Configuring a Standard Bucket Policy

OBS Console provides bucket policy templates for multiple typical scenarios. You can use these templates to quickly configure bucket policies.

Procedure

  1. In the bucket list, click the bucket you want to operate to go to the Objects page.
  2. In the navigation pane, choose Permissions > Bucket Policies.
  3. Click Create.
  4. Choose a policy template. For details about the parameters, see Bucket Policies and Object Policies.

    Figure 1 Choosing the Public Read template
    Figure 2 Choosing the Public Read/Write template
    Figure 3 Choosing the Bucket Read-Only template
    Figure 4 Choosing the Bucket Read/Write template
    Figure 5 Choosing the Directory Read-Only template
    Figure 6 Choosing the Directory Read/Write template
    Figure 7 Choosing the Object Read-Only template
    Figure 8 Choosing the Object Read/Write template
    Table 1 Bucket policy templates

    Principal

    Resource

    Template

    Actions Allowed

    Advanced Settings

    All accounts

    Entire bucket (including the objects in it)

    Public Read

    Allows anonymous users to perform the following actions on a bucket and the objects in it:

    GetBucketLocation (to get the bucket location)

    GetObject (to obtain object content and metadata)

    RestoreObject (to restore objects from Cold storage)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    Excluding the specified actions is not allowed.

    Public Read/Write

    Allows anonymous users to perform the following actions on a bucket and the objects in it:

    ListBucket (to list objects in the bucket and obtain the bucket metadata)

    ListBucketVersions (to list object versions in the bucket)

    GetBucketLocation (to get the bucket location)

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    ModifyObjectMetaData (to modify object metadata)

    ListBucketMultipartUploads (to list multipart uploads)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    RestoreObject (to restore objects from Cold storage)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    PutObjectAcl (to configure the object ACL)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    Excluding the specified actions is not allowed.

    Current account/Other accounts/Delegated accounts/Federated user

    Entire bucket (including the objects in it)

    Bucket Read-Only

    Allows specified accounts to perform the following actions on a bucket and the objects in it:

    Get* (all GET actions)

    List* (all LIST actions)

    Excluding the specified actions is not allowed.

    Bucket Read/Write

    Allows specified accounts to perform all actions excluding the following ones on a bucket and the objects in it:

    DeleteBucket (to delete the bucket)

    PutBucketPolicy (to configure a bucket policy)

    PutBucketAcl (to configure the bucket ACL)

    The specified actions are excluded.

    All accounts/Current account/Other accounts/Delegated accounts/Federated user

    Current bucket + Specified objects

    Directory Read-Only

    Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it:

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    RestoreObject (to restore objects from Cold storage)

    ListBucket (to list objects in the bucket and obtain the bucket metadata)

    ListBucketVersions (to list object versions in the bucket)

    GetBucketLocation (to get the bucket location)

    NOTE:

    If you apply the policy to All accounts, ListBucket and ListBucketVersions are not included in the template.

    Excluding the specified actions is not allowed.

    Directory Read/Write

    Allows all accounts or specified accounts to perform the following actions on the current bucket and the specified resources in it:

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    ModifyObjectMetaData (to modify object metadata)

    ListBucketMultipartUploads (to list multipart uploads)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    PutObjectAcl (to configure the object ACL)

    RestoreObject (to restore objects from Cold storage)

    ListBucket (to list objects in the bucket and obtain the bucket metadata)

    ListBucketVersions (to list object versions in the bucket)

    GetBucketLocation (to get the bucket location)

    Excluding the specified actions is not allowed.

    All accounts/Current account/Other accounts/Delegated accounts/Federated user

    Specified objects

    Object Read-Only

    Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket:

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    GetObjectVersionAcl (to obtain the ACL of a specified object version)

    GetObjectAcl (to obtain the object ACL)

    RestoreObject (to restore objects from Cold storage)

    Excluding the specified actions is not allowed.

    Object Read/Write

    Allows all accounts or specified accounts to perform the following actions on specified resources in the bucket:

    PutObject (to upload objects using PUT and POST, upload parts, initiate multipart uploads, and assemble parts)

    GetObject (to obtain object content and metadata)

    GetObjectVersion (to obtain the content and metadata of a specified object version)

    ModifyObjectMetaData (to modify object metadata)

    ListMultipartUploadParts (to list uploaded parts)

    AbortMultipartUpload (to abort multipart uploads)

    GetObjectVersionAcl (to obtain the ACL of an object version)

    GetObjectAcl (to obtain the object ACL)

    PutObjectAcl (to configure the object ACL)

    RestoreObject (to restore objects from Cold storage)

    Excluding the specified actions is not allowed.

  5. Complete the bucket policy configuration.

    Some bucket policy templates require a configuration of principals or resources. You can also change the existing settings of a template, including the policy name, principals, resources, actions, and conditions. For details, see Bucket Policy Parameters.

  6. Click Create in the lower right corner.
Parent topic: Configuring a Bucket Policy