This topic explains how to use IAM policies to allow IAM users to upload and download TOS objects via TOS Browser.

Scenario

TOS Browser is a graphical user interface (GUI) tool designed for TOS. It allows you to manage TOS buckets and objects comprehensively. For detailed guidance, see Quick start with TOS Browser.

You can log in to TOS Browser with an AK/SK pair or a share link. Before logging in, make sure you have granted the corresponding permissions to your account.

Notes

Before you begin, make sure you have created an IAM user. For instructions, see Create user.

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

This topic only covers granting access to the basic actions required for uploading and downloading objects via TOS Browser. To perform other operations on buckets or objects using TOS Browser, add the corresponding actions to the policy. For more information about actions allowed by IAM policies, see Supported actions.

Steps

Step 1: Create an IAM policy

Log in to the IAM console.

In the left navigation pane, click Permission policy.

On the Permission policy page, click Create Policy.

On the Create Policy page

Configure the following parameters.

Parameter	Description
Policy name	A policy name can contain letters and numbers, as well as the following characters: +=,.@-_. The length must not exceed 64 characters.
Description	The description can contain letters, numbers, and special characters. The length must not exceed 128 characters.

Click the JSON editor tab. Then, copy the following content into the text box, and click Submit.

All resources
Objects with the prefix "prefix" in the "bucketname" bucket
{
"Statement": [{
"Effect": "Allow",
"Action": [
"tos:GetObject",
"tos:PutObject",
"tos:DeleteObject",
"tos:GetObjectAcl",
"tos:PutObjectAcl",
"tos:GetObjectVersion",
"tos:DeleteObjectVersion",
"tos:AbortMultipartUpload",
"tos:ListMultipartUploadParts",
"tos:ListBucket",
"tos:HeadBucket",
"tos:ListBuckets",
"tos:ListBucketVersions",
"tos:GetBucketVersioning",
"tos:GetBucketLocation"
],
"Resource": [
"*"
]
}]
}
{
"Statement": [
{
"Effect": "Allow",
"Action": [
"tos:GetObject",
"tos:PutObject",
"tos:DeleteObject",
"tos:GetObjectAcl",
"tos:PutObjectAcl",
"tos:GetObjectVersion",
"tos:DeleteObjectVersion",
"tos:AbortMultipartUpload",
"tos:ListMultipartUploadParts",
"tos:ListBucket",
"tos:HeadBucket",
"tos:ListBuckets",
"tos:ListBucketVersions",
"tos:GetBucketVersioning"
],
"Resource": [
"trn:tos:::bucketname",
"trn:tos:::bucketname/prefix/*"
]
},
{
"Effect": "Allow",
"Action": [
"tos:ListBucket"
],
"Resource": [
"trn:tos:::bucketname"
],
"Condition": {
"StringLike": {
"tos:prefix": [
"prefix/*"
]
}
}
}
]
}

Step 2: Attach the IAM policy to identities

After creating the IAM policy, you must attach it to IAM identities, such as users, user groups, or roles, for it to take effect.

Log in to the IAM console.

In the left navigation pane, click Permission policy.

On the Permission policy page, set Policy type to Customer managed, find the policy you previously created, and click Authorization in the Actions column.

On the Authorize page, choose whether to Limit to project resources. In the Identity section, select the users, user groups, or roles that you want to authorize. Then, click Submit.

After authorization, click Done to view the policy details.

Torch Object Storage