Docs

File Storage vePFS

Access point

Configuring access point policies

By configuring access point policies, you can control how different IAM users or IAM roles within the same primary account access the file system. This allows for more granular permissions and enables flexible management of file system access rights. This article describes the steps for configuring an access point policy.

Prerequisites

You have created an access point. For more details, see Creating access points.

Usage

When access point policies are enabled, all IAM accounts (including the primary account, IAM users, and IAM roles) are blocked from mounting and accessing data through the access point by default. You must configure the access point client policy and grant it to the IAM account before you can mount and access data through the access point.

Enabling access point policies for access points that are already in use without policies enabled may interrupt ongoing operations.

Disabling the access point policy does not affect existing business access. To mount new clients, use an access point without an enabled policy.

Steps

In the top menu bar, select the region of the file system you want to manage.

In the left navigation pane, click File System > File System List.

On the File System page, click the file system you want to manage.

On the file system Overview page, click the Access Points tab.

On the Access Points page, click Manage in the Actions column of the target access point, or click the access point name directly.

On the access point Overview page, click the Access Point Policy tab.

In the Access Point Policy section, click the icon under IAM Policy to enable the access point policy.

tip

The Typical Policy Examples section provides recommended code for both Read Policy and Read/Write Policy. For details, see Typical Policy Examples.

If there is a related data flow policy in the root directory of the access point, the system automatically obtains relevant permissions from the TOS side to ensure consistency in data access permissions, and provides suggested configurations for file system mount permissions in the TOS Permissions and File System Mount Permissions Mapping section based on the acquired TOS permissions. For details, see TOS Permissions and File System Mount Permissions Mapping.

Configure access point client permission policies.

In the left navigation bar, select Permission policies.

On the Permission policies page, click Create Policy.

On the Create Policy page, enter the Policy Name and Description.

Click the JSON Editor tab.

Configure read-only or read-write policies according to your actual business needs.

tip

You can copy the sample code from the Access Point Policy tab's Sample Policies section on the vePFS console to the JSON Editor.

Click Submit.

Assign access point client permission policies to IAM user groups, IAM users, and IAM roles.

tip

IAM roles do not have permanent credentials and can only temporarily access vePFS through STS temporary AK/SK + token. When these credentials expire, the IAM role cannot access vePFS.

Once a policy is linked to a user group, all users in that group receive the same policy permissions.

After authorizing IAM users, IAM roles, or IAM user groups, it takes some time for the changes to take effect. Please wait patiently.

Authorize IAM user groups
Authorize IAM users
Authorize IAM roles
Create an IAM user. For instructions, see Creating IAM users.
Create an IAM user group. For instructions, seeCreating IAM user groups.
In the user group list, click the target user group name.
On the user group details page, select the Users tab, and click Add user.
On the Add user panel, select the user created in step 1, and click OK.
Select the Permissions tab, and click Add permission.
On the Add Authorization page, select the client permission policy.
Click Submit.
Create an IAM user. For instructions, see Creating IAM users.
tip
Skip this step if the IAM user already exists.
Grant client permission policy to the IAM user.
In the user list, click the target username.
On the User Details page, select the Permissions tab.
Click Add Permission.
On the Authorization page, select the client policy.
Click Submit.
Create an IAM user and grant this user the STSAssumeRoleAccess permission. For instructions, seeCreate user.
Create an IAM role. For instructions, seeCreate role.
tip
If the target IAM role already exists, skip this step.
Specify authorized users in the IAM role trust policy.
In the role list, click the target role name.
On the role details page, select the Trust Relationships tab.
On the Trust Relationships tab, click Edit trust policy.
Change the root user in the Principal parameter to the username you created in Step 1.
Click Save.
Grant client policy permissions to the IAM role.
In the role list, click the target role name.
On the Role Details page, select the Permissions tab.
On the Policy tab, click Authorize.
On the Add Permission page, select the target client policy.
Click Submit.
Obtain the temporary credentials through the AssumeRole API. For more information, see AssumeRole.

Typical policy examples

The recommended client permission policy configuration code is provided. See the example below:

Read-only policy

Read-write policy

​
​
      {​
        "Statement": [​
            {​
                "Effect": "Allow",​
                "Action": [​
                    "vepfs:ClientMount",​
                    "vepfs:ClientRootAccess"​
                ],​
                "Resource": ["trn:vepfs:<RegionCode>:<AccountId>:filesystem/<FilesystemId>"],​
                "Condition": {​
                    "StringEquals": {​
                        "volc:RequestTag/accesspoint": "<Access point ID>"​
                    }​
                }​
            },​
            {​
                "Effect": "Allow",​
                "Action": [​
                    "vepfs:VerifyAccessPoint",​
                    "vepfs:DescribeAccessPoints",​
                    "vepfs:CreateAccessPoint",​
                    "vepfs:ModifyAccessPoint",​
                    "vepfs:DeleteAccessPoint"​
                ],​
                "Resource": [​
                    "*"​
                ]​
            }​
        ]​
      }​
    ​

Key parameter description:

Parameter	Note
Action	Defines the scope of actions for permissions: vepfs:ClientMount: Supports mounting file systems and reading data. vepfs:ClientWrite: Supports writing data. Must be used together with ClientMount to enable file system mounting and data reading. vepfs:ClientRootAccess: Allows access using the root user. If this action is not authorized, access as the root user will be mapped to the nobody user. The nobody user is the default user in Linux systems. This user can only access public content on the server and has low permissions with high security. If an endpoint is linked toPOSIXusers, thosePOSIXusers are alsoaffected by ClientRootAccess. For example, ifPOSIXis bound touser rootbutClientRootAccessis not granted, all I/OPOSIXusers mounted through the access pointwill be mapped tothe nobody user.
Resource	Defines the scope of resources for permissions. If resource scope control is not required, enter * to indicate permissions are valid for all vePFS resources. If resource scope control is needed, enter the access point TRN. For instructions on viewing the access point TRN, refer toView access point information.
Condition	Defines the conditions under which permissions take effect. For detailed information about Condition, see Condition.

TOS permission and file system mount permission mapping

The TOS permission and file system mount permission mapping section displays the linked TOS buckets at the access point and the recommended file system mount permissions, including:

TOS bucket: Information about the TOS bucket currently linked to the access point.

Action: Recommended file system mount permissions, mapped from the permission settings of the corresponding TOS bucket. The mapping between TOS permissions and file system mount permissions is as follows.

tip

Meeting any one of the TOS bucket policies, TOS Bucket ACL, or IAM policy conditions is sufficient; all conditions are not required.

File system mount permissions	TOS bucket policy	TOS Bucket ACL	IAM policy
ClientMount	HeadBucket and ListBucket and GetObject	Read permissions	Preset policies: TOSReadOnlyAccess Custom policies: HeadBucket, ListBucket, and GetObject
ClientMount ClientWrite	HeadBucket and (PutObject or DeleteObject)	Write permissions Or Read and write permissions	Preset policies: TOSFullAccess, AdministratorAccess Custom policy: HeadBucket and (PutObject or DeleteObject)

User list: Recommended user information for authorization.

Last updated: 2026.03.03 10:21:55