Object Storage Service:Use resource groups for fine-grained resource control

Terms

Procedure for resource group-level authorization

The following procedure describes how to grant a Resource Access Management (RAM) user permissions to manage OSS resources within a specific resource group.

1. In the RAM console, create a RAM user.

   For more information, see Create a RAM user.

2. In the Resource Group console, create a resource group.

   For more information, see Create a resource group.

3. Assign resources to the corresponding resource group.

   • New resources: When you create a resource, specify the resource group to which it belongs.

   • Existing resources: Transfer existing resources to the corresponding resource group. For more information, see Manually transfer resources to a resource group.

4. In the RAM console, create a custom policy.

   Create a custom policy that includes the required operation permissions for the RAM user. For more information, see Create a custom policy. You can skip this step if you grant a system policy to the RAM user.

   Important

   In a production environment, follow the Principle of Least Privilege (PoLP). Grant the RAM user only the minimum permissions required to avoid the security risks of excessive permissions.

   The following code provides an example of a custom policy:

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
             "oss:GetObject",
             "oss:PutObject"
         ],
         "Resource": "*"
       }
     ]
   }

5. Grant the RAM user permissions on the specified resource group.

   You can use either of the following methods to grant permissions:

   • Grant permissions in the Resource Group console. The resource scope is set to the corresponding resource group by default. For more information, see Grant permissions on a resource group to a RAM identity.

     

   • You can grant permissions in the RAM console. When you select the Resource Scope, make sure to select Resource Group Level. For more information, see Grant permissions to a RAM user.

     

Resource types that support resource groups

OSS supports resource groups for some resource types. The following table lists the supported resource types.

Operations that do not support resource group-level authorization

The following table lists the operations (actions) and their corresponding API operations in OSS that do not support resource group-level authorization.

For more information about RAM authorization for OSS, see Use RAM policies to authorize access to OSS.

For resource types that do not support resource groups, you cannot grant permissions at the resource group level. To grant permissions, you must create a custom policy and set the resource scope to Account Level.

The following code provides two examples of custom policies. You can modify the policies as needed.

• Allow read-only operations that do not support resource group-level authorization. The Action element lists all read-only operations that do not support resource group-level authorization.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "oss:DescribeRegions",
          "oss:ListUserDataRedundancyTransition",
          "oss:GetPublicAccessBlock",
          "oss:GetUserAntiDDosInfo",
          "oss:ListBucketAntiDDosInfo",
          "oss:ListResourcePools",
          "oss:GetResourcePoolInfo",
          "oss:ListResourcePoolBuckets",
          "oss:GetResourcePoolRequesterQoSInfo",
          "oss:ListResourcePoolRequesterQoSInfos"
        ],
        "Resource": "*"
      }
    ]
  }

• Allow all operations that do not support resource group-level authorization. The Action element lists all operations that do not support resource group-level authorization.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "oss:DescribeRegions",
          "oss:ListUserDataRedundancyTransition",
          "oss:PutPublicAccessBlock",
          "oss:GetPublicAccessBlock",
          "oss:DeletePublicAccessBlock",
          "oss:InitUserAntiDDosInfo",
          "oss:UpdateUserAntiDDosInfo",
          "oss:GetUserAntiDDosInfo",
          "oss:InitBucketAntiDosInfo",
          "oss:UpdateBucketAntiDDosInfo",
          "oss:ListBucketAntiDDosInfo",
          "oss:ListResourcePools",
          "oss:GetResourcePoolInfo",
          "oss:ListResourcePoolBuckets",
          "oss:PutResourcePoolRequesterQoSInfo",
          "oss:GetResourcePoolRequesterQoSInfo",
          "oss:ListResourcePoolRequesterQoSInfos",
          "oss:DeleteResourcePoolRequesterQoSInfo"
        ],
        "Resource": "*"
      }
    ]
  }