Grant Fine-Grained OSS Access with RAM Custom Policies - Resource Access Management - Alibaba Cloud - Resource Access Management

Create custom RAM policies to control what OSS resources your RAM users can access and how.

System policies and prerequisites

Two system policies cover common OSS access patterns:
- AliyunOSSFullAccess: grants full management permissions on all OSS buckets.
- AliyunECSReadOnlyAccess: grants read-only permissions on OSS buckets.
If neither policy fits your requirements, create a custom policy using the examples in this topic.
Before writing policies, review the available OSS permissions. For more information, see RAM Policy.

Grant OSS access to a RAM user

Create a RAM user. For more information, see Create a RAM user.
Create a custom policy. For more information, see Create a custom policy and Policy examples.
Attach the policy to the RAM user. For more information, see Manage RAM user permissions.

Policy examples

Example 1: Grant full management access to a specific bucket

This policy grants a RAM user all OSS operations (oss:*) on the bucket named myphotos and all objects within it.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowFullAccessToMyphotos",
            "Effect": "Allow",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ]
        }
    ]
}

Example 2: Grant read-only access to a bucket

This policy lets a RAM user list objects and read their contents in the myphotos bucket. The required permissions differ depending on whether the user accesses OSS through the SDK/CLI or the OSS console.

SDK and CLI access

Two statements are needed: one to list objects in the bucket, and one to read individual objects.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowListObjectsInMyphotos",
            "Effect": "Allow",
            "Action": "oss:ListObjects",
            "Resource": "acs:oss:*:*:myphotos"
        },
        {
            "Sid": "AllowGetObjectsInMyphotos",
            "Effect": "Allow",
            "Action": "oss:GetObject",
            "Resource": "acs:oss:*:*:myphotos/*"
        }
    ]
}

OSS console access

The console requires additional permissions beyond what the SDK/CLI needs.

Note

When a RAM user logs on to the OSS console, the ListBuckets, GetBucketAcl, and GetObjectAcl operations are called to check whether the bucket is public.

The first statement grants console-level visibility operations on all buckets. The second and third statements grant list and read access scoped to myphotos.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowConsoleVisibility",
            "Effect": "Allow",
            "Action": [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl"
            ],
            "Resource": "acs:oss:*:*:*"
        },
        {
            "Sid": "AllowListObjectsInMyphotos",
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetBucketAcl"
            ],
            "Resource": "acs:oss:*:*:myphotos"
        },
        {
            "Sid": "AllowGetObjectsInMyphotos",
            "Effect": "Allow",
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl"
            ],
            "Resource": "acs:oss:*:*:myphotos/*"
        }
    ]
}

Example 3: Restrict access to specific IP addresses

Use the Condition element to limit which IP addresses can access the myphotos bucket. Choose between an allowlist or a denylist approach.

IP allowlist (Allow with IP condition)

This policy grants read access to myphotos only when the request originates from the 192.168.0.0/16 or 172.16.1.0/16 CIDR block. The IP condition applies to the data-access statement only — the Allow statement for console visibility remains unrestricted.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowConsoleVisibility",
            "Effect": "Allow",
            "Action": [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl"
            ],
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Sid": "AllowReadFromAllowedIPs",
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ],
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16", "172.16.1.0/16"]
                }
            }
        }
    ]
}

IP denylist (Deny with IP condition)

This policy explicitly denies all OSS operations when the request comes from an IP address outside the 192.168.0.0/16 CIDR block. A RAM user outside that range cannot access or manage the myphotos bucket.

The first two statements grant the necessary Allow permissions; the third applies the Deny. Both are required — the Allow grants access, and the Deny overrides it for out-of-range IPs.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowConsoleVisibility",
            "Effect": "Allow",
            "Action": [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl"
            ],
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Sid": "AllowReadFromMyphotos",
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ]
        },
        {
            "Sid": "DenyAccessFromOutsideAllowedIP",
            "Effect": "Deny",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16"]
                }
            }
        }
    ]
}

Note

A Deny statement takes priority over an Allow statement. When a RAM user outside the myphotos bucket tries to read data and their IP address is not in the 192.168.0.0/16 CIDR block, OSS returns a permission denied error.

Example 4: Grant read-only access to a specific folder

Folder-level authorization is an advanced use of RAM policies. The required permissions depend on how the RAM user accesses OSS.

The following bucket stores photos organized by location and year:

The bucket myphotos contains folders named by location, each with subfolders named by year.

myphotos[Bucket]
  ├── beijing
  │   ├── 2014
  │   └── 2015
  ├── hangzhou
  │   ├── 2013
  │   ├── 2014
  │   └── 2015 // Grant read-only permissions on this folder to a RAM user.
  └── qingdao
      ├── 2014
      └── 2015

The goal is to grant read-only access to the myphotos/hangzhou/2015/ folder. Choose the scenario that matches your use case:

Scenario 1: Direct object access without folder listing

The RAM user reads objects using their full path but cannot list folder contents. Attach this policy to application services that fetch objects by known paths.

In this scenario, the RAM user can use the full path to read object data.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowGetObjectsInHangzhou2015",
            "Effect": "Allow",
            "Action": [
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos/hangzhou/2015/*"
            ]
        }
    ]
}

Scenario 2: Folder access via OSS CLI

The RAM user can list and read objects in myphotos/hangzhou/2015/ using the OSS CLI or by calling OSS operations directly. Use this policy to grant access to software developers.

In this scenario, the RAM user can use the OSS CLI or call operations to read data from the folder.

The ListObjects permission is required to enumerate objects in the folder. The Prefix condition scopes listing to the target folder only.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowGetObjectsInHangzhou2015",
            "Effect": "Allow",
            "Action": [
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos/hangzhou/2015/*"
            ]
        },
        {
            "Sid": "AllowListObjectsInHangzhou2015",
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos"
            ],
            "Condition": {
                "StringLike": {
                    "oss:Prefix": "hangzhou/2015/*"
                }
            }
        }
    ]
}

Scenario 3: Folder access via OSS console

The RAM user navigates to myphotos/hangzhou/2015/ using the OSS console or a visual client such as Windows File Explorer.

In this scenario, the RAM user can use a visual OSS client (for example, Windows File Explorer) to access the myphotos/hangzhou/2015/ folder.

Three sets of permissions are required for console navigation to work correctly:

Permission to list all buckets
Permission to list folders under myphotos
Permission to list folders under myphotos/hangzhou

The first statement grants console visibility across all buckets. The second grants read access to the target folder. The third uses the Delimiter and Prefix conditions to enable folder-by-folder navigation down to hangzhou/2015/.

{
    "Version": "1",
    "Statement": [
        {
            "Sid": "AllowConsoleVisibility",
            "Effect": "Allow",
            "Action": [
                "oss:ListBuckets",
                "oss:GetBucketStat",
                "oss:GetBucketInfo",
                "oss:GetBucketTagging",
                "oss:GetBucketAcl"
            ],
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Sid": "AllowGetObjectsInHangzhou2015",
            "Effect": "Allow",
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos/hangzhou/2015/*"
            ]
        },
        {
            "Sid": "AllowFolderNavigationInMyphotos",
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos"
            ],
            "Condition": {
                "StringLike": {
                    "oss:Delimiter": "/",
                    "oss:Prefix": [
                        "",
                        "hangzhou/",
                        "hangzhou/2015/*"
                    ]
                }
            }
        }
    ]
}