Bucket policies are resource-based authorization policies. Bucket owners can use bucket policies to authorize other users to access the specified resource in Object Storage Service (OSS). This topic describes how to run the bucket-policy command to add, modify, obtain, or delete bucket policies for a bucket.
Usage notes
Add or modify bucket policies
Before you add or modify bucket policies for a bucket, you must create a JSON file on your local device, and configure bucket policies in the JSON file. You can configure multiple bucket policies in a single JSON file. However, the total size of the bucket policies cannot exceed 16 KB.
When you add or modify bucket policies, ossutil reads bucket policies from the JSON file and adds the policies to the specified bucket. When you add bucket policies, existing bucket policies are overwritten.
- Command syntax
./ossutil64 bucket-policy --method put oss://bucketname local_json_file
The following table describes the parameters in the syntax.
Parameter Description bucketname The name of the bucket for which you want to add or modify bucket policies. local_json_file The name of the local JSON file in which you configure bucket policies. - Example
- Create a file named local_json_file on your local device and write different bucket
policies based on different scenarios.
The following examples show how to configure common bucket policies:
Note The following examples show how the bucket owner whose UID is174649585760****
in the Resource parameter configures bucket policies to grant different permissions to RAM users, such as the RAM user whose UID is20214760404935****
in the Principal parameter and the anonymous user*
.- Specify that only anonymous requests from the specified IP address are allowed to
access all resources in a bucket named examplebucket.
{ "Statement": [ { "Action": [ "oss:GetObject", "oss:GetObjectAcl", "oss:ListObjects", "oss:RestoreObject", "oss:GetVodPlaylist", "oss:ListObjectVersions", "oss:GetObjectVersion", "oss:GetObjectVersionAcl", "oss:RestoreObjectVersion" ], "Condition": { "IpAddress": { "acs:SourceIp": [ "10.10.10.10" ] } }, "Effect": "Allow", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket/*" ] }, { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Condition": { "StringLike": { "oss:Prefix": [ "*" ] }, "IpAddress": { "acs:SourceIp": [ "10.10.10.10" ] } }, "Effect": "Allow", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket" ] } ], "Version": "1" }
- Grant the specified Resource Access Management (RAM) user read-only permissions on
the
hangzhou/2020
andhangzhou/2015
directories in a bucket named examplebucket.{ "Statement": [ { "Action": [ "oss:GetObject", "oss:GetObjectAcl", "oss:ListObjects", "oss:RestoreObject", "oss:GetVodPlaylist", "oss:ListObjectVersions", "oss:GetObjectVersion", "oss:GetObjectVersionAcl", "oss:RestoreObjectVersion" ], "Effect": "Allow", "Principal": [ "20214760404935****" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket/hangzhou/2020/*", "acs:oss:*:174649585760****:examplebucket/hangzhou/2015/*" ] }, { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Condition": { "StringLike": { "oss:Prefix": [ "hangzhou/2020/*", "hangzhou/2015/*" ] } }, "Effect": "Allow", "Principal": [ "20214760404935****" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket" ] } ], "Version": "1" }
- Reject anonymous requests to all the objects in the
hangzhou/2021/
directory of a bucket named examplebucket.{ "Statement": [ { "Action": [ "oss:RestoreObject", "oss:ListObjects", "oss:AbortMultipartUpload", "oss:PutObjectAcl", "oss:GetObjectAcl", "oss:ListParts", "oss:DeleteObject", "oss:PutObject", "oss:GetObject", "oss:GetVodPlaylist", "oss:PostVodPlaylist", "oss:PublishRtmpStream", "oss:ListObjectVersions", "oss:GetObjectVersion", "oss:GetObjectVersionAcl", "oss:RestoreObjectVersion" ], "Effect": "Deny", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket/hangzhou/2021/*" ] }, { "Action": [ "oss:ListObjects", "oss:GetObject" ], "Condition": { "StringLike": { "oss:Prefix": [ "hangzhou/2021/*" ] } }, "Effect": "Deny", "Principal": [ "*" ], "Resource": [ "acs:oss:*:174649585760****:examplebucket" ] } ], "Version": "1" }
- Specify that only anonymous requests from the specified IP address are allowed to
access all resources in a bucket named examplebucket.
- Add a bucket policy to the examplebucket bucket.
./ossutil64 bucket-policy --method put oss://examplebucket local_json_file
If a similar output is displayed, the bucket policy is added to the examplebucket bucket:
1.125101(s) elapsed
- Create a file named local_json_file on your local device and write different bucket
policies based on different scenarios.
Obtain bucket policies
- Command syntax
./ossutil64 bucket-policy --method get oss://bucketname local_json_file
Parameter Description bucketname The name of the bucket whose policies you want to obtain. local_json_file The local JSON file that is used to store the obtained bucket policies. If this parameter is not specified, obtained bucket policies are displayed without being stored in the JSON file. - Example
You can run the following commands to obtain the bucket policies configured for a bucket named examplebucket:
./ossutil64 bucket-policy --method get oss://examplebucket local_json_file
If a similar output is displayed, the bucket policies of examplebucket are obtained and written to the local JSON file:
0.212407(s) elapsed
Delete bucket policies
If you no longer need to use bucket policies to authorize other users to access your OSS resources, delete the configured bucket policies.
- Command syntax
./ossutil64 bucket-policy --method delete oss://bucketname
- Example
You can run the following command to delete all bucket policies configured for a bucket named examplebucket:
./ossutil64 bucket-policy --method delete oss://examplebucket
If a similar output is displayed, all bucket policies configured for examplebucket are deleted:0.530750(s) elapsed
Common options
If you use ossutil to switch to a bucket that is located in another region, add the -e option to the command to specify the endpoint of the region in which the specified bucket is located. If you use ossutil to switch to a bucket that belongs to another Alibaba Cloud account, you can add the -i option to the command to specify the AccessKey ID of the specified account, and add the -k option to the command to specify the AccessKey secret of the specified account.
./ossutil64 bucket-policy --method put oss://examplebucket local_json_file -e oss-cn-hangzhou.aliyuncs.com -i LTAI4Fw2NbDUCV8zYUzA**** -k 67DLVBkH7EamOjy2W5RVAHUY9H****
For more information about other common options that you can specify in the sync command, see Common options.