幫助中心
首頁 Object Storage Service 用户指南 OSS Tables 許可權與存取控制

許可權與存取控制

更新時間：
Copy as MD
產品

OSS Tables基於IAM Policy格式的資源策略（Resource Policy）提供存取控制能力，支援在Table Bucket和Table兩個層級設定資源策略，實現細粒度的許可權管理。

許可權模型

OSS Tables使用IAM Policy格式的資源策略（Resource Policy）進行存取控制，具有以下特點：

  • IAM Policy格式：資源策略採用與RAM Policy相同的IAM Policy格式，包含Version、Statement、Effect、Action、Principal、Resource等標準欄位。

  • 雙層級粒度：支援在Table Bucket層級和Table層級兩種粒度設定資源策略。Table Bucket層級的策略對Bucket下所有Table生效，Table層級的策略僅對指定Table生效。

  • 管理入口：在Table Bucket詳情頁的許可權控制 Tab下管理Bucket授權策略和RAM存取控制。許可權控制 Tab包含Bucket 授權策略和存取控制 RAM兩個子Tab。

  • 資源鑒權：對於 Table 相關請求，最終鑒權結果由 Table Bucket Policy 和 Table Policy 共同決定：

    Table Bucket Policy

    Table Policy

    鑒權結果

    Allow

    Allow

    Allow

    Allow

    Ignore

    Allow

    Allow

    Deny

    Deny

    Ignore

    Allow

    Allow

    Ignore

    Ignore

    Ignore

    Ignore

    Deny

    Deny

    Deny

    Allow

    Deny

    Deny

    Ignore

    Deny

    Deny

    Deny

    Deny

Bucket授權策略

資源策略分為Table Bucket層級和Table層級兩種粒度。

Table Bucket層級資源策略

Table Bucket層級的資源策略用於控制對整個Table Bucket及其下所有Table的存取權限。Table Bucket的權限原則將作用於其下所有Table。

控制台

通過OSS控制台的圖形化介面配置Bucket授權策略，支援按圖形策略添加和按文法策略添加兩種方式。

  1. 登入OSS管理主控台，在左側導覽列選擇Table Bucket 列表。

  2. 單擊目標Table Bucket名稱，進入Table Bucket詳情頁。

  3. 選擇許可權控制 Tab。

  4. 在Bucket 授權策略子Tab下，單擊新增授權。

  5. 選擇按圖形策略添加或按文法策略添加。

  6. 根據業務需求配置以下參數：

    • 授權資源：選擇需要授權的資源範圍。

    • 授權操作：選擇允許或拒絕的操作類型。

    • 條件：設定策略生效的條件（可選）。

    • 授權使用者：指定策略的授權對象。

    • 效力：選擇允許（Allow）或拒絕（Deny）。

  7. 單擊確定完成授權配置。

配置完成後，在授權列表中查看已配置的策略。授權列表展示授權資源、授權操作、條件、授權使用者、效力等資訊，並支援在操作列對策略進行編輯或刪除。

ossutil

# 設定Table Bucket資源策略
ossutil tables-api put-table-bucket-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket --resource-policy '{"Version":"1","Statement":[{"Effect":"Allow","Action":["oss:GetTableBucket","oss:ListTables","oss:GetTable"],"Principal":["1142323451******"],"Resource":["acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket"]}]}'

# 擷取Table Bucket資源策略
ossutil tables-api get-table-bucket-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket

# 刪除Table Bucket資源策略
ossutil tables-api delete-table-bucket-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket

SDK

Python

設定Table Bucket資源策略（PutTableBucketPolicy）

import argparse
import json
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="put table bucket policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)
parser.add_argument('--policy', help='The resource policy JSON string.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.put_table_bucket_policy(oss_tables.models.PutTableBucketPolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
        resource_policy=args.policy,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id}')
    print(f'successfully set policy for: {args.table_bucket_arn}')


if __name__ == "__main__":
    main()

擷取Table Bucket資源策略（GetTableBucketPolicy）

import argparse
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="get table bucket policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.get_table_bucket_policy(oss_tables.models.GetTableBucketPolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' resource policy: {result.resource_policy}')


if __name__ == "__main__":
    main()

刪除Table Bucket資源策略（DeleteTableBucketPolicy）

import argparse
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="delete table bucket policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.delete_table_bucket_policy(oss_tables.models.DeleteTableBucketPolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id}')
    print(f'successfully deleted policy for: {args.table_bucket_arn}')


if __name__ == "__main__":
    main()

Go

設定Table Bucket資源策略（PutTableBucketPolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.PutTableBucketPolicy(context.TODO(), &tables.PutTableBucketPolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
		ResourcePolicy: oss.Ptr(`
			{
			   "Version":"1",
			   "Statement":[
			   {
				 "Action":[
				   "oss:GetTable",
				],
				"Effect":"Deny",
				"Principal":["1234567890"],
				"Resource":["acs:osstables:cn-hangzhou:1234567890:bucket/demo-bucket"]
			   }
			  ]
			 }
		`),
	})

	if err != nil {
		log.Fatalf("failed to put table bucket policy %v", err)
	}

	log.Printf("put table bucket policy result:%#v\n", result)
}

擷取Table Bucket資源策略（GetTableBucketPolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.GetTableBucketPolicy(context.TODO(), &tables.GetTableBucketPolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
	})

	if err != nil {
		log.Fatalf("failed to get table bucket policy %v", err)
	}

	log.Printf("get table bucket policy result:%#v\n", result)
}

刪除Table Bucket資源策略（DeleteTableBucketPolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.DeleteTableBucketPolicy(context.TODO(), &tables.DeleteTableBucketPolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
	})

	if err != nil {
		log.Fatalf("failed to delete table bucket policy %v", err)
	}

	log.Printf("delete table bucket policy result:%#v\n", result)
}

Java

設定Table Bucket資源策略（PutTableBucketPolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class PutTableBucketPolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";
        String resourcePolicy = "{\"Version\":\"1\",\"Statement\":[{\"Effect\":\"Deny\",\"Action\":[\"oss:GetTable\"],\"Principal\":[\"1234567890\"],\"Resource\":[\"acs:osstable:cn-hangzhou:1234567890:bucket/demo-bucket/table/*\"]}]}";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            PutTableBucketPolicyRequest request = PutTableBucketPolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .resourcePolicy(resourcePolicy)
                    .build();

            PutTableBucketPolicyResult result = client.putTableBucketPolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Successfully updated table bucket policy for ARN: %s%n", tableBucketARN);
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

擷取Table Bucket資源策略（GetTableBucketPolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class GetTableBucketPolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            GetTableBucketPolicyRequest request = GetTableBucketPolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .build();

            GetTableBucketPolicyResult result = client.getTableBucketPolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Retrieved policy for table bucket: %s%n", tableBucketARN);
            if (result.resourcePolicy() != null) {
                System.out.printf("Policy: %s%n", result.resourcePolicy());
            } else {
                System.out.println("No policy set for this table bucket.");
            }
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

刪除Table Bucket資源策略（DeleteTableBucketPolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class DeleteTableBucketPolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            DeleteTableBucketPolicyRequest request = DeleteTableBucketPolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .build();

            DeleteTableBucketPolicyResult result = client.deleteTableBucketPolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Successfully deleted policy for table bucket ARN: %s%n", tableBucketARN);
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

API

Table層級資源策略

Table層級的資源策略用於控制對單個Table的存取權限。

控制台

通過OSS控制台的圖形化介面配置Bucket授權策略，支援按圖形策略添加和按文法策略添加兩種方式。

  1. 登入OSS管理主控台，在左側導覽列選擇Table Bucket 列表。

  2. 單擊目標Table Bucket名稱，進入Table Bucket詳情頁。

  3. 選擇Table 列表 Tab，進入目標Table 詳情頁。

  4. 在許可權控制 > Table 授權策略子Tab下，單擊新增授權。

  5. 選擇按圖形策略添加或按文法策略添加。

  6. 根據業務需求配置以下參數：

    • 授權資源：選擇需要授權的資源範圍。

    • 授權操作：選擇允許或拒絕的操作類型。

    • 條件：設定策略生效的條件（可選）。

    • 授權使用者：指定策略的授權對象。

    • 效力：選擇允許（Allow）或拒絕（Deny）。

  7. 單擊確定完成授權配置。

配置完成後，在授權列表中查看已配置的策略。授權列表展示授權資源、授權操作、條件、授權使用者、效力等資訊，並支援在操作列對策略進行編輯或刪除。

ossutil

# 設定Table資源策略
ossutil tables-api put-table-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket --namespace mynamespace --name mytable --resource-policy '{"Version":"1","Statement":[{"Effect":"Allow","Action":["oss:GetTable","oss:CreateTable","oss:DeleteTable"],"Principal":["1142323451******"],"Resource":["acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket/table/c3a22d63-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]}]}'

# 擷取Table資源策略
ossutil tables-api get-table-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket --namespace mynamespace --name mytable

# 刪除Table資源策略
ossutil tables-api delete-table-policy --table-bucket-arn acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket --namespace mynamespace --name mytable

SDK

Python

設定Table資源策略（PutTablePolicy）

import argparse
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="put table policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)
parser.add_argument('--namespace', help='The namespace of the table.', required=True)
parser.add_argument('--name', help='The name of the table.', required=True)
parser.add_argument('--policy', help='The resource policy JSON string.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.put_table_policy(oss_tables.models.PutTablePolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
        namespace=args.namespace,
        name=args.name,
        resource_policy=args.policy,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id}')
    print(f'successfully set policy for: {args.namespace}/{args.name}')


if __name__ == "__main__":
    main()

擷取Table資源策略（GetTablePolicy）

import argparse
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="get table policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)
parser.add_argument('--namespace', help='The namespace of the table.', required=True)
parser.add_argument('--name', help='The name of the table.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.get_table_policy(oss_tables.models.GetTablePolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
        namespace=args.namespace,
        name=args.name,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id},'
          f' resource policy: {result.resource_policy}')


if __name__ == "__main__":
    main()

刪除Table資源策略（DeleteTablePolicy）

import argparse
import alibabacloud_oss_v2 as oss
import alibabacloud_oss_v2.tables as oss_tables

parser = argparse.ArgumentParser(description="delete table policy sample")
parser.add_argument('--region', help='The region in which the table bucket is located.', required=True)
parser.add_argument('--endpoint', help='The domain names that other services can use to access OSS Tables.')
parser.add_argument('--table-bucket-arn', help='The ARN of the table bucket.', required=True)
parser.add_argument('--namespace', help='The namespace of the table.', required=True)
parser.add_argument('--name', help='The name of the table.', required=True)

def main():
    args = parser.parse_args()

    credentials_provider = oss.credentials.EnvironmentVariableCredentialsProvider()

    cfg = oss.config.load_default()
    cfg.credentials_provider = credentials_provider
    cfg.region = args.region
    if args.endpoint is not None:
        cfg.endpoint = args.endpoint

    client = oss_tables.Client(cfg)

    result = client.delete_table_policy(oss_tables.models.DeleteTablePolicyRequest(
        table_bucket_arn=args.table_bucket_arn,
        namespace=args.namespace,
        name=args.name,
    ))

    print(f'status code: {result.status_code},'
          f' request id: {result.request_id}')
    print(f'successfully deleted policy for: {args.namespace}/{args.name}')


if __name__ == "__main__":
    main()

Go

設定Table資源策略（PutTablePolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
	namespace      string
	name           string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
	flag.StringVar(&namespace, "namespace", "", "The name of the namespace.")
	flag.StringVar(&name, "name", "", "The name of the table.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(namespace) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, namespace name required")
	}

	if len(name) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table name required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.PutTablePolicy(context.TODO(), &tables.PutTablePolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
		Namespace:      oss.Ptr(namespace),
		Name:           oss.Ptr(name),
		ResourcePolicy: oss.Ptr(`
			{
			   "Version":"1",
			   "Statement":[
			   {
				 "Action":[
				   "oss:GetTable"
				],
				"Effect":"Deny",
				"Principal":["1234567890"],
				"Resource":["acs:osstable:cn-hangzhou:1234567890:bucket/demo-bucket/table/*"]
			   }
			  ]
			 }
		`),
	})

	if err != nil {
		log.Fatalf("failed to put table policy %v", err)
	}

	log.Printf("put table policy result:%#v\n", result)
}

擷取Table資源策略（GetTablePolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
	namespace      string
	name           string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
	flag.StringVar(&namespace, "namespace", "", "The name of the namespace.")
	flag.StringVar(&name, "name", "", "The name of the table.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(namespace) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, namespace name required")
	}

	if len(name) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table name required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.GetTablePolicy(context.TODO(), &tables.GetTablePolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
		Namespace:      oss.Ptr(namespace),
		Name:           oss.Ptr(name),
	})

	if err != nil {
		log.Fatalf("failed to get table policy %v", err)
	}

	log.Printf("get table policy result:%#v\n", result)
}

刪除Table資源策略（DeleteTablePolicy）

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/tables"
)

var (
	region         string
	tableBucketArn string
	namespace      string
	name           string
)

func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&tableBucketArn, "table-bucket-arn", "", "The arn of the table bucket.")
	flag.StringVar(&namespace, "namespace", "", "The name of the namespace.")
	flag.StringVar(&name, "name", "", "The name of the table.")
}

func main() {
	flag.Parse()
	if len(tableBucketArn) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table bucket arn required")
	}

	if len(namespace) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, namespace name required")
	}

	if len(name) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, table name required")
	}

	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	client := tables.NewTablesClient(cfg)

	result, err := client.DeleteTablePolicy(context.TODO(), &tables.DeleteTablePolicyRequest{
		TableBucketARN: oss.Ptr(tableBucketArn),
		Namespace:      oss.Ptr(namespace),
		Name:           oss.Ptr(name),
	})

	if err != nil {
		log.Fatalf("failed to delete table policy %v", err)
	}

	log.Printf("delete table policy result:%#v\n", result)
}

Java

設定Table資源策略（PutTablePolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class PutTablePolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";
        String namespace = "mynamespace";
        String name = "mytable";
        String resourcePolicy = "{\"Version\":\"1\",\"Statement\":[{\"Effect\":\"Deny\",\"Action\":[\"oss:GetTable\"],\"Principal\":[\"1234567890\"],\"Resource\":[\"acs:osstable:cn-hangzhou:1234567890:bucket/demo-bucket/table/*\"]}]}";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            PutTablePolicyRequest request = PutTablePolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .namespace(namespace)
                    .name(name)
                    .resourcePolicy(resourcePolicy)
                    .build();

            PutTablePolicyResult result = client.putTablePolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Successfully put table policy for table: %s/%s%n", namespace, name);
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

擷取Table資源策略（GetTablePolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class GetTablePolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";
        String namespace = "mynamespace";
        String name = "mytable";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            GetTablePolicyRequest request = GetTablePolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .namespace(namespace)
                    .name(name)
                    .build();

            GetTablePolicyResult result = client.getTablePolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Resource policy: %s%n", result.resourcePolicy());
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

刪除Table資源策略（DeleteTablePolicy）

import com.aliyun.sdk.service.oss2.credentials.EnvironmentVariableCredentialsProvider;
import com.aliyun.sdk.service.oss2.tables.OSSTablesClient;
import com.aliyun.sdk.service.oss2.tables.models.*;

public class DeleteTablePolicySample {

    public static void main(String[] args) throws Exception {
        String region = "cn-hangzhou";
        String tableBucketARN = "acs:osstables:cn-hangzhou:1234567890:bucket/mytablebucket";
        String namespace = "mynamespace";
        String name = "mytable";

        try (OSSTablesClient client = OSSTablesClient.newBuilder()
                .credentialsProvider(new EnvironmentVariableCredentialsProvider())
                .region(region)
                .build()) {
            DeleteTablePolicyRequest request = DeleteTablePolicyRequest.newBuilder()
                    .tableBucketARN(tableBucketARN)
                    .namespace(namespace)
                    .name(name)
                    .build();

            DeleteTablePolicyResult result = client.deleteTablePolicy(request);

            System.out.printf("Status code:%d, request id:%s%n",
                    result.statusCode(), result.requestId());
            System.out.printf("Successfully deleted table policy for table: %s/%s%n", namespace, name);
        } catch (Exception e) {
            System.out.println("Error: " + e.getMessage());
        }
    }
}

API

RAM存取控制

通過RAM（Resource Access Management）為子使用者或角色授予OSS Tables相關許可權。RAM Policy使用標準的IAM Policy文法，可在RAM控制台中對使用者、使用者組或角色附加自訂權限原則。

  1. 登入OSS管理主控台，在左側導覽列選擇Table Bucket 列表。

  2. 單擊目標Table Bucket名稱，進入Table Bucket詳情頁。

  3. 選擇許可權控制 Tab，然後單擊存取控制 RAM子Tab。

  4. 在存取控制 RAM頁面，單擊前往RAM控制台設定，跳轉到RAM控制台進行以下操作：

    • 建立自訂權限原則：在RAM控制台的權限原則管理頁面，建立自訂權限原則，在策略內容中配置OSS Tables相關Action和Resource。

    • 為使用者或角色授權：將建立的權限原則附加到RAM使用者、使用者組或角色上。

RAM Policy樣本

以下為常見的RAM Policy配置樣本。

授予Table Bucket唯讀許可權

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetTableBucket",
        "oss:ListTableBuckets",
        "oss:ListNamespaces",
        "oss:GetNamespace",
        "oss:ListTables",
        "oss:GetTable",
        "oss:GetTableData",
        "oss:GetTablePolicy",
        "oss:GetTableBucketPolicy",
        "oss:GetTableMaintenanceConfiguration",
        "oss:GetTableBucketMaintenanceConfiguration",
        "oss:GetTableEncryption",
        "oss:GetTableBucketEncryption",
        "oss:GetTableMetadataLocation"
      ],
      "Resource": [
        "acs:osstables:cn-hangzhou:*:bucket/my-table-bucket",
        "acs:osstables:cn-hangzhou:*:bucket/my-table-bucket/*"
      ]
    }
  ]
}

授予特定Table Bucket的完全系統管理權限

{                                                                                                
   "Version": "1",                                          
   "Statement": [                                                                                 
     {                                                                                            
       "Effect": "Allow",                                                                         
       "Action": "oss:*",                                                                         
       "Resource": [                                        
         "acs:osstables:cn-hangzhou:*:bucket/my-table-bucket",                                    
         "acs:osstables:cn-hangzhou:*:bucket/my-table-bucket/*"
       ]                                                                                          
     }                                                      
   ]                                                                                              
}

資源策略文法

OSS Tables的資源策略採用IAM Policy格式，策略文檔為JSON格式，包含以下欄位：

欄位

類型

是否必填

取值

說明

Version

String

是

1

策略版本號碼，固定為"1"。

Statement

Array

是

—

授權語句列表，每個語句定義一條授權規則。

Effect

String

是

Allow / Deny

授權效力。Allow表示允許，Deny表示拒絕。Deny的優先順序高於Allow。

Action

Array

是

oss:*

巨集指令清單，支援萬用字元*。例如oss:GetTable表示擷取表資訊，oss:*Table*匹配所有包含Table的操作。

Principal

Array

是

帳號ID

授權主體，填寫阿里雲帳號ID。可指定多個帳號。

Resource

Array

是

ARN

資源ARN列表，指定策略生效的資源範圍。支援萬用字元*。

Condition

Object

否

—

策略生效條件。支援IP地址限制等條件，使用標準IAM Condition文法。

許可權巨集指令清單

以下為OSS Tables支援的所有Action列表：

資源層級

Action

說明

跨帳號訪問

Table Bucket 層級

oss:CreateTableBucket

建立Table Bucket。

不允許

oss:GetTableBucket

擷取Table Bucket資訊。

允許

oss:ListTableBuckets

列舉要求者擁有的所有Table Bucket。

不允許

oss:DeleteTableBucket

刪除Table Bucket。

允許

oss:CreateNamespace

建立Namespace。

允許

oss:DeleteNamespace

刪除Namespace。

允許

oss:ListNamespaces

列舉Table Bucket中的所有Namespace。

允許

oss:GetNamespace

擷取Namespace資訊。

允許

oss:PutTableBucketPolicy

設定Table Bucket的資源策略。

不允許

oss:GetTableBucketPolicy

擷取Table Bucket的資源策略。

不允許

oss:DeleteTableBucketPolicy

刪除Table Bucket的資源策略。

不允許

oss:GetTableBucketMaintenanceConfiguration

擷取Table Bucket的自動維護配置。

允許

oss:PutTableBucketMaintenanceConfiguration

設定Table Bucket的自動維護配置。

允許

oss:PutTableBucketEncryption

設定Table Bucket的加密配置。

不允許

oss:GetTableBucketEncryption

擷取Table Bucket的加密配置。

不允許

oss:DeleteTableBucketEncryption

刪除Table Bucket的加密配置。

不允許

Table 層級

oss:GetTableMaintenanceConfiguration

擷取Table的自動維護配置。

允許

oss:PutTableMaintenanceConfiguration

設定Table的自動維護配置。

允許

oss:PutTablePolicy

設定Table的資源策略。

不允許

oss:GetTablePolicy

擷取Table的資源策略。

不允許

oss:DeleteTablePolicy

刪除Table的資源策略。

不允許

oss:CreateTable

建立Table。

允許

oss:GetTable

擷取Table資訊。

允許

oss:GetTableMetadataLocation

擷取指定表的Metadata檔案位置資訊

允許

oss:ListTables

列舉Table Bucket中的所有Table。

允許

oss:RenameTable

重新命名Table。

允許

oss:UpdateTableMetadataLocation

更新指定表的Metadata檔案位置。

允許

oss:GetTableData

擷取 Table 中的資料。

允許

oss:PutTableData

向 Table 中寫入資料。

允許

oss:GetTableEncryption

擷取Table的加密配置。

不允許

oss:PutTableEncryption

修改Table的加密配置。

不允許

oss:DeleteTable

刪除Table。

允許

資源ARN格式

OSS Tables使用以下ARN（Alibaba Cloud Resource Name）格式標識資源：

資源層級

格式

樣本

Table Bucket

acs:osstables:{region}:{account_id}:bucket/{bucket_name}

acs:osstables:cn-beijing:1142323451804027:bucket/test-xx

Table

acs:osstables:{region}:{account_id}:bucket/{bucket_name}/table/{table_id}

acs:osstables:cn-beijing:1142323451804027:bucket/doc-test-1776656082/table/c3a22d63-xxxx-xxxx-xxxx-xxxxxxxxxxxx

上一篇：資料維護下一篇：服務端加密