OSS dual access control with VPC and bucket policies - Object Storage Service

Combine a VPC policy with a bucket policy to control OSS access at both the network source and resource levels, preventing unauthorized access and data exfiltration.

How it works

This solution pairs a VPC policy with a bucket policy to form a source-side authorization and destination-side validation model. The VPC policy restricts which buckets a VPC can access, enabling fine-grained permission management and risk isolation. The bucket policy validates the request source, ensuring only traffic from the authorized VPC reaches the resource.

Allowed access: Requests from an authorized VPC to an authorized bucket pass both policies.
Denied access:
- VPC policy denial: The VPC attempts to access a bucket not authorized by the VPC policy.
- Bucket policy denial: A request reaches the bucket from an unauthorized VPC.

Implementation

The following example demonstrates dual access control. An enterprise user (UID: 174649585760xxxx) stores business data in an OSS bucket named example-bucket. Applications run on ECS instances in VPC vpc-t4nlw426y44rd3iq4xxxx. All access uses the AccessKey of RAM user example-user (UID: 20655703638807****). Access control goals:

VPC source-side control: Allow the VPC to access only example-bucket.
Bucket destination-side control: Deny all OSS requests that do not originate from the specified VPC.

Step 1: Configure a VPC policy

Create an endpoint policy for VPC vpc-t4nlw426y44rd3iq4xxxx that restricts access to example-bucket.

Go to the VPC console. In the left-side navigation pane, click Endpoints.
Click Create Endpoint and configure the following settings.

If this is your first time using endpoints, you must first Activate Endpoint Service.
- Region: Select the region where the VPC is located, such as Singapore.
- Endpoint Name: Enter a name for the endpoint.
- Endpoint Type: Select Gateway Endpoint.
- Endpoint Service: Select Alibaba Cloud Service and then select the OSS endpoint service. The service name ends with oss.
- VPC: Select the target VPC.
- Route Table: Select the target route table.
- Endpoint Policy: Enter the following policy in the editor.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "oss:*",
      "Principal": [
        "20655703638807****"
      ],
      "Resource": [
        "acs:oss:*:*:example-bucket",
        "acs:oss:*:*:example-bucket/*"
      ]
    }
  ]
}
```
Confirm the configuration and click OK.

Step 2: Configure a bucket policy

Configure a bucket policy to deny all OSS access from any VPC except vpc-t4nlw426y44rd3iq4xxxx.

Go to the Buckets list and click the target bucket.
In the left-side navigation pane of the bucket, click Permission Control > Bucket Policy.

Select Add by Syntax, click Edit, and enter the following policy.

{
  "Statement": [
    {
      "Action": [
        "oss:*"
      ],
      "Effect": "Deny",
      "Principal": [
        "20655703638807****"
      ],
      "Resource": "acs:oss:*:*:*",
      "Condition": {
        "StringNotEquals": {
          "acs:SourceVpc": [
            "vpc-t4nlw426y44rd3iq4xxxx"
          ]
        }
      }
    }
  ],
  "Version": "1"
}

Confirm the policy, click Save, and follow the on-screen prompts.

Step 3: Verify access control

Use ossutil to verify the configuration. Download ossutil 2.0 and configure it with the RAM user's AccessKey and the internal endpoint. For example, use oss-ap-southeast-1-internal.aliyuncs.com.

Verify the allowed access scenario

On an ECS instance in VPC vpc-t4nlw426y44rd3iq4xxxx, use the AccessKey of user 20655703638807**** to list objects in example-bucket.

ossutil ls oss://example-bucket/

The request succeeds because both policies grant access.

Verify the VPC policy denial scenario

From the same VPC, access a bucket not authorized by the VPC policy, such as other-bucket.

ossutil ls oss://other-bucket/

Access is denied with Access denied by VPC endpoint policy.., confirming the VPC policy restricts accessible buckets at the source.

Verify the bucket policy denial scenario

From an unauthorized VPC or the public internet, use the same user's AccessKey to access example-bucket.

ossutil ls oss://example-bucket/

Access is denied with Access denied by bucket policy.., confirming the bucket policy validates the VPC source at the destination.