Configuring a Custom Bucket Policy (Common Mode)¶
If you want to grant special permissions to specific users, you can configure custom bucket policies. If a standard bucket policy conflicts with a custom bucket policy, the authorization priority is given to the custom bucket policy and then the standard bucket policy.
This section describes how to configure a custom bucket policy in common mode (GUI).
Procedure¶
In the bucket list, click the bucket you want to operate. The Overview page is displayed.
In the navigation pane, choose Permissions.
On the Bucket Policies tab page, configure a custom bucket policy according to your needs.
On the right of Custom Bucket Policies, select Common mode to configure the policy in the GUI mode.
Click Create Bucket Policy. Select a proper policy mode as required. Valid values are as follows:
Read-only: The authorized user will have the read permission on the bucket and objects. For subsequent operations, see 5.
Read and write: The authorized user will have the read and write permissions on the bucket and objects. For subsequent operations, see 5.
Customized: The authorized user will have the customized permissions on the bucket and objects. For detailed configuration, see 6.
Note
Only one bucket policy mode can be configured at a time.
For the read-only and read and write modes, enter information about the authorized user in the following format and click OK.
Figure 1 Parameter settings of a custom bucket policy in the read-only or read and write mode¶
Table 1 Parameters in bucket policies¶ Parameter
Value
Description
Principal
Include or Exclude
Cloud service user, Federated user
If you select Federated user, you can specify the user to be an Identity provider or a User group.
Specifies users on whom this bucket policy takes effect, including cloud service users and federated users. A cloud service user is the one who accesses the cloud services through registration with the cloud services. A federated user is the one who accesses the cloud services through federated identity authentication.
Include: The policy applies to specified users.
Exclude: The policy applies to all users except the specified ones.
Resources
Include or Exclude
Input format:
Object: Object name
Object set: Object name prefix*, *Object name suffix, or *
Indicates the resource that a bucket policy applies to. With the read-only mode and read and write mode, the policy can only apply to objects.
Include: The policy takes effect on the specified OBS resources.
Exclude: The policy takes effect on all OBS resources except the specified ones.
For the customized mode, set parameters based on the site requirements and click OK.
Figure 2 Parameter settings of a custom bucket policy in the customized mode¶
Table 2 describes each parameter.
Table 2 Parameters for configuring a custom bucket policy¶ Parameter
Value
Description
Effect
Allow or Deny
Effect of a bucket policy.
Allow: The policy allows the matched requests.
Deny: The policy denies the matched requests.
Principal
Include or Exclude
Cloud service user, Federated user
If you select Federated user, you can specify the user to be an Identity provider or a User group.
Specifies users on whom this bucket policy takes effect, including cloud service users and federated users. A cloud service user is the one who accesses the cloud services through registration with the cloud services. A federated user is the one who accesses the cloud services through federated identity authentication.
Include: The policy applies to specified users.
Exclude: The policy applies to all users except the specified ones.
Resources
Include or Exclude
Resource input format:
Object: Object name
Object set: Object name prefix*, *Object name suffix, or *
Blank: Indicates that the resource is the entire bucket.
Indicates the resource that a bucket policy applies to.
Include: The policy takes effect on the specified OBS resources.
Exclude: The policy takes effect on all OBS resources except the specified ones.
Relationship between resource types and actions:
When a resource is an object or an object set, only the actions related to the object can be configured.
When the resource is a bucket, only the actions related to the bucket can be configured.
Actions
Include or Exclude
For details, see Actions.
Operations stated in the bucket policy.
Include: The policy applies to specified actions.
Exclude: The policy takes effect on all actions except the specified ones.
Conditions
Conditions under which the bucket policy takes effect