Docs

Torch Object Storage

Multi-region access points (MRAP)

Creating multi-region access point policies

A multi-region access point streamlines global data access by enabling access to buckets located in different regions through a single endpoint. However, if your account does not have permission to access the buckets attached to the access point, your requests may fail. You can configure a multi-region access point policy to grant your account the necessary permissions. This approach allows you to focus on principals and actions at the access point level, rather than managing permission policies for individual buckets. As a result, the complexity of maintaining cross-region and cross-bucket permission policies is reduced. This topic describes how to create a multi-region access point policy and delegate access to the access point.

Notes

The total JSON description size of multi-region access point policies per account cannot exceed 20 KB.

Scenario

Company A collects a batch of data and stores it in three buckets: prod, test, and dev. To ensure data security, only the Identity and Access Management (IAM) user "data-dev" will have GetObject and PutObject permissions for the data in these buckets.

In this scenario, you can create a multi-region access point associated with the "prod", "test", and "dev" buckets. Next, create a multi-region access point policy and delegate access control for the buckets to the access point. Once this is complete, the IAM user "data-dev" will be able to access the data in these three buckets via the multi-region access point.

Creating an access point policy

You can create access point policies using either a visual or JSON editor. Choose the method that best suits your needs.

Creating an access point policy in visual view

In the left navigation pane, select Access point > Multi-Region Access Points.

On the Multi-Region Access Points page, click the multi-region access point you want to manage.

On the multi-region access point details page, click the Permission tab.

On the Visual view tab, click Create policy.

Under Select template, choose a policy template and click Next step.

In this scenario, select Custom Policy.

tip

Access point policy templates and bucket policy templates have the same resource scope and actions. When selecting an access point policy template, you can refer to the documentation for bucket policy template. For more information, see Bucket policy templates.

Under Configure policy, configure the following parameters and click Next step.

Parameter	Description	Example value
Policy configuration method	Select Visual view.	Visual view
Policy name	Enter a name for the access point policy.	Custom Policy-daf6
Effect	Select whether the policy results in an allow or a deny. Allow: Allows the matched requests. Deny: Denies the matched requests.	Allow
Authorized user	Specified account: The policy only applies to the specified account(s). Options: Current main account: Grants permissions to one or more IAM users or subusers of the current account. The account ID is displayed by default. Click Add row to select IAM users from the dropdown menu under Sub account name. Other main account: Grants permissions to another account and its IAM users or subusers. Enter the account ID and IAM username(s). All users: The policy applies to all users, including those who are anonymous and not authenticated. In this case, selecting Allow for the Effect setting may lead to data security risks. Use with caution.	Select Current main account, click Add row, and select data-dev
User Policy	Select whether to include or exclude the specified user(s). You can only set the User Policy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above users: Denies specified users certain permissions. Exclude the above users: Denies certain permissions to all users except those specified. tip The "Exclude the above users" option is used only to deny permissions. It does not grant permissions. To grant specific users certain permissions, you must also create the corresponding permission policies. For guidance, see Using NotPrincipal to deny access to all users except those specified.	None
Resource	Current Multi-Region Access Points: The policy applies to all buckets attached to the multi-region access point. You can configure bucket actions in the Action section. Objects in bucket: The policy takes effect on the objects in the bucket. You can configure object actions in the Action section. All objects: The policy takes effect on all objects in the bucket. Specified object(s): If you select Specified object(s), click the Add row icon to specify the object(s).	Select Current Multi-Region Access Points, Objects in bucket, and All objects
Resource strategy	Select whether to include or exclude the specified resource(s). You can only set the resource strategy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above resources: Denies users access to the specified resources. Exclude the above resources: Denies users access to any resource except those specified. tip The "Exclude the above resources" option is used only to deny users access to certain resources. It does not grant permissions. To grant users access to certain resources, you must also create the corresponding permission policies. For guidance, see Using NotResource to deny users access to any resource except those specified.	None
Action	Select the action(s) to be authorized. For more information, see Supported actions.	Select GetObject and PutObject.
Operational strategy	Select whether to include or exclude the specified action(s). How the operational strategy works depends on the effect you previously selected. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies. The options are explained below when Effect is Allow. Include the above actions: Allows users to perform the specified actions. Exclude the above actions: Allows users to perform any action except those specified. For guidance, see Using NotAction to allow users to perform any action except those specified.	Include the above actions
Condition	Click the Add row icon and set the condition and value. For more information, see Conditions.	None

Under Confirm policy, click Select.

Creating an access point policy in JSON view

In the left navigation pane, select Access point > Multi-Region Access Points.

On the Multi-Region Access Points page, click the multi-region access point you want to manage.

On the multi-region access point details page, click the Permission tab.

Click the JSON view tab.

Click Edit and enter the policy content.

Example policy:

{
"Statement": [
{
"Sid": "Custom Policy-daf6",
"Effect": "Allow",
"Principal": [
"210015****/data-dev"
],
"Action": [
"tos:GetObject",
"tos:PutObject"
],
"Resource": [
"trn:tos::210015****:accesspoint/m941ea886****-mrap",
"trn:tos::210015****:accesspoint/m941ea886****-mrap/object/*"
],
}
]
}

tip

When specifying the resources, use the following formats: trn:tos::<account ID>:accesspoint/<multi-region access point alias> for buckets and trn:tos::<account ID>:accesspoint/<multi-region access point alias>/object/<directory path> for objects. You can find the access point alias on the multi-region access point details page.

Once you have finished configuring, click Select.

Delegating access to an access point

When accessing bucket resources via an access point, the system evaluates both the access point policy and the bucket policy. Access is granted only if both policies permit it. Access will be denied if either policy denies or does not authorize the operation. After creating a multi-region access point policy, you must configure bucket policies for all associated buckets to delegate access to the access point. Then, you can access the resources of the buckets through the access point.

TOS provides a visual permission delegation feature. On the Access point permission delegation panel, you can select a delegation type. The system then automatically generates the corresponding authorization statement. After you verify the details, the system authomatically creates the statements within the bucket policies of all associated buckets. This feature simplifies complex bucket policy configurations and enables permission isolation based on access points.

In the left navigation pane, select Access point > Multi-Region Access Points.

On the Multi-Region Access Points page, click the multi-region access point you want to manage.

On the multi-region access point details page, click the Permission tab.

On the Visual view tab, click Access point permission delegation.

Under Select delegate type, set the Delegation type, and then click Generation Policy.

Delegation type	Description	Example value
DataAccessPointTrn	Delegates access to the current access point. After delegation, this access point becomes available.	Select DataAccessPointAccount
DataAccessPointAccount	Delegates access to all access points within the current account. After delegation, all access points within the current account become available.	Select DataAccessPointAccount

After confirming that the policy content is correct, click Submit under Generation Policy.

Then, you can view the results under Delegate result.

Next steps

Once you have successfully delegated access to the access point, you can share it with other users, allowing them to access related resources through it. For instructions, see Using multi-region access points.

Last updated: 2026.01.21 16:38:32