Granting Other Accounts Permissions to Operate a Specific Bucket

The bucket owner (root account) or other accounts and IAM users, who have the permission to set bucket policies, can configure bucket policies to grant the bucket operation permissions to other accounts or IAM users under other accounts.

The following is an example about how to grant other accounts bucket access and object upload permissions.

Note

To grant permissions to IAM users under other accounts, you need to configure both bucket policies and IAM policies.

1. Configure a bucket policy to allow IAM users to access the bucket.

2. Configure IAM policies for the account where authorized IAM users belong, to allow the IAM users to access the bucket.

Only permissions that are allowed by both the bucket policy and IAM policies can take effect.

Procedure

1. In the bucket list, click the bucket you want to operate. The Overview page is displayed.

2. In the navigation pane, choose Permissions.

3. Choose Bucket Policies > Custom Bucket Policies.

4. Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.

5. Configure the parameters listed in the table below to grant other accounts bucket access permission.

   Table 1 Parameters for granting bucket access permission

   Parameter	Value
   Policy Mode	Customized
   Effect	Allow
   Principal	Include Cloud service user. Select Other account, and enter the account ID and user ID. For Account ID, enter the Domain ID that can be found on the My Credential page.
   Resources	Include Leave it blank.
   Actions	Include ListBucket

6. Click OK.

7. Click Create Bucket Policy. The Create Bucket Policy dialog box is displayed.

8. Configure the parameters listed in the table below to grant other accounts the object upload permission:

   Note

   Before granting this permission to a user, ensure that the user has the permission to access the bucket.

   Table 2 Parameters for granting permission to upload objects

   Parameter	Value
   Policy Mode	Customized
   Effect	Allow
   Principal	Include Cloud service user. Select Other account, and enter the account ID and user ID. For Account ID, enter the Domain ID that can be found on the My Credential page.
   Resources	Include Resource name: *
   Actions	Include PutObject

9. Click OK.

last updated: 2024-04-24 02:20