Docs

Torch Object Storage

Authorizing other accounts

Allowing another account to access a directory of the current account

This topic explains how to allow another account to access a specific directory of the current account.

Scenario

Principal: Account 210000****.

Resource: The image directory in the bucketname1 bucket.

Notes

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Steps

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

Visual view

JSON view

Click Create policy.

On the Create Bucket Authorization Policy page, select Folder Read-Only and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, use the default value. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Use the default option, Other main account, and enter the account ID.
Resource	Resource scope	Use the default options, Current bucket, Objects in bucket, and Specified object(s). Set Resource path for Specified object(s) to image/. Click Add Field to specify multiple objects. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/*. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Action	General Action	The current template includes several pre-configured actions. You can leave them as they are or modify the allowed actions according to your needs. For more information on actions allowed by bucket policies, see Supported actions.
			Bucket Action
			Object Action
		Operational strategy	Use the default option, i.e., Include the above actions. This option allows users to perform the specified actions.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Next steps

Once the bucket policy has been created, the authorized account can download objects from the specified directory of the specified bucket using one of the following methods:

Use an API or SDK to download objects from the directory.

Use the resource path to access the directory via TOS browser and download the directory's contents.

Use tosutil commands to download objects from the directory.

warning

TOS does not support listing buckets from other accounts. Despite having the aforementioned permissions, the authorized account cannot download objects from the directory via the console.

Last updated: 2026.08.14 16:23:30