Docs

Torch Object Storage

Manage Bucket Configuration

Managing Bucket Policies (Node.js SDK)

Bucket is the globally unique namespace of TOS, which is equivalent to a data container and is used to store object data. In TOS, permission control is realized by IAM Policy, bucket Policy, bucket and object ACL. Bucket Policy and ACL are both rights control policies based on TOS resources. Compared with bucket ACL, bucket Policy has more flexible rights configuration. This article describes how to set, obtain, and delete the authorization policy for a bucket.

Set bucket policy

warning

Before setting a bucket policy, you must have tos: PutBucketPolicypermission, see Overview.

Users with the tos: PutBucketPolicypermission can change the bucket policy arbitrarily, and can obtain other permissions through this permission. It is recommended that you configure it carefully.

Sample code

The following code sets the bucket policy.

// Import SDK, if the TOS Node.JS SDK version is less than 2.5.2, please change "TosClient" to "TOS" in the code below.​
import { TosClient, TosClientError, TosServerError } from '@volcengine/tos-sdk';​
​
// Create a client.​
const client = new TosClient({​
  accessKeyId: process.env['TOS_ACCESS_KEY'],​
  accessKeySecret: process.env['TOS_SECRET_KEY'],​
  region: "Provide your region", // Fill in the region where the Bucket is located. For example, if it is in China North 2 (Beijing), fill in "Provide your region" as cn-beijing.​
  endpoint: "Provide your endpoint", // Enter the domain address.​
});​
​
function handleError(error) {​
  if (error instanceof TosClientError) {​
    console.log('Client Err Msg:', error.message);​
    console.log('Client Err Stack:', error.stack);​
  } else if (error instanceof TosServerError) {​
    console.log('Request ID:', error.requestId);​
    console.log('Response Status Code:', error.statusCode);​
    console.log('Response Header:', error.headers);​
    console.log('Response Err Code:', error.code);​
    console.log('Response Err Msg:', error.message);​
  } else {​
    console.log('unexpected exception, message: ', error);​
  }​
}​
​
const bucketName = 'node-sdk-test-bucket';​
async function main() {​
  try {​
    const { requestId: putPolicyRequestId } = await client.putBucketPolicy({​
      bucket: bucketName,​
      policy: {​
        Statement: [​
          {​
            Sid: 'internal public',​
            Effect: 'Allow',​
            Action: ['*'],​
            Principal: '*',​
            Resource: [`trn:tos:::${bucketName}/*`, `trn:tos:::${bucketName}`],​
          },​
        ],​
      },​
    });​
    console.log('putBucketPolicy Request ID: ', putPolicyRequestId);​
  } catch (error) {​
    handleError(error);​
  }​
}​
​
main();​

Get bucket policy

warning

You must have the tos: GetBucketPolicy permission before you can get the bucket policy, see Permissions Configuration Guide.

Sample code

The following code is used to obtain the bucket policy.

// Import SDK, if the TOS Node.JS SDK version is less than 2.5.2, please change "TosClient" to "TOS" in the code below.​
import { TosClient, TosClientError, TosServerError } from '@volcengine/tos-sdk';​
​
// Create a client.​
const client = new TosClient({​
  accessKeyId: process.env['TOS_ACCESS_KEY'],​
  accessKeySecret: process.env['TOS_SECRET_KEY'],​
  region: "Provide your region", // Fill in the region where the Bucket is located. For example, if it is in China North 2 (Beijing), fill in "Provide your region" as cn-beijing.​
  endpoint: "Provide your endpoint", // Enter the domain address.​
});​
​
function handleError(error) {​
  if (error instanceof TosClientError) {​
    console.log('Client Err Msg:', error.message);​
    console.log('Client Err Stack:', error.stack);​
  } else if (error instanceof TosServerError) {​
    console.log('Request ID:', error.requestId);​
    console.log('Response Status Code:', error.statusCode);​
    console.log('Response Header:', error.headers);​
    console.log('Response Err Code:', error.code);​
    console.log('Response Err Msg:', error.message);​
  } else {​
    console.log('unexpected exception, message: ', error);​
  }​
}​
​
const bucketName = 'node-sdk-test-bucket';​
async function main() {​
  try {​
    const { data, requestId: getPolicyRequestId } = await client.getBucketPolicy(bucketName);​
    console.log('getBucketPolicy Request ID: ', getPolicyRequestId);​
    console.log('Policy: %o', data);​
  } catch (error) {​
    handleError(error);​
  }​
}​
​
main();​

Delete bucket policy

warning

Before deleting a bucket policy, you must have tos: DeleteBucketPolicypermission, see Overview.

Sample code

The following code is used to delete the bucket policy.

// Import SDK, if the TOS Node.JS SDK version is less than 2.5.2, please change "TosClient" to "TOS" in the code below.​
import { TosClient, TosClientError, TosServerError } from '@volcengine/tos-sdk';​
​
// Create a client.​
const client = new TosClient({​
  accessKeyId: process.env['TOS_ACCESS_KEY'],​
  accessKeySecret: process.env['TOS_SECRET_KEY'],​
  region: "Provide your region", // Fill in the region where the Bucket is located. For example, if it is in China North 2 (Beijing), fill in "Provide your region" as cn-beijing.​
  endpoint: "Provide your endpoint", // Enter the domain address.​
});​
​
function handleError(error) {​
  if (error instanceof TosClientError) {​
    console.log('Client Err Msg:', error.message);​
    console.log('Client Err Stack:', error.stack);​
  } else if (error instanceof TosServerError) {​
    console.log('Request ID:', error.requestId);​
    console.log('Response Status Code:', error.statusCode);​
    console.log('Response Header:', error.headers);​
    console.log('Response Err Code:', error.code);​
    console.log('Response Err Msg:', error.message);​
  } else {​
    console.log('unexpected exception, message: ', error);​
  }​
}​
​
const bucketName = 'node-sdk-test-bucket';​
async function main() {​
  try {​
    const { requestId: deletePolicyRequestId } = await client.deleteBucketPolicy(bucketName);​
    console.log('deleteBucketPolicy Request ID: ', deletePolicyRequestId);​
  } catch (error) {​
    handleError(error);​
  }​
}​
​
main();​