Docs

Torch Object Storage

Authorizing other accounts

Allowing an IAM user from another account to access a bucket from the current account

This topic explains how to allow an IAM user from another account to access a bucket and its resources of the current account.

Scenario

Principal: IAM user user of another account 210000****.

Resource: Bucket bucketname1.

Actions: GetObject, PutObject, ListBucket, ListBucketVersions, and HeadBucket.

Recommended authorization method

Two steps are needed to allow an IAM user from another account to access a bucket and its resources.

The account that owns the bucket must create a bucket policy that grants the user access.

The other account must create an IAM policy that grants the user access to the bucket and its resources.

For example, to allow IAM user B1 from account B to access bucket C from account A:

Account A configures a bucket policy to allow IAM user B1 to access bucket C.

Account B configures an IAM policy to allow IAM user B1 to access bucket C.

Notes

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Step 1: Create a bucket policy

The account that owns the bucket creates a bucket policy that allows the IAM user (user) from another account (210000****) to perform the following operations on "bucketname1": GetObject, PutObject, ListBucket, ListBucketVersions, and HeadBucket.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

Visual view

JSON view

Click Create policy.

On the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, use the default value. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Use the default option, Other main account, and enter the account ID. Then, click Add Field and enter the name of the IAM user you want to authorize under Sub account name. In this example, we enter user.
Resource	Resource scope	Select Current bucket, Objects in bucket, and All objects.
Action	General Action	It is optional. You can also select one or more actions you want to authorize based on your needs. For more information, see General actions.
		Bucket Action	Select ListBucket, HeadBucket, and ListBucketVersions. You can also select other actions as needed. For more information, see Bucket actions.
		Object Action	Select GetObject and PutObject. You can also select other actions as needed. For more information, see Object actions.
		Operational strategy	Use the default option, i.e., Include the above actions. This option allows users to perform the specified actions.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Step 2: Create an IAM policy

The other account (210000****) creates an IAM policy that allows its IAM user (user) to perform the following operations on bucketname1: GetObject, PutObject, ListBucket, ListBucketVersions, and HeadBucket.

In the left navigation pane, click Permission policy.

On the Permission policy page, click Create Policy.

On the Create Policy page

Configure the following parameters.

Parameter	Description
Policy name	A policy name can contain letters and numbers, as well as the following characters: +=,.@-_. The length must not exceed 64 characters.
Description	The description can contain letters, numbers, and special characters. The length must not exceed 128 characters.

Click the JSON editor tab. Copy the following content into the text box and replace the Resource value as needed. Finally, click Submit.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"tos:GetObject",
"tos:PutObject",
"tos:ListBucket",
"tos:ListBucketVersions",
"tos:HeadBucket"
],
"Resource": [
"trn:tos:::bucketname1",
"trn:tos:::bucketname1/*"
]
}
]
}

Click Authorize.

Alternatively, navigate to the Permission policy page. Set Policy type to Customer managed, find the policy you previously created, and click Authorization in the Actions column.

On the Authorize page, choose whether to Limit to project resources. On the User tab under Identity, select the IAM user you want to authorize. In this example, we use "user". Then, click Submit.

After authorization, click Done to view the policy details.

Next steps

Once the authorization is complete, the IAM user can upload and download objects to and from the specified bucket using one of the following methods:

Use an API or SDK to upload and download objects to and from the bucket.

Use the resource path to access the bucket via TOS browser and upload and download objects.

Use tosutil commands to upload and download objects to and from the bucket.

warning

TOS does not support listing buckets from other accounts. Despite having the aforementioned permissions, the IAM user cannot upload and download objects to and from the bucket via the console.

Last updated: 2026.08.14 16:23:30