Docs

Torch Object Storage

FAQ

Access control FAQ

Category	FAQ
Bucket policy	How do I configure a bucket policy? How can I verify that the JSON configuration passed via API is correct? What is the relationship between bucket policies and access control lists (ACLs) for buckets and objects? Can they coexist? Can I grant permissions to a specific directory within a TOS bucket? How can I view the permissions for an existing bucket?
IAM policy	How can I give an IAM user permission to view only a specific bucket? How can I grant an IAM user permissions for cross-region replication? If I skip configuring role permissions when creating an IAM role, does IAM assign default permissions to the role?
ACL	How can I make a private bucket publicly readable?
Others	Why can't I view the bucket's usage statistics and other information? I receive a message saying that I lack the necessary permissions. Can I grant different IAM users access permissions to different objects via API? Why aren't the configured permissions taking effect?

Bucket policy

How do I configure a bucket policy? How can I verify that the JSON configuration passed via API is correct?

Bucket policy configuration is relatively complex. We recommend using the visual editor in the TOS console. If you need to create a bucket policy using the JSON editor, however, refer to IAM policies.

What is the relationship between bucket policies and access control lists (ACLs) for buckets and objects? Can they coexist?

A bucket policy is a flexible authorization method that allows you to grant specific permissions to Identity and Access Management (IAM) accounts, users, or anonymous users for certain resources.

In contrast, bucket and object ACLs are a convenient, coarse-grained authorization method that allows you to grant public read or write access to a bucket, or public read access to an object.

Both can coexist. When both are configured, the bucket policy takes precedence.

Can I grant permissions to a specific directory within a TOS bucket?

Yes. You can use a bucket policy to grant read/write permissions to a specific directory. For more information, see Bucket policies.

How can I view the permissions for an existing bucket?

When creating a bucket, if you set the bucket permission to public read, a bucket policy that allows access to all users is automatically generated.

IAM policy

How can I give an IAM user permission to view only a specific bucket?

You can do so using an IAM policy. For more information, see IAM policy examples.

How can I grant an IAM user permissions for cross-region replication?

You can do so using an IAM policy. For more information, see IAM policies.

If I skip configuring role permissions when creating an IAM role, does IAM assign default permissions to the role?

IAM does not assign default permissions to a role. You must manually add the required permissions to the role. For more information, see IAM policy overview.

ACL

How can I make a private bucket publicly readable?

You can set bucket permissions using a bucket ACL. For more information, see Configuring bucket ACLs.

Others

Why can't I view the bucket's usage statistics and other information? I receive a message saying that I lack the necessary permissions.

To view usage statistics, you must have read-only access to Cloud Monitor. For authorization steps, see Granting read-only access to Cloud Monitor.

Can I grant different IAM users access permissions to different objects via API?

No. Currently, granting permissions in batches via API is not supported. For this purpose, you can use bucket policies or IAM policies. For more information, see Bucket policies and IAM policies.

Why aren't the configured permissions taking effect?

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Last updated: 2026.06.22 15:21:16