To grant IAM users all permissions on all TOS resources under the current account, use system managed IAM policies. For instructions, see Create a user and authorize it. Specifically, select the TOSFullAccess system managed policy during authorization.

Granting IAM users permission to create buckets and list all buckets

To grant IAM users permission to create buckets and list all buckets, use customer managed IAM policies. For instructions, see Policy Overview.

Example policy:

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "tos:CreateBucket",​
        "tos:ListBuckets"​
      ],​
      "Resource": [​
        "trn:tos:::*"​
      ]​
    }​
  ]​
}​

Granting IAM users permissions on specified resources

IAM policy

Bucket policy

For instructions, see Policy Overview. Example policy:

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "tos:List*"​
      ],​
      "Resource": [​
        "trn:tos:::test"​
      ]​
    }​
  ]​
}​

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket policies.

On the Bucket policies page, click the Visual view tab and then click Create policy.

On the Create Bucket Authorization Policy page, select Folder Read and Write and click Next.

Configure the following parameters.

Category	Description
Authorized user	Select Specified account. The details are as follows: Current main account: Grants permissions to one or more IAM users or subusers of the current account. The account ID is displayed by default. Click Add Field to select IAM users from the drop-down menu under Sub account name. Other main account: Grants permissions to one or more IAM users or subusers of another account. Enter the account ID. Then, click Add Field to enter an IAM username under Sub account name.
Resource	Select Specified object(s), and click the Add Field icon to specify the object(s).
Action	Select the general action(s) to be authorized. For more information, see General actions.
Condition (Optional)	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Last updated: 2026.08.14 16:23:29

Public security network record in Beijing: No. 11010802032137