Docs

Torch Object Storage

Permissions

Bucket ACLs

In the TOS console, you can create account authorizations to manage permissions for buckets and their access control lists (ACLs). Specifically, you can grant an Identity and Access Management (IAM) master account permissions to read and write the current bucket and its ACL. The grantee can then access the bucket using the access key ID (AK) and secret access key (SK).

Prerequisites

To configure the ACL for your bucket, your account must either create the bucket or have write access to its ACL.

Creating account authorizations

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket ACLs. On the Bucket ACLs page, click Create Account Authorization.

Set the following parameters in the box that appears:

Parameter	Description	Remarks
Account ID	The ID of the IAM master account.	ACL configuration is only available for master account IDs, not IAM users.
Bucket Access Permission	The following bucket access permissions are available: Read Permission: Selecting only the Read Permission option allows grantees to retrieve bucket and object metadata and download objects. Selecting both Read Permission and Include object list/multi-parts list gives grantees permission to retrieve bucket and object metadata, download objects, and list objects and multipart uploads. Write Permission: Allows grantees to upload objects, overwrite existing objects, and delete objects.	This operation is risky. Proceed with caution.
ACL Access Permission	The following ACL permissions are available: Read Permission: Allows grantees to read the bucket's ACL. Write Permission: Allows grantees to modify or delete the bucket's ACL.	Granting Write Permission is risky. Proceed with caution.

Click Save.

tip

Once you have authorized the account, you can view the permissions that have been created in the list. To edit permissions, you can click Edit or Delete in the Actions column of the desired authorized account.

Granting public access permissions

Follow the steps below to authorize all users, including anonymous users.

warning

Exercise caution when granting public access permissions to your bucket. In this case, all users, including anonymous users, can access your bucket without authentication. This can cause security issues.

After public access permissions are created, they can be edited but not deleted.

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket ACLs.

In the Public Access Permission section of the Bucket ACLs page, click Edit in the Actions column of All users.

Set the following parameters in the box that appears:

Parameter	Description
Bucket Access Permission	The following bucket access permissions are available: Read Permission: Selecting only the Read Permission option allows all users to retrieve bucket and object metadata and download objects. Selecting both Read Permission and Include object list/multi-parts list gives all users permission to retrieve bucket and object metadata, download objects, and list objects and multipart uploads. Write Permission: Allows all users to upload objects, overwrite existing objects, and delete objects.
ACL Access Permission	The following ACL permissions are available: Read Permission: Allows all users to read the bucket's ACL. Write Permission: Allows all users to modify or delete the bucket's ACL.

Click Save.

tip

After authorizing all users, you can view the created permission in the list or modify it by clicking Edit in the Actions column.

Last updated: 2026.07.24 11:20:32