiguration	授予获取桶的跨区域复制配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getReplicationConfiguration	授予获取桶的跨区域复制配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:headBucket	授予获取桶元数据的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:headBucket	授予获取桶元数据的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:listAllMyBuckets	授予查询创建的桶列表的权限。	List	bucket *	-	-
obs:bucket:listAllMyBuckets	授予查询创建的桶列表的权限。	List	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:listBucket	授予获取桶内对象列表的权限。	List	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:listBucket	授予获取桶内对象列表的权限。	List	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:prefix obs:delimiter obs:max-keys	-
obs:bucket:listBucketMultipartUploads	授予列举桶中已初始化多段任务的权限。	List	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:listBucketMultipartUploads	授予列举桶中已初始化多段任务的权限。	List	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:listBucketVersions	授予获取桶内多版本对象列表的权限。	List	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:listBucketVersions	授予获取桶内多版本对象列表的权限。	List	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:prefix obs:delimiter obs:max-keys	-
obs:bucket:putBucketAcl	授予设置桶ACL的权限。	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketAcl	授予设置桶ACL的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:x-obs-acl	-
obs:bucket:putBucketCORS	授予设置桶的CORS配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketCORS	授予设置桶的CORS配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketCustomDomainConfiguration	授予设置桶的自定义域名的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketCustomDomainConfiguration	授予设置桶的自定义域名的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketObjectLockConfiguration	授予设置桶级默认WORM策略的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketObjectLockConfiguration	授予设置桶级默认WORM策略的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketInventoryConfiguration	授予设置桶清单规则的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketInventoryConfiguration	授予设置桶清单规则的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketLogging	授予设置桶的日志管理配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketLogging	授予设置桶的日志管理配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketPolicy	授予设置桶策略的权限。	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketPolicy	授予设置桶策略的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketQuota	授予设置桶配额的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketQuota	授予设置桶配额的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketStoragePolicy	授予设置桶默认存储类型的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketStoragePolicy	授予设置桶默认存储类型的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketTagging	授予设置桶标签的权限。	Tagging	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketTagging	授予设置桶标签的权限。	Tagging	-	g:RequestTag/<tag-key> g:TagKeys obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketVersioning	授予设置桶的多版本状态的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketVersioning	授予设置桶的多版本状态的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketWebsite	授予设置桶的网站配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketWebsite	授予设置桶的网站配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putDirectColdAccessConfiguration	授予设置桶归档对象直读策略的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putDirectColdAccessConfiguration	授予设置桶归档对象直读策略的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putEncryptionConfiguration	授予设置桶的加密配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putEncryptionConfiguration	授予设置桶的加密配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain obs:BucketEncrypted	-
obs:bucket:putLifecycleConfiguration	授予设置桶的生命周期配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putLifecycleConfiguration	授予设置桶的生命周期配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putReplicationConfiguration	授予设置桶的跨区域复制配置的权限。	Write	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putReplicationConfiguration	授予设置桶的跨区域复制配置的权限。	Write	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketPublicAccessBlock	授予获取桶BPA配置的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketPublicAccessBlock	授予获取桶BPA配置的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:putBucketPublicAccessBlock	授予设置桶BPA配置的权限。	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:putBucketPublicAccessBlock	授予设置桶BPA配置的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:deleteBucketPublicAccessBlock	授予删除桶BPA配置的权限。	Permission_management	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:deleteBucketPublicAccessBlock	授予删除桶BPA配置的权限。	Permission_management	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketPolicyPublicStatus	授予获取桶策略公开状态的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketPolicyPublicStatus	授予获取桶策略公开状态的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-
obs:bucket:getBucketPublicStatus	授予获取桶公开状态的权限。	Read	bucket *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
obs:bucket:getBucketPublicStatus	授予获取桶公开状态的权限。	Read	-	obs:EpochTime obs:SourceIp obs:TlsVersion obs:CustomDomain	-

OBS的API通常对应着一个或多个授权项。表2展示了API与授权项的关系，以及该API需要依赖的授权项。

表2 API与授权项的关系
API	对应的授权项	依赖的授权项
PUT /?replication	obs:bucket:putReplicationConfiguration	-
GET /?replication	obs:bucket:getReplicationConfiguration	-
DELETE /?replication	obs:bucket:deleteReplicationConfiguration	-
PUT /ObjectName?acl	obs:object:putObjectAcl	-
PUT /ObjectName?acl	obs:object:putObjectVersionAcl	-
GET /ObjectName?acl	obs:object:getObjectAcl	-
GET /ObjectName?acl	obs:object:getObjectVersionAcl	-
PUT /ObjectName?metadata	obs:object:modifyObjectMetadata	-
POST /	obs:object:putObject	kms:cmk:create kms:cmk:list kms:cmk:createDataKey functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
PUT /ObjectName	obs:object:putObject	kms:cmk:create kms:cmk:list kms:cmk:createDataKey functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
PUT /objectname?tagging&versionId=versionid	obs:object:putObjectTagging	-
PUT /objectName?tagging&versionId	obs:object:putObjectVersionTagging	-
GET /ObjectName	obs:object:getObject	kms:cmk:create kms:cmk:list kms:cmk:decryptDataKey
GET /objectname?tagging&versionId=versionid	obs:object:getObjectTagging	-
GET /objectName?tagging&versionId	obs:object:getObjectVersionTagging	-
GET /ObjectName	obs:object:getObjectVersion	kms:cmk:create kms:cmk:list kms:cmk:decryptDataKey
HEAD /ObjectName	obs:object:getObject	obs:object:getObjectRetention
HEAD /ObjectName	obs:object:getObjectVersion	obs:object:getObjectRetention
DELETE /ObjectName	obs:object:deleteObject	functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
DELETE /objectname?tagging&versionId=versionid	obs:object:deleteObjectTagging	-
DELETE /objectName?tagging&versionId	obs:object:deleteObjectVersionTagging	-
DELETE /ObjectName	obs:object:deleteObjectVersion	functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
POST /ObjectName?uploads	obs:object:putObject	kms:cmk:create kms:cmk:list kms:cmk:createDataKey
GET /?uploads&max-uploads=max	obs:bucket:listBucketMultipartUploads	-
PUT /ObjectName?partNumber=partNum&uploadId=uploadID	obs:object:putObject	kms:cmk:createDataKey kms:cmk:decryptDataKey
GET /ObjectName?uploadId=uploadid&max-parts=max&part-number-marker=marker	obs:object:listMultipartUploadParts	-
DELETE /ObjectName?uploadId=uplaodID	obs:object:abortMultipartUpload	-
POST /ObjectName?uploadId=uploadID	obs:object:putObject	functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
PUT /?website	obs:bucket:putBucketWebsite	-
GET /?website	obs:bucket:getBucketWebsite	-
DELETE /?website	obs:bucket:deleteBucketWebsite	-
PUT /?cors	obs:bucket:putBucketCORS	-
GET /?cors	obs:bucket:getBucketCORS	-
DELETE /?cors	obs:bucket:putBucketCORS	-
PUT /?directcoldaccess	obs:bucket:putDirectColdAccessConfiguration	-
GET /?directcoldaccess	obs:bucket:getDirectColdAccessConfiguration	-
DELETE /?directcoldaccess	obs:bucket:deleteDirectColdAccessConfiguration	-
POST /ObjectName?restore&versionId=VersionID	obs:object:restoreObject	-
PUT /?quota	obs:bucket:putBucketQuota	-
GET /?quota	obs:bucket:getBucketQuota	-
PUT /?lifecycle	obs:bucket:putLifecycleConfiguration	-
DELETE /?lifecycle	obs:bucket:putLifecycleConfiguration	-
GET /?lifecycle	obs:bucket:getLifecycleConfiguration	-
PUT /?acl	obs:bucket:putBucketAcl	-
GET /?acl	obs:bucket:getBucketAcl	-
PUT /?logging	obs:bucket:putBucketLogging	-
GET /?logging	obs:bucket:getBucketLogging	-
PUT /?tagging	obs:bucket:putBucketTagging	-
GET /?tagging	obs:bucket:getBucketTagging	-
DELETE /?tagging	obs:bucket:deleteBucketTagging	-
PUT /?policy	obs:bucket:putBucketPolicy	-
GET /?policy	obs:bucket:getBucketPolicy	-
DELETE /?policy	obs:bucket:deleteBucketPolicy	-
GET /?storageinfo	obs:bucket:getBucketStorage	-
PUT /	obs:bucket:createBucket	-
DELETE /	obs:bucket:deleteBucket	-
HEAD /	obs:bucket:headBucket	-
GET /	obs:bucket:listBucket	-
GET /?location	obs:bucket:getBucketLocation	-
PUT /?versioning	obs:bucket:putBucketVersioning	-
GET /?versioning	obs:bucket:getBucketVersioning	-
GET /	obs:bucket:listBucketVersions	-
PUT /?encryption	obs:bucket:putEncryptionConfiguration	kms:cmk:get
GET /?encryption	obs:bucket:getEncryptionConfiguration	-
DELETE /?encryption	obs:bucket:putEncryptionConfiguration	-
PUT /?inventory&id=configuration-id	obs:bucket:putBucketInventoryConfiguration	-
GET /?inventory&id=configuration-id	obs:bucket:getBucketInventoryConfiguration	-
GET /?inventory	obs:bucket:getBucketInventoryConfiguration	-
DELETE /?inventory&id=configuration-id	obs:bucket:deleteBucketInventoryConfiguration	-
PUT /?storageClass	obs:bucket:putBucketStoragePolicy	-
GET /?storageClass	obs:bucket:getBucketStoragePolicy	-
PUT /?customdomain=domainname	obs:bucket:putBucketCustomDomainConfiguration	-
GET /?customdomain	obs:bucket:getBucketCustomDomainConfiguration	-
DELETE /?customdomain=domainname	obs:bucket:deleteBucketCustomDomainConfiguration	-
PUT /?object-lock	obs:bucket:putBucketObjectLockConfiguration	-
GET /?object-lock	obs:bucket:getBucketObjectLockConfiguration	-
PUT /ObjectName?retention&versionId=versionid	obs:object:putObjectRetention	-
PUT /ObjectName?partNumber=partNum&uploadId=UploadID	obs:object:putObject	obs:object:getObject kms:cmk:create kms:cmk:list kms:cmk:createDataKey kms:cmk:decryptDataKey
POST /?delete	obs:object:deleteObject	functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
PUT /destinationObjectName	obs:object:putObject	obs:object:getObject kms:cmk:create kms:cmk:list kms:cmk:createDataKey kms:cmk:decryptDataKey functiongraph:function:invokeAsync functiongraph:workflow:invoke smn:topic:publish
GET /	obs:bucket:listAllMyBuckets	-
PUT /ObjectName?truncate&length=Length	obs:object:putObject	-
POST /ObjectName?append&position=Position	obs:object:putObject	kms:cmk:create kms:cmk:list kms:cmk:createDataKey kms:cmk:decryptDataKey
PUT /ObjectName?modify&position=Position	obs:object:putObject	-
POST /ObjectName?name=Name&rename	obs:object:getObject	obs:object:putObject
GET /?publicAccessBlock	obs:bucket:getBucketPublicAccessBlock	-
PUT /?publicAccessBlock	obs:bucket:putBucketPublicAccessBlock	-
DELETE /?publicAccessBlock	obs:bucket:deleteBucketPublicAccessBlock	-
GET /?policyStatus	obs:bucket:getBucketPolicyPublicStatus	-
GET /?bucketStatus	obs:bucket:getBucketPublicStatus	-

资源类型（Resource）

资源类型（Resource）表示身份策略所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的身份策略语句中指定该资源的URN，身份策略仅作用于此资源；如未指定，Resource默认为“*”，则身份策略将应用到所有资源。您也可以在身份策略中设置条件，从而指定资源类型。

OBS定义了以下可以在自定义身份策略的Resource元素中使用的资源类型。

表3 OBS支持的资源类型
资源类型	URN
bucket	obs:::bucket:<bucket-name>
object	obs:::object:<bucket-name>/<object-name>

条件（Condition）

条件键概述

条件（Condition）是身份策略生效的特定条件，包括条件键和运算符。

条件键表示身份策略语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。
- 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：全局条件键。
- 服务级条件键（前缀通常为服务缩写，如obs:）仅适用于对应服务的操作，详情请参见表4。
- 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。
运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：运算符。

OBS支持的服务级条件键

OBS定义了以下可以在自定义身份策略的Condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。

表4 OBS支持的服务级条件键
服务级条件键	类型	单值/多值	说明
obs:versionId	string	单值	根据对象版本号过滤请求。
obs:prefix	string	单值	根据列举对象的前缀过滤请求。
obs:delimiter	string	单值	根据分组桶内对象的字符串过滤请求。
obs:max-keys	numeric	单值	根据最大返回的对象数过滤请求，返回按照字典顺序的最多前max-keys个对象。
obs:x-obs-acl	string	单值	根据头域携带的ACL过滤请求, 取值范围为private\|public-read\|public-read-write\|bucketowner-read\|bucket-owner-full-control\|log-delivery-write。
obs:x-obs-copy-source	string	单值	根据复制对象时可操作的源桶名以及源对象名过滤请求, 格式为/bucketname/keyname。
obs:x-obs-metadata-directive	string	单值	根据新对象的元数据是从源对象中复制或使用请求中的元数据替换过滤请求，取值范围为COPY\|REPLACE。
obs:x-obs-server-side-encryption	string	单值	根据桶中对象是否加密存储过滤请求，取值为kms。
obs:SourceIp	ip_address	单值	根据x-forward-for头域中的首个IP或请求发起的源IP过滤请求。
obs:EpochTime	numeric	单值	根据服务器接收请求的时间过滤请求，格式为从1970.01.01 00:00:00 UTC开始所经过的秒数，不考虑闰秒。
obs:BucketEncrypted	boolean	单值	根据创桶、设置桶加密、删除桶加密后桶的加密状态过滤请求。
obs:TlsVersion	numeric	单值	根据客户端发起请求使用的TLS协议版本过滤请求。
obs:CustomDomain	boolean	单值	根据客户端发起请求是否使用自定义域名来过滤请求。