This topic explains how to configure access control using both VPC endpoint policies and permission policies, along with examples of related scenarios.

Notes

TOS can only obtain the authentication context, or SourceVpc, from requests sent through VPC endpoints. If the tos:sourcevpc condition is set only in bucket or IAM policies and the corresponding gateway endpoint is not created, TOS cannot obtain the SourceVpc. This causes TOS to fail to identify the VPC source of the request and renders the tos:sourcevpc condition ineffective.

Steps

First, configure the access policy for the VPC endpoint that you want to use. This defines which TOS resources can be accessed. Next, create a bucket policy or an IAM policy to grant permissions for specific actions on the TOS resources via the VPC endpoint.

Configure the access policy for a VPC gateway endpoint.

You can configure the Access policy when creating a VPC endpoint. Specify allowed actions through the Action element and define accessible TOS resources through the Resource element. You can also use the Condition element to grant access to buckets with specific tags, such as tos:BucketTag. For instructions, see Creating a gateway endpoint and Modifying an endpoint.

Create a bucket or IAM policy.

When creating a bucket policy, you can specify authorized VPCs in Condition using tos:sourcevpc. Use the condition key rolename to limit access to specific IAM roles for other cloud services or internal requests within TOS. For instructions, see Creating a custom bucket policy in JSON view or Creating a custom bucket policy in visual view.

When creating an IAM policy, you can specify authorized VPCs in Condition using SourceVpc. For instructions, see Configuring IAM policies.

Example 1: Grant permission to perform all actions on a bucket via a VPC endpoint

Scenario: Use a VPC endpoint policy and a bucket policy to allow all accounts to perform all actions on the tos-example bucket via a VPC endpoint.

Example VPC endpoint policy:

{
"Statement": [
{
"Effect": "Allow",
"Principal": [
"*"
],
"Action": ["*"],
"Resource": [
"trn:tos:::tos-example",
"trn:tos:::tos-example/*"
]
}
]
}

Example bucket policy:

{
"Statement": [
{
"Sid": "id-11",
"Effect": "Allow",
"Principal": [
"*"
],
"Action": [
"*"
],
"Resource": [
"trn:tos:::tos-example",
"trn:tos:::tos-example/*"
],
"Condition": {
"StringEquals": {
"tos:sourcevpc": [
"vpc-pedgr4xdnklc4acvz69o****"
]
}
}
}
]
}

Example 2: Grant permission to upload to and download from a bucket via a VPC endpoint

Scenario: Use a VPC endpoint policy and a bucket policy to allow all accounts to upload to and download from the tos-example bucket via a VPC endpoint.

Example VPC endpoint policy:

{
"Statement": [
{
"Effect": "Allow",
"Principal": [
"*"
],
"Action": ["tos:PutObject","tos:GetObject"],
"Resource": [
"trn:tos:::tos-example/*"
]
}
]
}

Example bucket policy:

{
"Statement": [
{
"Sid": "id-11",
"Effect": "Allow",
"Principal": [
"*"
],
"Action": [
"tos:PutObject",
"tos:GetObject"
],
"Resource": [
"trn:tos:::tos-example/*"
],
"Condition": {
"StringEquals": {
"tos:sourcevpc": [
"vpc-pedgr4xdnklc4acvz69o****"
]
}
}
}
]
}

Example 3: Grant permission to upload to and download from a group of buckets via a VPC endpoint

TOS allows you to control access through bucket tags. Classify your buckets using bucket tags and apply VPC endpoint and IAM policies to grant access to buckets with specific tags via a VPC endpoint.

Scenario: Use a VPC endpoint policy and an IAM policy to allow all accounts to upload to and download from buckets with the Tag1:Value1 tag via a VPC endpoint.

Example VPC endpoint policy:

{
"Statement": [
{
"Effect": "Allow",
"Principal": [
"*"
],
"Action": ["tos:PutObject","tos:GetObject"],
"Resource": [
"*"
],
"Condition":{
"StringEquals":{
"tos:BucketTag/Tag1": ["Value1"]
}
}
}
]
}

Example IAM policy:

{
"Statement": [
{
"Sid": "id-11",
"Effect": "Allow",
"Action": [
"tos:PutObject",
"tos:GetObject"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"SourceVpc": [
"vpc-pedgr4xdnklc4acvz69o****"
]
}
}
}
]
}

Example 4: Grant permission to upload to and download from a bucket via a VPC endpoint, including requests to replicate objects across regions

Configuring both a VPC endpoint policy and a bucket policy for a bucket may prevent other cloud services from accessing this bucket. Internal TOS operations on this bucket, such as cross-region replication and bucket inventory requests, may also fail. To resolve this issue, you can use the condition key rolename to permit the other service or internal request to upload to and download from the bucket.

Scenario: Use a VPC endpoint policy to allow all accounts to upload to and download from the tos-example bucket via a VPC endpoint. Use a bucket policy to allow uploads to and downloads from the tos-example bucket via the VPC endpoint, including requests to replicate objects across regions.

Example VPC endpoint policy:

{
"Statement": [
{
"Effect": "Allow",
"Principal": [
"*"
],
"Action": ["tos:PutObject","tos:GetObject"],
"Resource": [
"trn:tos:::tos-example/*"
]
}
]
}

Example bucket policy:

{
"Statement": [
{
"Sid": "id-11",
"Effect": "Allow",
"Principal": [
"*"
],
"Action": [
"tos:PutObject",
"tos:GetObject"
],
"Resource": [
"trn:tos:::tos-example/*"
],
"Condition": {
"StringEquals": {
"tos:sourcevpc": [
"vpc-pedgr4xdnklc4acvz69o****"
]
}
}
},
{
"Sid": "id-12",
"Effect": "Allow",
"Principal": [
"*"
],
"Action": [
"tos:PutObject",
"tos:GetObject"
],
"Resource": [
"trn:tos:::tos-example/*"
],
"Condition": {
"StringEquals": {
"tos:rolename": [
"ServiceRoleforReplicationAccessTOS"
]
}
}
}
]
}

You can also configure a bucket policy to deny access to everyone except those using a specified VPC or role. However, this configuration will prevent you from accessing the bucket via the console.

Example: Deny all requests—except those from the vpc-pedgr4xdnklc4acvz69o**** VPC and cross-region replication—from performing upload or download operations on the bucket.

{
"Statement": [
{
"Sid": "id-11",
"Effect": "Deny",
"Principal": [
"*"
],
"Action": [
"tos:PutObject",
"tos:GetObject"
],
"Resource": [
"trn:tos:::tos-example/*"
],
"Condition": {
"StringNotEquals": {
"tos:sourcevpc": [
"vpc-pedgr4xdnklc4acvz69o****"
],
"tos:rolename": [
"ServiceRoleforReplicationAccessTOS"
]
}
}
}
]
}

rolename

The table below lists the role names for other cloud services and internal TOS requests.

Requests from	rolename
Cross-region replication	ServiceRoleforReplicationAccessTOS
Bucket inventory	TosArchiveTOSInventory
Other cloud services	The role name for the service. tip To obtain the rolename for another cloud service, first create an IAM role for the service and set the trust identity to "Services". For how to create an IAM role, see Role Management.

Torch Object Storage