Docs

Torch Object Storage

Access control

Overview

To ensure the security of your resources, TOS offers several authorization methods, including bucket policies, Identity and Access Management (IAM) policies, and access control lists (ACLs). Based on your business requirements, you can select the appropriate methods to allow different users to access or manage your resources.

Authorization methods

This topic provides the authorization methods supported by TOS and their use cases for your reference.

tip

In general, we recommend that you configure permissions by using IAM policies or bucket policies.

We also recommend that you select the same type of policies to facilitate further maintenance.

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Method	Principal	Action	Condition	Use cases
IAM policy	IAM users	All.	Supported	When granting IAM users permissions to multiple cloud resources. When granting the same permissions to multiple buckets. When configuring service-level permissions, such as creating and listing buckets.
Bucket policy	Accounts All users	All actions except for creating or listing buckets. For more information, see Actions.	Yes. For more information, see Conditions.	When granting permissions across accounts or to all users. When you need to configure specific conditions for applying permissions.
Bucket ACL	Accounts All users	Read permission Read permission, including listing objects/multipart uploads Write permission ACL read permission ACL write permission	Not supported	When authorizing IAM users in another account or all users to read or write all objects in a bucket. tip Only an account can grant permissions to other accounts.
Object ACL	Accounts All users	Private Public read Public read/write	Not supported	When granting permissions (private, public read, or public read/write) to a single object.

Which method should I select?

The following table compares various authorization methods. Select the appropriate methods based on your business requirements.

Parameter	Type	Bucket policy	IAM policy	ACL
Principal (authorized user)	IAM users within the same account	✔️	✔️	❌
		Other accounts	✔️	❌	✔️
		IAM users in another account	✔️	❌	❌
		All users	✔️	❌	✔️
Effect (action to take)	Allow	✔️	✔️	✔️
Effect (action to take)		Deny	✔️	✔️	❌
Resource (authorized resource)	All TOS resources	❌	✔️	❌
		A TOS bucket	✔️	✔️	✔️
		A group of specified TOS objects	✔️	✔️	❌
		A TOS object	✔️	✔️	✔️
Action	Service-level permissions (creating buckets or listing all buckets)	❌	✔️	❌
		Specific permissions on buckets or objects	✔️	✔️	❌
		Read/write permissions on buckets or objects	✔️	✔️	✔️
Condition	Conditions for applying permissions	✔️	✔️	❌

Which permission rule applies when they conflict?

Setting multiple permission rules may result in conflicts. The authorization process is as follows:

Check whether all users are authorized.

Yes: Go to Step 2.

No: Check user permissions.

If the check passes, check resource permissions.

warning

By default, the ACL permissions for the resource owner are set to Allow.

The following table describes which action (allow or deny) to take when there is a conflict between bucket policies, IAM policies, and ACLs for any bucket owner or their IAM users.