Permissions Management¶
You can use Identity and Access Management (IAM) to manage OBS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.
You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use OBS resources but prevent them from being able to delete resources or perform any high-risk operations.
If your account does not require individual IAM users for permissions management, skip this section.
IAM is a free service. You only pay for the resources in your account. For more information about IAM, see section "Service Overview" in the Identity and Access Management User Guide.
OBS Permissions¶
By default, new IAM users do not have any permissions assigned. You can assign permissions to these users by adding them to one or more groups and attaching policies to the groups. IAM provides preset system policies that define common permissions for different services, such as full control access and read-only. You can directly use these preset policies.
OBS is a global service deployed and accessed without specifying any physical region. OBS permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.
RBAC policy: An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all the required permissions, including permissions for accessing and managing that service. RBAC policies do not support operation-specific permission control.
Note
Due to data caching, an RBAC policy or a fine-grained policy involving OBS actions will take effect 10 to 15 minutes after it is attached to a user or a user group.
Table 1 lists all system policies of OBS.
Policy | Description | Policy Type |
|---|---|---|
Tenant Administrator | Allows you to perform any operation on all cloud resources under the account. OBS policies are configured under Global service > OBS. | RBAC policy |
Tenant Guest | Allows you to perform read-only operations on all cloud resources under the account. OBS policies are configured under Global service > OBS. | RBAC policy |
OBS Buckets Viewer | Allows you to list buckets, obtain basic bucket information and bucket metadata, and list objects. OBS policies are configured under Global service > OBS. | RBAC policy |
OBS Viewer | Allows you to list buckets, obtain basic bucket information and bucket metadata, and list objects. This policy is a system-defined policy of fine-grained authorization. Users with fine-grained authorization can use this policy and can create custom policy template based on this policy. OBS policies are configured under Global service > OBS. | Fine-grained policy |
OBS Operator | Allows you to perform all operations defined in OBS Viewer and to perform basic object operations, such as uploading objects, downloading objects, deleting objects, and obtaining object ACLs. This policy is a system-defined policy of fine-grained authorization. Users with fine-grained authorization can use this policy and can create custom policy template based on this policy. OBS policies are configured under Global service > OBS. | Fine-grained policy |
The following table lists operations that can be performed under each set of OBS permission.
Operation | Tenant Administrator | Tenant Guest | OBS Administrator | OBS Buckets Viewer | OBS ReadOnlyAccess | OBS OperateAccess |
|---|---|---|---|---|---|---|
Listing buckets | Supported | Supported | Supported | Supported | Supported | Supported |
Creating buckets | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Deleting buckets | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Obtaining basic bucket information | Supported | Supported | Supported | Supported Note The statistics of used storage space and number of objects cannot be obtained. | Supported Note The statistics of used storage space and number of objects cannot be obtained. | Supported Note The statistics of used storage space and number of objects cannot be obtained. |
Controlling bucket access | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing bucket policies | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Changing bucket storage classes | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Listing objects | Supported | Supported | Supported | Supported | Supported | Supported |
Listing objects with multiple versions | Supported | Supported | Supported | Not supported | Not supported | Not supported |
Uploading files | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Creating folders | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Deleting objects | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Deleting folders | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Downloading objects | Supported | Supported | Supported | Not supported | Not supported | Supported |
Deleting object versions | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Downloading object versions | Supported | Supported | Supported | Not supported | Not supported | Supported |
Changing object storage classes | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Restoring objects | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Undeleting objects | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Deleting fragments | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Controlling object access | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Configuring object metadata | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Obtaining object metadata | Supported | Supported | Supported | Not supported | Not supported | Supported |
Managing versioning | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing logging | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing event notifications | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing tags | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing lifecycle rules | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing static website hosting | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing CORS rules | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing URL validation | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing domain names | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Managing cross-region replication | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Configuring object ACL | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Configuring the ACL for an object version | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Obtaining object ACL information | Supported | Supported | Supported | Not supported | Not supported | Supported |
Obtaining the ACL of a specific object version | Supported | Supported | Supported | Not supported | Not supported | Supported |
Initiating a multipart upload | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Listing uploaded parts | Supported | Supported | Supported | Not supported | Not supported | Supported |
Canceling multipart uploads | Supported | Not supported | Supported | Not supported | Not supported | Supported |
Configuring requester-pays | Supported | Not supported | Supported | Not supported | Not supported | Not supported |
Obtaining the requester pays configuration | Supported | Supported | Supported | Not supported | Not supported | Not supported |
OBS Resource Permissions Management¶
Access to OBS buckets and objects can be controlled by IAM user permissions, bucket policies, and ACLs.
For more information, see Overview.