Docs

Torch Object Storage

Single-region access points (SRAP)

Overview

A TOS single-region access point is an endpoint that can be configured with independent permissions. It provides a dedicated domain name for a bucket. You can create multiple access points for the same bucket. This enables you to tailor access control and access methods for different businesses or user groups.

Use cases

Single-region access points are ideal for scenarios where multiple lines of business share the same bucket, but require permission isolation. For example:

Data isolation for multiple lines of business: Dozens or hundreds of lines of business require access to their own independent datasets within the same bucket. Access requires isolation. Since so many lines of business share one bucket, managing bucket policies becomes significantly more complex. Single-region access points allow the configuration of independent endpoints, which breaks down a large, complex bucket policy into multiple business-specific policies. You only need to focus on the principals and permitted actions for a single endpoint, rather than considering the permission logic of other businesses. This simplifies permission configuration in large-scale data-sharing scenarios.

Environment isolation for AI/big data training: An AI team stores a training data lake in TOS. To prevent accidental access to sensitive data in the test environment, only the training clusters running in a specific virtual private cloud (VPC) should have access to the data. You can configure a VPC access policy for a single-region access point to allow access only from the specified VPC. This achieves VPC-level access isolation.

Features

Dedicated domain names: Each single-region access point provides a dedicated domain name for a bucket. You can access resources in the bucket via this domain name. You can also use the access point as a domain name for a TOS accelerator, which enables intelligent, availability zone-aware DNS routing.

Permission isolation by access point: Each access point can have its own permission policy. When accessing TOS through an access point, your permissions are limited to the actions, resources, and conditions defined in its policy. This allows for differentiated access control for different lines of business or roles.

Network access control: You can configure single-region access points to restrict access to TOS resources to specific VPCs or the Internet, enabling flexible network access management.

Next steps

Creating single-region access points

Using single-region access points

Last updated: 2026.01.21 16:38:31