Docs

Torch Object Storage

Common configuration scenarios

Blocking public access to TOS

Blocking public access to TOS

This topic explains how to restrict public access to TOS buckets. Follow this tutorial to limit public access to TOS and prevent TOS data from leaking onto the public network.

Notes

The TOS console will no longer be accessible to the public once access to TOS has been restricted.

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Steps

Log in to the TOS console.

In the left navigation pane, click Buckets. In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

tip

In this scenario, select JSON view and click Edit. Then, copy the following content into the text box and replace bucketname with the name of your bucket. Finally, click Save.

In this scenario, we recommend using a bucket policy with the NetPlane condition. For more information about bucket policies, see Overview.

Prevent users on the public network from reading objects in the "bucketname" bucket

{
"Statement": [{
"Effect": "Deny",
"Action": "tos:GetObject",
"Principal": ["*"],
"Resource": ["trn:tos:::bucketname","trn:tos:::bucketname/*"],
"Condition": {
"StringEquals": {
"tos:NetPlane": "public"
}
}
}]
}

Deny public access to the "bucketname" bucket for any operation

{
"Statement": [{
"Effect": "Deny",
"Action": "tos:*",
"Principal": ["*"],
"Resource": ["trn:tos:::bucketname","trn:tos:::bucketname/*"],
"Condition": {
"StringEquals": {
"tos:NetPlane": "public"
}
}
}]
}

Deny public access to the "bucketname" bucket for any operation, but allow console-based management

{
"Statement": [{
"Effect": "Deny",
"Action": "tos:*",
"Principal": ["*"],
"Resource": ["trn:tos:::bucketname", "trn:tos:::bucketname/*"],
"Condition": {
"StringEquals": {
"tos:NetPlane": "public",
"volc:ViaConsole": "false"
}
}
}]
}

Last updated: 2026.08.14 16:23:29