Bucket policies are resource-based authorization policies. Bucket owners can use bucket policies to authorize other users to access the specified resource in Object Storage Service (OSS). This topic describes how to run the bucket-policy command to add, modify, obtain, or delete bucket policies for a bucket.

Usage notes

  • Sample command lines in this topic are based on the 64-bit Linux system. For other systems, replace ./ossutil64 in the commands with the corresponding binary name. For more information, see ossutil.
  • For more information about bucket policies, see Overview.

Add or modify bucket policies

Before you add or modify bucket policies for a bucket, you must create a JSON file on your local device, and configure bucket policies in the JSON file. You can configure multiple bucket policies in a single JSON file. However, the total size of the bucket policies cannot exceed 16 KB.

When you add or modify bucket policies, ossutil reads bucket policies from the JSON file and adds the policies to the specified bucket. When you add bucket policies, existing bucket policies are overwritten.

  • Command syntax
    ./ossutil64 bucket-policy --method put oss://bucketname local_json_file

    The following table describes the parameters in the syntax.

    Parameter Description
    bucketname The name of the bucket for which you want to add or modify bucket policies.
    local_json_file The name of the local JSON file in which you configure bucket policies.
  • Example
    1. Create a file named local_json_file on your local device and write different bucket policies based on different scenarios.

      The following examples show how to configure common bucket policies:

      Note The following examples show how the bucket owner whose UID is 174649585760**** in the Resource parameter configures bucket policies to grant different permissions to RAM users, such as the RAM user whose UID is 20214760404935**** in the Principal parameter and the anonymous user *.
      • Specify that only anonymous requests from the specified IP address are allowed to access all resources in a bucket named examplebucket. 
        {
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl",
                "oss:ListObjects",
                "oss:RestoreObject",
                "oss:GetVodPlaylist",
                "oss:ListObjectVersions",
                "oss:GetObjectVersion",
                "oss:GetObjectVersionAcl",
                "oss:RestoreObjectVersion"
            ],
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.10.10.10"
                    ]
                }
            },
            "Effect": "Allow",
            "Principal": [
                "*"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket/*"
            ]
        },
        {
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Condition": {
                "StringLike": {
                    "oss:Prefix": [
                        "*"
                    ]
                },
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.10.10.10"
                    ]
                }
            },
            "Effect": "Allow",
            "Principal": [
                "*"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket"
            ]
        }
    ],
    "Version": "1"
}
      • Grant the specified Resource Access Management (RAM) user read-only permissions on the hangzhou/2020 and hangzhou/2015 directories in a bucket named examplebucket. 
        {
    "Statement": [
        {
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl",
                "oss:ListObjects",
                "oss:RestoreObject",
                "oss:GetVodPlaylist",
                "oss:ListObjectVersions",
                "oss:GetObjectVersion",
                "oss:GetObjectVersionAcl",
                "oss:RestoreObjectVersion"
            ],
            "Effect": "Allow",
            "Principal": [
                "20214760404935****"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket/hangzhou/2020/*",
                "acs:oss:*:174649585760****:examplebucket/hangzhou/2015/*"
            ]
        },
        {
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Condition": {
                "StringLike": {
                    "oss:Prefix": [
                        "hangzhou/2020/*",
                        "hangzhou/2015/*"
                    ]
                }
            },
            "Effect": "Allow",
            "Principal": [
                "20214760404935****"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket"
            ]
        }
    ],
    "Version": "1"
}
      • Reject anonymous requests to all the objects in the hangzhou/2021/ directory of a bucket named examplebucket. 
        {
    "Statement": [
        {
            "Action": [
                "oss:RestoreObject",
                "oss:ListObjects",
                "oss:AbortMultipartUpload",
                "oss:PutObjectAcl",
                "oss:GetObjectAcl",
                "oss:ListParts",
                "oss:DeleteObject",
                "oss:PutObject",
                "oss:GetObject",
                "oss:GetVodPlaylist",
                "oss:PostVodPlaylist",
                "oss:PublishRtmpStream",
                "oss:ListObjectVersions",
                "oss:GetObjectVersion",
                "oss:GetObjectVersionAcl",
                "oss:RestoreObjectVersion"
            ],
            "Effect": "Deny",
            "Principal": [
                "*"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket/hangzhou/2021/*"
            ]
        },
        {
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Condition": {
                "StringLike": {
                    "oss:Prefix": [
                        "hangzhou/2021/*"
                    ]
                }
            },
            "Effect": "Deny",
            "Principal": [
                "*"
            ],
            "Resource": [
                "acs:oss:*:174649585760****:examplebucket"
            ]
        }
    ],
    "Version": "1"
}
    2. Add a bucket policy to the examplebucket bucket. 
      ./ossutil64 bucket-policy --method put oss://examplebucket local_json_file

      If a similar output is displayed, the bucket policy is added to the examplebucket bucket: 

      1.125101(s) elapsed

Obtain bucket policies

  • Command syntax
    ./ossutil64 bucket-policy --method get oss://bucketname local_json_file
    Parameter Description
    bucketname The name of the bucket whose policies you want to obtain.
    local_json_file The local JSON file that is used to store the obtained bucket policies. If this parameter is not specified, obtained bucket policies are displayed without being stored in the JSON file.
  • Example

    You can run the following commands to obtain the bucket policies configured for a bucket named examplebucket: 

    ./ossutil64 bucket-policy --method get oss://examplebucket local_json_file

    If a similar output is displayed, the bucket policies of examplebucket are obtained and written to the local JSON file: 

    0.212407(s) elapsed

Delete bucket policies

If you no longer need to use bucket policies to authorize other users to access your OSS resources, delete the configured bucket policies.

  • Command syntax
    ./ossutil64 bucket-policy --method delete oss://bucketname
  • Example

    You can run the following command to delete all bucket policies configured for a bucket named examplebucket: 

    ./ossutil64 bucket-policy --method delete oss://examplebucket
    If a similar output is displayed, all bucket policies configured for examplebucket are deleted: 
    0.530750(s) elapsed

Common options

If you use ossutil to switch to a bucket that is located in another region, add the -e option to the command to specify the endpoint of the region in which the specified bucket is located. If you use ossutil to switch to a bucket that belongs to another Alibaba Cloud account, you can add the -i option to the command to specify the AccessKey ID of the specified account, and add the -k option to the command to specify the AccessKey secret of the specified account.

For example, you can run the following command to configure a bucket policy for a bucket named examplebucket, which is located in the China (Hangzhou) region and is owned by another Alibaba Cloud account:
./ossutil64 bucket-policy --method put oss://examplebucket local_json_file -e oss-cn-hangzhou.aliyuncs.com -i LTAI4Fw2NbDUCV8zYUzA****  -k 67DLVBkH7EamOjy2W5RVAHUY9H****

For more information about other common options that you can specify in the sync command, see Common options.