Big Data File Storage
Big Data File Storage
Document
- Documentation
Big Data File StorageUser GuideManagement permissionsCloudFS Actions
Copy page
Download PDFManagement permissions
CloudFS Actions
Copy pageDownload PDFCloudFS Actions
This document introduces the Actions supported by CloudFS and provides common permission policy examples.
Background information
A policy describes permissions. IAM provides identity-based policies and resource-based policies. Whether for users, user groups, or roles, permissions must be granted by associating policies. For more information, refer to policy syntax.
Each policy consists of the following elements:
- Statement: The Statement element encapsulates policy statements and can contain a single statement or an array of multiple statements.
- Effect: The value is either "Allow" or "Deny", indicating whether operations on the specified resource are allowed.
- Action: Actions. Represents a specific Action, which has the same meaning as Action in the API.
- Resource: Specifies the resource to which the Action applies. Format: trn: {service}:{region}:{account}: {resourceType}/{id}.
Supported Actions
The Actions supported by CloudFS are shown in the following table.
Permissions | Authorized Action | Resource |
View file system list. | cfs:ListFs | trn:cfs:${region-id}:${account-id}:cfs/* |
Create file system instance. | cfs:CreateFs | trn:cfs:${region-id}:${account-id}:cfs/* |
Delete file system. | cfs:DeleteFs | trn:cfs:${region-id}:${account-id}:cfs/fsName |
Update file system, expand capacity, or enable acceleration. | cfs:UpdateFs | trn:cfs:${region-id}:${account-id}:cfs/fsName |
View Availability Zone and Region. | cfs:ListRegionAndZone | trn:cfs:${region-id}:${account-id}:cfs/* |
View file information in a specific directory under the specified file system. | cfs:ListDir | trn:cfs:${region-id}:${account-id}:cfs/fsName |
View VPC list. | cfs:DescribeVpcs vpc:DescribeVpcs (already included in cross-service authorization) | trn:cfs:${region-id}:${account-id}:cfs/* |
View security group information. | cfs:DescribeSecurityGroups vpc:DescribeSecurityGroups (included in cross-service authorization) | trn:cfs:${region-id}:${account-id}:cfs/* |
View subnet list under the specified VPC. | cfs:DescribeSubnetIds vpc:DescribeSubnets (included in cross-service authorization) | trn:cfs:${region-id}:${account-id}:cfs/* |
View object storage Bucket list. | cfs:ListTosBuckets tos:ListBuckets (included in cross-service authorization) | trn:cfs:${region-id}:${account-id}:cfs/* |
Read specified file. | cfs:Read | trn:cfs:${region-id}:${account-id}:${file-system-name}$ |
Upload file. | cfs:Write | trn:cfs:${region-id}:${account-id}:${file-system-name}$ |
View files and subdirectories in the specified TOS Bucket. | cfs:List | trn:cfs:${region-id}:${account-id}:${file-system-name}/$ |
Interface and Action mapping table
The mapping between interfaces and Actions in permission policies.
API | Action |
append | cfs:Write |
create | cfs:Write |
delete | cfs:Write and parent directory cfs:Write permissions |
getBlockLocations | cfs:Read |
mkdirs | cfs:Write |
rename | cfs:Write (sources), cfs:Write (destination) |
listPaths | Parent directory cfs:Read |
concat | cfs:Read (sources), cfs:Write (destination) |
getStoragePolicy | cfs:Read |
getXAttrs | cfs:Read |
listXAttrs | cfs:Read |
getContentSummary | cfs:Read |
removeXAttr | cfs:Write |
setReplication | cfs:Write |
setStoragePolicy | cfs:Write |
setTimes | cfs:Write |
setXAttr | cfs:Write |
getFileInfo | cfs:Read |
getFileLinkInfo | cfs:Read |
getLinkTarget | cfs:Read |
getListing | cfs:List tip When using the cfs:List permission, you need to be aware of the following:
|
Permission policy examples
Example 1: Full control permission for a specific path
Grants the user full control permission for the /path and its subpaths.
{
"Statement" : [
{
"Effect" : "Allow",
"Action" : [
"cfs:*"
],
"Resource": [
"trn:cfs:*:*:{file-system-name}/path/*"
]
}
]
}
Example 2: Read permission for a specific path
Grants the user read permission for the /readPath and its subpaths.
{
"Statement" : [
{
"Effect" : "Allow",
"Action" : [
"cfs:Read"
],
"Resource": [
"trn:cfs:*:*: {file-system-name}/readPath/*"
]
}
]
}
Example 3: Write permission for a specific path and deny delete operation for a subpath
Grants the user write permission for the /writePath and its subpaths. At the same time, write permission for the /writePath/subPath/ is denied, so delete operations for this path are prohibited.
{
"Statement" : [
{
"Effect" : "Allow",
"Action" : [
"cfs:Write"
],
"Resource": [
"trn:cfs:*:*: {file-system-name}/writePath/*"
]
}
{
"Effect" : "Deny",
"Action" : [
"cfs:Write"
],
"Resource": [
"trn:cfs:*:*: {file-system-name}/writePath/subPath/"
]
}
]
}
Example 4: Disable List permission in data lake mode
Disables the user's List permission for a mounted TOS Bucket. After disabling, FUSE mounting can proceed normally, and cd, cat, cp, and other read/write operations can be performed, but ls is not allowed.
The following permission policy has the following effects:
- Grants the user full control permission for the Bucket with Namespace ID 12345.
- Disables the user's List permission for the Bucket with Namespace ID 12345.
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"cfs:*"
],
"Resource": [
"trn:cfs:*:*:{file-system-name}/12345"
]
},
{
"Effect": "Deny",
"Action": [
"cfs:List"
],
"Resource": [
"trn:cfs:*:*:{file-system-name}/12345"
]
}
]
}
Last updated: 2026.02.02 11:20:49
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
