Docs

Torch Object Storage

IAM policies

Overview

After creating an Identity and Access Management (IAM) user, you must grant the user permissions by selecting specific IAM policies. This topic covers what you need to know about IAM policies.

Background information

For more information, see the IAM documentation.

Use cases

Use an IAM policy if you need to:

Grant IAM users permissions for multiple cloud resources.

Grant the same permissions to multiple buckets.

Assign different permissions to different IAM users.

Configure service-level permissions, for example, creating buckets or listing all buckets under an account.

System managed IAM policies

IAM presets the following policies for TOS.

Policy name	Description	TOS actions
AdministratorAccess	Provides full access to all services and resources.	Allows the specified user(s) to perform all actions supported by TOS on a bucket and the objects in it.
TOSFullAccess	Provides full access to all TOS buckets.	Allows the specified user(s) to perform all actions supported by TOS on all the buckets and objects of the account.
TOSReadOnlyAccess	Provides read only access to all TOS buckets.	Allows the specified user(s) to perform the following actions on a bucket and the objects in it: Get: all GET operations. List: all LIST operations. HeadBucket: Check whether a bucket exists.

Supported actions

General actions

Action	Description
*	A wildcard, which grants permission to perform all supported actions on the resource.
Get*	Grants permission to perform all GET actions on the resource.
Put*	Grants permission to perform all PUT actions on the resource.
List*	Grants permission to perform all List actions on the resource.

Bucket actions

Category	Action	Description
Bucket operation	CreateBucket	Grants permission to create a new bucket.
		ListBuckets	Grants permission to list all buckets owned by the requester.
		ListBucket	Grants permission to list objects in a bucket and retrieve the bucket's metadata.
		HeadBucket	Grants permission to check whether a bucket exists.
		DeleteBucket	Grants permission to delete a bucket.
		PutBucketStorageClass	Grants permission to set the default storage type for a bucket.
Bucket policy	GetBucketPolicy	Grants permission to obtain the bucket policy on a bucket.
		PutBucketPolicy	Grants permission to add or replace a bucket policy on a bucket. This permission allows users to get other permissions.
		DeleteBucketPolicy	Grants permission to delete the bucket policy on a bucket.
Bucket access control list (ACL)	GetBucketACL	Grants permission to return the ACL of a bucket.
Bucket access control list (ACL)		PutBucketACL	Grants permission to set the permissions on a bucket using ACL.
Cross-origin resource sharing (CORS) rule	GetBucketCORS	Grants permission to retrieve information about the CORS rules of a bucket.
Cross-origin resource sharing (CORS) rule		PutBucketCORS	Grants permission to create a CORS rule for a bucket.
Mirroring rule	GetBucketMirror	Grants permission to retrieve information about mirroring rules of a bucket.
		PutBucketMirror	Grants permission to configure mirroring rules for a bucket.
		DeleteBucketMirror	Grants permission to delete mirroring rules of a bucket.
Event notification	PutBucketNotification	Grants permission to place or delete event notification configurations for a bucket.
Event notification		GetBucketNotification	Grants permission to obtain the event notification configurations of a bucket.
Custom domain	PutBucketCustomDomain	Grant permission to associate a custom domain name with a bucket.
		GetBucketCustomDomain	Grant permission to obtain custom domain configurations of a bucket.
		DeleteBucketCustomDomain	Grant permission to remove a custom domain name from a bucket.
Bucket inventory	PutBucketInventory	Grants permission to create bucket inventory rules for a bucket.
		GetBucketInventory	Grants permission to retrieve information about a specific bucket inventory rule of a bucket.
		DeleteBucketInventory	Grants permission to delete specific bucket inventory rules of a bucket.
		ListBucketInventory	Grants permission to retrieve information about bucket inventory rules of a bucket.
Server-side encryption	PutBucketEncryption	Grants permission to configure server-side encryption for a bucket.
		GetBucketEncryption	Grants permission to obtain the server-side encryption configurations of a bucket.
		DeleteBucketEncryption	Grants permission to delete the server-side encryption configurations of a bucket.
RenameObject	PutBucketRename	Grants permission to enable RenameObject on a bucket.
		DeleteBucketRename	Grants permission to disable RenameObject on a bucket.
		GetBucketRename	Grants permission to check if RenameObject is enabled for a bucket.
Bucket replication	PutBucketReplication	Grants permission to create a cross-region or same-region replication rule for a bucket.
		GetBucketReplication	Grants permission to retrieve information about cross-region or same-region replication of a bucket.
		DeleteBucketReplication	Grants permission to delete cross-region or same-region replication rules of a bucket.
Bucket tag	GetBucketTagging	Grants permission to obtain the tag set of a bucket.
		PutBucketTagging	Grants permission to add a set of tags to a bucket.
		DeleteBucketTagging	Grants permission to remove the entire tag set of a bucket.
Transfer acceleration	PutBucketTransferAcceleration	Grants permission to configure transfer acceleration for a bucket.
Transfer acceleration		GetBucketTransferAcceleration	Grants permission to obtain transfer acceleration configurations of a bucket.
Versioning	PutBucketVersioning	Grants permission to set the versioning state of a bucket.
Versioning		GetBucketVersioning	Grants permission to obtain the versioning state of a bucket.
Static website	PutBucketWebsite	Grants permission to host a static website on a bucket.
		GetBucketWebsite	Grants permission to obtain the website configurations of a bucket.
		DeleteBucketWebsite	Grants permission to delete the website configurations of a bucket.
Lifecycle rule	PutLifecycleConfiguration	Grants permission to add or replace lifecycle configurations for a bucket.
Lifecycle rule		GetLifecycleConfiguration	Grants permission to obtain the lifecycle rule configurations of a bucket.

Object actions

Category	Action	Description
Object operation	PutObject	Grants permission to add an object to a bucket.
		GetObject	Grants permission to retrieve the content and metadata of an object.
		RenameObject	Grants permission to rename an object.
		RestoreObject	Grants permission to restore an archived copy of an object.
		ListBucketVersions	Grants permission to list all the versions of objects in a bucket.
		DeleteObject	Grants permission to delete an object.
		GetBucketLocation	Grants permission to return the region that a bucket resides in.
Object ACL	PutObjectAcl	Grants permission to set the permissions on an object using ACL.
Object ACL		GetObjectAcl	Grants permission to obtain the ACL of an object.
Object tag	PutObjectTagging	Grants permission to add a set of tags to an object.
		DeleteObjectTagging	Grants permission to remove the entire tag set of an object.
		GetObjectTagging	Grants permission to obtain the tag set of an object.
Others	AbortMultipartUpload	Grants permission to abort a multipart upload.
		ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads.
		ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload.

Supported resources

In an IAM policy, resources define the scope on which permissions take effect

Resource type	Resource	TRN	Actions allowed
Bucket	Specified bucket	trn:tos:{region}:{accountid}:	Bucket actions tip If you want to include the ListBuckets action in your IAM policy, you must set "Resource" to "Resource": [ "*"].
Object	Specified object	trn:tos:{region}:{accountid}:{bucket}/	Object actions

Supported conditions

In an IAM policy, conditions determine the circumstances under which permissions take effect. The following section introduces global condition keys. For more information on service-specific condition keys, see Conditions.

tip

For more information about condition operators, see Condition operators.

Condition key	Description
volc:SourceIp	The source IP of the request. It supports both IPv4 and IPv6 addresses and ranges.
volc:UserName	The IAM username of the requester.
volc:ViaConsole	Whether the request is made via the console. Possible values: true: Access via the console. false: Access via APIs.
volc:PrincipalTrn	The TRN of the requester. The TRN format varies according to the requester. IAM users (including those who log in via user SSO): trn:iam::${AccountId}:user/$ IAM roles (those who use temporary credentials after role assumption, including logging in via role SSO): trn:iam::${AccountId}:role/$ Root users (accounts or root users, not IAM users or roles of accounts): trn:iam::${AccountId}:root
volc:RequestedRegion	The requested region.
volc:CurrentTime	The exact time, down to the second, that the server receives a request, expressed in UTC. It supports the standard ISO 8601 format (YYYY-MM-DD'T'HH:MM:SS'Z') or a Unix timestamp (e.g., 2023-08-30T23:59:59Z).
volc:ResourceTag/$	The tag (tag value + tag_key) attached to the resources that can be accessed. This condition requires you to include a resource ID in the request. For certain List APIs, if no resource ID is provided, the request will fail the authorization check because it will be interpreted as a query for all resources.
volc:RequestTag/$	The tag (tag value + tag_key ) that must be included in the request, including any tags that are added to or removed from a resource by the request. However, this does not include tags used for filtering when Query is used.
volc:RequestTagKeys	The tag key(s) that must be included in the request, including any tags that are added to or removed from a resource by the request. However, this does not include tags used for filtering when Query is used.

Creating customer managed IAM policies

If the default IAM policies do not meet your needs, you can create your own policy by referring to the following topics:

Configuring IAM policies

IAM policy examples

Last updated: 2026.08.10 10:14:53