Docs

Torch Object Storage

Authorizing IAM users of the current account

Allowing an IAM user to delete an object

This topic explains how to allow an IAM user of the current account to delete an object.

Scenario

Principal: IAM user iamuser of account 210015****.

Resource: The data/aaa object.

Action: DeleteObject.

Notes

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Steps

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

Visual view

JSON view

Click Create policy.

On the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, use the default value. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Select Current main account. Then, click Add Field and select the IAM user you want to authorize from the drop-down menu under Sub account name. In this example, we use iamuser.
Resource	Resource scope	Select Objects in bucket and Specified object(s). Then, set Resource path to data/aaa. Click Add Field to specify multiple objects. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Action	General Action	Leave this section empty.
		Bucket Action	Leave this section empty.
		Object Action	Select DeleteObject and DeleteObjectVersion.
		Operational strategy	Use the default option, i.e., Include the above actions. This option allows users to perform the specified actions.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Next steps

Once the bucket policy has been created, the IAM user can delete the specified object using one of the following methods:

Use an API or SDK to delete the specified object.

To delete the specified object via the console or TOS Browser, the IAM user must be granted permission via an IAM policy to perform the following actions: ListBuckets and ListBucket. For more information about actions allowed by IAM policies, see Supported actions.

tip

Despite having the aforementioned permissions, the IAM user may still encounter errors such as Request failed with status code 403 or Insufficient permissions when attempting to delete the object via the console. This occurs due to missing permissions for other APIs. These errors do not affect existing permissions and can be disregarded.

Last updated: 2026.08.14 16:23:30