# Permissions Management

You can use Identity and Access Management (IAM) to manage OBS permissions and control access to your resources. IAM provides identity authentication, permissions management, and access control.

You can create IAM users for your employees, and assign permissions to these users on a principle of least privilege (PoLP) basis to control their access to specific resource types. For example, you can create IAM users for software developers and assign specific permissions to allow them to use OBS resources but prevent them from being able to delete resources or perform any high-risk operations.

If your account does not require individual IAM users for permissions management, skip this section.

#### OBS Permissions

By default, new IAM users do not have any permissions assigned. To assign permissions to these new users, add them to one or more groups, and attach permissions policies to these groups. IAM provides preset system policies that define common permissions for different services, such as full control access and read-only. You can directly use these preset policies.

OBS is a global service deployed and accessed without specifying any physical region. OBS permissions are assigned to users in the global project, and users do not need to switch regions when accessing OBS.

RBAC policy: An RBAC policy consists of permissions for an entire service. Users in a group with such a policy assigned are granted all the required permissions, including permissions for accessing and managing that service. RBAC policies do not support operation-specific permission control.

Due to data caching, an RBAC policy involving OBS actions will take effect 10 to 15 minutes after it is attached to a user and user group.

Table 1 lists all system policies of OBS.

Table 1 OBS system policies
Policy | Description | Policy Type
--- | --- | ---
Tenant Administrator | Operation permissions: any operation on all cloud resources owned by the account OBS policies are configured under Global service > OBS. | RBAC policy
Tenant Guest | Operation permissions: read-only access permission to all cloud resources owned by the account OBS policies are configured under Global service > OBS. | RBAC policy
OBS Buckets Viewer | Operation permissions: listing buckets, obtaining basic bucket information, obtaining bucket metadata information, and listing objects OBS policies are configured under Global service > OBS. | RBAC policy

The following table lists operations that can be performed under each set of OBS permission.

Table 2 Permissions and the allowed operations on OBS resources
Operation | Tenant Administrator | Tenant Guest | OBS Buckets Viewer
--- | --- | --- | ---
Listing buckets | Yes | Yes | Yes
Creating buckets | Yes | No | No
Deleting buckets | Yes | No | No
Obtaining basic bucket information | Yes | Yes | Yes NOTE: The statistics of used storage space and number of objects cannot be obtained.
Controlling bucket access | Yes | No | No
Managing bucket policies | Yes | No | No
Modifying bucket storage classes | Yes | No | No
Listing objects | Yes | Yes | Yes
Listing objects with multiple versions | Yes | Yes | No
Uploading files | Yes | No | No
Creating folders | Yes | No | No
Deleting files | Yes | No | No
Deleting folders | Yes | No | No
Downloading files | Yes | Yes | No
Deleting files with multiple versions | Yes | No | No
Downloading files with multiple versions | Yes | Yes | No
Modifying object storage classes | Yes | No | No
Restoring files | Yes | No | No
Canceling the deletion of files | Yes | No | No
Deleting fragments | Yes | No | No
Controlling object access | Yes | No | No
Configuring object metadata | Yes | No | No
Obtaining object metadata | Yes | Yes | No
Managing versioning | Yes | No | No
Managing logging | Yes | No | No
Managing event notifications | Yes | No | No
Managing tags | Yes | No | No
Managing lifecycle rules | Yes | No | No
Managing static website hosting | Yes | No | No
Managing CORS rules | Yes | No | No
Managing URL validation | Yes | No | No
Managing domain names | Yes | No | No
Configuring object ACL | Yes | No | No
Configuring the ACL for an object of a specified version | Yes | No | No
Obtaining object ACL information | Yes | Yes | No
Obtaining the ACL information of a specified object version | Yes | Yes | No
Uploading in the multipart mode | Yes | No | No
Listing uploaded parts | Yes | Yes | No
Canceling multipart tasks | Yes | No | No

#### Managing OBS Resource Permissions

Access to OBS buckets and objects can be controlled by IAM user permissions, bucket policies, and ACLs.

For more information, see Overview.

Parent topic: Service Overview