Docs

Torch Object Storage

Common configuration scenarios

Authorizing non-owners

Non-owners are users who do not own any buckets or objects. However, you can grant them permission to access these resources, including the ability to download objects. This topic explains how to authorize non-owners.

Scenario

This tutorial uses the users "aaa", "bbb", and "ccc" as examples. The background and objective are as follows:

Background: User aaa owns the "test" bucket. User bbb has permission to upload objects to the bucket. User ccc has no permissions.

Objective: After authorization, User ccc will be able to download objects in the "test" bucket, which are uploaded by User bbb.

Steps

When uploading the sample.txt object to the data directory of the "test" bucket, User bbb sets the object' access control list (ACL) permission to "bucket-owner-full-control". This grants User aaa full access to the object.

Through a bucket policy, User aaa grants User ccc GetObject permission for the data directory of the "test" bucket. This allows User ccc to download the sample.txt object.

For more information about bucket policies, see Overview.

Prerequisites

A bucket has been created. For more information, see Creating buckets.

User bbb has been granted permission to upload objects to the bucket. For more information, see Allowing an IAM user to upload and download objects in a bucket.

tosutil has been downloaded and installed. For instructions, see Downloading and installing tosutil.

Step 1: Upload the object

Run this command to initialize the tosutil configuration.

./tosutil config -i <access key> -k <secret key> -e <endpoint> -re <region>

Parameter	Description
access key	The access key ID (AK) for User bbb. For instructions on how to view the AK and SK, see Viewing the Access Key ID and Secret Access Key.
secret key	The secret access key (SK) for User bbb.
endpoint	TOS external access domain name.
region	The region where the "test" bucket is located. For more information on TOS regions, see Regions and endpoints.

Run this command to upload the sample.txt object and set its ACL permission to "bucket-owner-full-control".

./tosutil cp file1_url tos://bucket[/prefix] -acl=bucket-owner-full-control

Example:

./tosutil cp sample.txt tos://test/data/sample.txt -acl=bucket-owner-full-control

Parameter	Description
file_url	The path for a local file. To upload multiple objects, add multiple file_url values to the command and separate them with commas (,). tip You can also use tosutil to upload folders or a list of objects. For instructions, see Upload objects (cp).
bucket	Specifies the name of the bucket being reported.
prefix	The prefix used for filtering objects in batch operations.
-acl	Sets the predefined access control lists (ACLs) for objects to be uploaded or copied. Possible values: private: Private permission. public-read: Publicly readable. public-read-write: Publicly readable and writable. authenticated-read: Authenticated users have read access. bucket-owner-read: The bucket owner has read access. bucket-owner-full-control: The bucket owner has full control. bucket-owner-entrusted: Controlled by the bucket policy, with the bucket owner having full control.

Step 2: Allow User ccc to download the object

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Permissions > Bucket policies.

Click Create policy.

On the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, use the default value. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Select Current main account. Under Sub account name, click Add Field and select User ccc from the dropdown menu.
Resource	Resource scope	Select Objects in bucket and Specified object(s). Then, click Add Field and set Resource path to data/*.
Action	General Action	It is optional. You can also select one or more actions you want to authorize based on your needs. For more information, see Supported actions.
			Bucket Action
		Object Action	Select GetObject. You can also select other actions as needed. For more information, see Object actions.
		Operational strategy	Use the default option, i.e., Include the above actions. This option allows users to perform the specified actions.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Step 3: Download the object

User ccc can use the GetObject API to download the sample.txt object. For more information about the GetObject API, see GetObject.

Last updated: 2026.08.14 16:23:30