To share data between departments or projects, configure a bucket policy. This policy lets you grant users in other departments permission to download shared data, while denying them permission to write or delete data. This helps prevent accidental data deletion or modification.
Solution overview
For example, Department A wants to share data from a bucket with employees in Department B. This scenario requires different levels of access. Employees in Department A need full read and write permissions for the bucket data. Employees in Department B only need to read the data, without permission to modify or delete it.
To implement this solution, configure the following bucket policies:
-
Employees in your department: Grant full read/write permissions.
-
Employees in other departments: Grant read-only permissions.
Grant read/write permissions to your department
Configure full read/write permissions for employees in your department. This ensures that internal users can manage the data in the bucket.
-
Go to the Bucket List page and click the destination bucket.
In the left-side navigation pane, click .
On the Add in GUI tab, click Authorize and configure the access policy as follows.
Configuration Item
Description
Authorized Resource
Select Whole Bucket. You can also select specific resources as needed.
Authorized User
Select RAM User, and then select your department's RAM Users from the drop-down list.
To grant permissions to many users, select Other Accounts and enter the accounts as prompted.
Authorized Operation
In the Simple Settings section, select Read/Write.
Click OK to apply the permissions for your department.
Grant read-only permissions to other departments
Configure read-only permissions for employees in other departments. This allows them to access and download shared data but prevents them from modifying or deleting it.
-
Go to the Bucket List page and click the destination bucket.
In the left-side navigation pane, click .
On the Add in GUI tab, click Authorize and configure the read-only permissions as follows.
Configuration Item
Description
Authorized Resource
Select Whole Bucket. You can also select specific resources as needed.
Authorized User
Select RAM User, and then select the RAM Users from the other department from the drop-down list.
If you need to grant permissions to a large number of users, you can select Other Accounts and enter the list of accounts as prompted.
Authorized Operation
In the Simple Settings section, select Read-Only (including ListObject).
Click OK to apply the permissions for the other departments.
Solution validation
Verify that employees from your department have full read/write permissions and that employees from other departments have read-only permissions.
Verify the read/write permissions of your department's employees
-
Upload a file
-
Log on to the OSS console as an employee from your department.
-
Go to the file list using the URL
https://oss.console.alibabacloud.com/bucket/oss-{region-id}/{bucket-name}/object. -
Click Upload Object and follow the on-screen instructions to upload the file.
-
Download a file
-
Go to the file list using the URL
https://oss.console.alibabacloud.com/bucket/oss-{region-id}/{bucket-name}/object. In the Actions column of the target object, click View Details and then click Download. The object is downloaded successfully.
-
Verify the read-only permissions of other departments' employees
-
Upload a file
-
Log on to the OSS console as an employee from another department.
-
Go to the file list using the URL
https://oss.console.alibabacloud.com/bucket/oss-{region-id}/{bucket-name}/object. -
Click Upload Object. The task list shows that the upload failed with an
AccessDeniedmessage. This confirms that the user does not have upload permissions.
-
Download a file
-
Go to the file list using the URL
https://oss.console.alibabacloud.com/bucket/oss-{region-id}/{bucket-name}/object. In the Actions column of the target object, click View Details and then click Download. The object is downloaded successfully. This confirms that the user has read permissions.
-
-
Delete a file
-
Go to the file list using the URL
https://oss.console.alibabacloud.com/bucket/oss-{region-id}/{bucket-name}/object. -
Select the destination file and click Permanently Delete. The file deletion fails with an
AccessDeniedmessage. This confirms that the user does not have delete permissions.
-