Docs

Torch Object Storage

Bucket policies

Bucket policy templates and parameters

This topic covers the actions supported by bucket policies, bucket policy templates, and parameters.

Supported actions

General actions

Action	Description
*	A wildcard, which grants permission to perform all supported actions on the resource.
Get*	Grants permission to perform all GET actions on the resource.
Put*	Grants permission to perform all PUT actions on the resource. warning This action is risky. Proceed with caution.
List*	Grants permission to perform all List actions on the resource.

Bucket actions

Resource type	Action	Description
Bucket operation	ListBucket	Grants permission to list objects in a bucket.
		HeadBucket	Grants permission to check whether a bucket exists and obtain its metadata.
		DeleteBucket	Grants permission to delete a bucket. warning This action is risky. Proceed with caution.
Bucket access control list (ACL)	GetBucketACL	Grants permission to obtain the ACL of a bucket.
Bucket access control list (ACL)		PutBucketACL	Grants permission to set the permissions on a bucket using ACL. warning This action is risky. Proceed with caution.
Bucket policy	GetBucketPolicy	Grants permission to obtain the bucket policy on a bucket.
		PutBucketPolicy	Grants permission to add or replace a bucket policy on a bucket. This permission allows users to get other permissions. warning This action is risky. Proceed with caution.
		DeleteBucketPolicy	Grants permission to delete the bucket policy on a bucket. warning This action is risky. Proceed with caution.
Bucket tag	GetBucketTagging	Grants permission to obtain the tag set of a bucket.
Bucket tag		PutBucketTagging	Grants permission to add a set of tags to a bucket.
Lifecycle rule	GetLifecycleConfiguration	Grants permission to obtain the lifecycle rule configurations of a bucket.
Lifecycle rule		PutLifecycleConfiguration	Grants permission to add or replace lifecycle configurations for a bucket.
Bucket version	GetBucketVersioning	Grants permission to obtain the versioning state of a bucket.
		PutBucketVersioning	Grants permission to set the versioning state of a bucket.
		ListBucketVersions	Grants permission to list all the versions of objects in a bucket.
Cross-origin resource sharing (CORS) rule	GetBucketCORS	Grants permission to retrieve information about the CORS rules of a bucket.
Cross-origin resource sharing (CORS) rule		PutBucketCORS	Grants permission to create a CORS rule for a bucket.
Message notification	PutBucketNotification	Grants permission to receive notifications when certain events happen in a bucket.
Message notification		GetBucketNotification	Grants permission to obtain the event notification configurations of a bucket.
Image style	PutBucketImageStyle	Grants permission to configure image styles under a bucket.
		GetBucketImageStyle	Grants permission to obtain image styles created under a bucket.
		ListBucketImageStyle	Grants permission to list image styles created under a bucket.
		DeleteBucketImageStyle	Grants permission to delete image styles created under a bucket. warning This action is risky. Proceed with caution.
Bucket storage policy	PutBucketStoragePolicy	Grants permission to set the default storage type for a bucket.
Object locking	PutBucketObjectLockConfiguration	Grants permission to apply object lock configurations to a bucket.
Object locking		GetBucketObjectLockConfiguration	Grants permission to retrieve object lock configurations.
RenameObject	PutBucketRename	Grants permission to enable RenameObject for a bucket.
RenameObject		GetBucketRename	Grants permission to check if RenameObject is enabled for a bucket.
Access monitor	PutBucketAccessMonitor	Grants permission to enable or disable access monitor.
Access monitor		GetBucketAccessMonitor	Grants permission to retrieve the status of the access monitor feature.
Bucket inventory	PutBucketInventory	Grants permission to create a bucket inventory rule for a bucket.
		GetBucketInventory	Grants permission to retrieve information about a specific bucket inventory rule of a bucket.
		ListBucketInventory	Grants permission to retrieve information about bucket inventory rules of a bucket.
		DeleteBucketInventory	Grants permission to delete specific bucket inventory rules of a bucket. warning This action is risky. Proceed with caution.
Others	ListBucketMultipartUploads	Grants permission to list in-progress multipart uploads.

Object actions

Resource type	Action	Description
Object operation	GetObject	Grants permission to retrieve the content and metadata of an object.
		PutObject	Grants permission to add an object to a bucket, including via a multipart upload.
		DeleteObject	Grants permission to delete an object. warning This action is risky. Proceed with caution.
		SetObjectExpires	Grants permission to set the expiration time for an object. warning This action is risky. Proceed with caution.
		RestoreObject	Grants permission to restore an object from Archive, Cold Archive or Deep Cold Archive.
Object ACL	GetObjectAcl	Grants permission to obtain the ACL of an object.
Object ACL		PutObjectAcl	Grants permission to set the permissions on an object using ACL. warning This action is risky. Proceed with caution.
Object version	GetObjectVersion	Grants permission to retrieve the content and metadata of a specific version of an object.
Object version		DeleteObjectVersion	Grants permission to remove a specific version of an object. warning This action is risky. Proceed with caution.
Object tag	GetObjectTagging	Grants permission to obtain the tag set of an object.
		PutObjectTagging	Grants permission to add a set of tags to an object.
		DeleteObjectTagging	Grants permission to remove the entire tag set of an object. warning This action is risky. Proceed with caution.
Object retention period	PutObjectRetention	Grants permission to place an object retention configuration on an object.
Object retention period		GetObjectRetention	Grants permission to obtain the object retention configurations for an object.
RenameObject	RenameObject	Grants permission to rename an object. tip Enable RenameObject for FNS buckets before using RenameObject. For instructions, see Using RenameObject or PutBucketRename. RenameObject is enabled by default for HNS buckets, so no additional action is required.
Others	AbortMultipartUpload	Grants permission to abort a multipart upload.
Others		ListMultipartUploadParts	Grants permission to list the parts that have been uploaded for a specific multipart upload.

Bucket policy templates

The TOS console provides seven preset bucket policy templates to cater to common scenarios. You can use one of them to quickly configure a policy.

Some templates may require a configuration of principals or resources. You can also modify the existing template settings, including principals, resources, actions, and conditions.

warning

Buckets with public read-only or read-write permissions are exposed on the public network. Anyone can read or write objects in these buckets, which incurs data transfer costs and may result in property loss or data leakage.

Template name	Principal	Resource	Actions
Bucket Read-Only	Specified users	Entire bucket, including all the objects in it	Allows the specified user(s) to perform the following actions on a bucket and the objects in it: Get: all GET operations. List: all LIST operations. HeadBucket: Check whether a bucket exists and obtain its metadata.
Bucket Read and Write	Specified users	Entire bucket, including all the objects in it	Allows the specified user(s) to perform the following actions on a bucket and the objects in it: Get: all GET operations. List: all LIST operations. HeadBucket: Check whether a bucket exists and obtain its metadata. PutLifecycleConfiguration: Add or replace lifecycle configurations for a bucket. PutBucketVersioning: Set the versioning state of a bucket. PutBucketCORS: Create a CORS rule for a bucket.. PutObject: Add an object to a bucket, including via a multipart upload. DeleteObject: Delete an object. PutObjectAcl: Set the permissions on an object using ACL. DeleteObjectVersion: Remove a specific version of an object. AbortMultipartUpload: Abort a multipart upload.
Folder Read-Only	Specified users	Objects with the specified prefix	Allows the specified user(s) to perform the following actions on a bucket and the specified objects in it: ListBucket: List objects in a bucket. HeadBucket: Check whether a bucket exists and obtain its metadata. ListBucketVersions: List all the versions of objects in a bucket. GetObject: Retrieve the content and metadata of an object. GetObjectAcl: Obtain the ACL of an object. GetObjectVersion: Retrieve the content and metadata of a specific version of an object.
Folder Read and Write	Specified users	Objects with the specified prefix	Allows the specified user(s) to perform the following actions on a bucket and the specified objects in it: ListBucket: List objects in a bucket. HeadBucket: Check whether a bucket exists and obtain its metadata. ListBucketVersions: List all the versions of objects in a bucket. ListBucketMultipartUploads: List in-progress multipart uploads. GetObject: Retrieve the content and metadata of an object. PutObject: Add an object to a bucket, including via a multipart upload. GetObjectAcl: Obtain the ACL of an object. PutObjectAcl: Set the permissions on an object using ACL. GetObjectVersion: Retrieve the content and metadata of a specific version of an object. AbortMultipartUpload: Abort a multipart upload. ListMultipartUploadParts: List the parts that have been uploaded for a specific multipart upload.
Public Read-Only (including ListBucket operations)	All users (all Internet users)	Entire bucket, including all the objects in it	Allows all users to perform the following actions on a bucket and the objects in it: ListBucket: List objects in a bucket. HeadBucket: Check whether a bucket exists and obtain its metadata. ListBucketVersions: List all the versions of objects in a bucket. GetObject: Retrieve the content and metadata of an object. GetObjectVersion: Retrieve the content and metadata of a specific version of an object.
Public Read-Only (excluding ListBucket operations)	All users (all Internet users)	Entire bucket, including all the objects in it	Allows all users to perform the following actions on a bucket and the objects in it: HeadBucket: Check whether a bucket exists and obtain its metadata. GetObject: Retrieve the content and metadata of an object. GetObjectVersion: Retrieve the content and metadata of a specific version of an object.
Public read/write	All users (all Internet users)	Entire bucket, including all the objects in it	Allows all users to perform the following actions on a bucket and the objects in it: ListBucket: List objects in a bucket. HeadBucket: Check whether a bucket exists and obtain its metadata. ListBucketVersions: List all the versions of objects in a bucket. GetObject: Retrieve the content and metadata of an object. PutObject: Add an object to a bucket, including via a multipart upload. GetObjectAcl: Obtain the ACL of an object. PutObjectAcl: Set the permissions on an object using ACL. GetObjectVersion: Retrieve the content and metadata of a specific version of an object. AbortMultipartUpload: Abort a multipart upload. ListMultipartUploadParts: List the parts that have been uploaded for a specific multipart upload.

Bucket policy parameters

A statement serves as a container for the main policy elements. A single policy may include multiple statements, each of which contains the following parameters:

Parameter	Required	Description	Example
Sid	No	Statement ID. tip It must be unique within a bucket.	"Sid": "test"
Effect	Yes	Whether the statement is an Allow or a Deny. Possible values: Allow Deny	"Effect": "Allow"
Principal	No tip When Effect is Allow, the Principal parameter is required.	The users to whom the statement will apply. To grant permissions to a specific user, enter the ID of the account to be authorized. To authorize Identity and Access Management (IAM) users of the account, use /. To grant permissions to all users, use a wildcard (*).	Specified users "Principal":["200000***/IAMUserName"] All users "Principal":[""]
NotPrincipal	No	This parameter must be used in conjunction with "Effect":"Deny". When used with "Effect":"Deny", it denies all users except those specified by NotPrincipal. For typical scenarios involving NotPrincipal, see Using NotPrincipal, NotResource, and NotAction. tip Using a wildcard () alone to deny all users is not supported. In other words, "NotPrincipal":[""] is not permitted. To authorize IAM users of the account, use /.	"NotPrincipal":["200000****/IAMUserName"]
Action	No tip When Effect is Allow, the Action parameter is required.	The actions that the statement will allow or deny. For more information, see Supported actions. The parameter value is expressed as an array of strings. Actions follow the format tos:ActionName and are case-insensitive. Wildcards () are allowed, which indicates that all possible operations can be performed on the resource. For example, "Action":["tos:List" ].	"Action": [ "tos:Get", "tos:List", "tos:HeadBucket" ]
NotAction	No	This parameter can be used with "Effect":"Deny" and "Effect":"Allow". When used with "Effect":"Deny", it denies all actions except those specified by NotAction. When used with "Effect":"Allow", it allows all actions except those specified by NotAction. The parameter value is expressed as an array of strings. Actions follow the format tos:ActionName and are case-insensitive. For typical scenarios involving NotAction, see Using NotPrincipal, NotResource, and NotAction. tip Using a wildcard () alone to deny all actions is not supported. In other words, "NotAction":[""] is not permitted. For a list of supported actions, see Supported actions.	"NotAction": [ "tos:Get", "tos:List", "tos:HeadBucket" ]
Resource	No tip When Effect is Allow, the Resource parameter is required.	The resources that the statement will apply to. Follow these guidelines when specifying the resource: To manipulate a bucket, specify the bucket name only, for example, trn:tos:::bucketname. To manipulate objects in a bucket, specify the objects, for example, trn:tos:::bucketname/objectname. tip When indicating the resource, you can use the wildcards "?" and "" to match objects. "?" matches any single character, while "" matches any single character or multiple characters. Examples: Example 1: Use "trn:tos:::data/" to match all objects in the "data" bucket. Example 2: Use "trn:tos:::data/aaa/" to match all objects in the "aaa" directory within the "data" bucket. Example 3: Use "trn:tos:::data/aa?" to match objects that start with "aa" and are followed by one character in the "data" bucket.	"Resource": [ "trn:tos:::bucketname", "trn:tos:::bucketname/*" ]
NotResource	No	This parameter must be used in conjunction with "Effect":"Deny". When combined with "Effect":"Deny", it denies access to all resources except those specified by NotResource. Follow these guidelines when specifying the resource: To manipulate a bucket, specify the bucket name only, for example, trn:tos:::bucketname. To manipulate objects in a bucket, specify the objects, for example, trn:tos:::bucketname/objectname. Use a wildcard ( * ) to indicate all resources in a bucket. For typical scenarios involving NotResource, see Using NotPrincipal, NotResource, and NotAction. tip Using a wildcard () alone to exclude all resources is not supported. In other words, "NotResource":[""] is not permitted.	"NotResource": "trn:tos:::bucketname/*"
Condition	No	The conditions for the statement to take effect. For more information, see Conditions.	"Condition": { "IpAddress": { "SourceIp": [ "192.168.0.1", "192.168.0.3" ] } }

Example

Conditions

Supported conditions

The conditions determine when a bucket policy takes effect. A bucket policy is applied only when its condition expressions match the values in the request. Each condition consists of a condition operator, a key, and a value. Condition operators, condition keys and actions allowed are interdependent.

tip

For more information about condition operators, see Condition operators.

Key	Condition operator type	Universally applicable	Key description	Value description
prefix	String	No	The prefix used to filter objects when listing. Supported actions: List* ListBucket ListBucketVersions	Enter a prefix and a wildcard (*). For example, if the bucket policy condition is set to prefix is not equal to dr1/, an authorized account must set the prefix parameter to a value other than dr1/ in Query when listing objects. Otherwise, the bucket policy will not take effect.
delimiter	String	No	The character used to group objects when listing. Supported actions: List* ListBucket ListBucketVersions	Enter common delimiters. For example, if the bucket policy condition is set to delimiter is equal to /, an authorized account must set the delimiter parameter to / in Query when listing objects. Otherwise, the bucket policy will not take effect.
max-keys	String	No	The maximum number of objects that can be listed at one time. Supported actions: List* ListBucket ListBucketVersions	Enter a number between 1 and 1,000. For example, if the bucket policy condition is set to max-keys is equal to 10, an authorized account must set the max-keys parameter to 10 in Query when listing objects. Otherwise, the bucket policy will not take effect.
versionid	String	No	Used to specify the object version. Supported actions: Delete* Get* DeleteObjectVersion GetObjectVersion	Enter an object version ID. For example, if the bucket policy condition is set to versionid is equal to 570731267015922DACF8, an authorized account must set the versionId parameter to 570731267015922DACF8 in Query when performing the corresponding action. Otherwise, the bucket policy will not take effect.
x-tos-acl	String	No	Used to pass the object's ACL in the header when uploading an object or setting the ACL of an object. Supported actions: Put* PutBucketAcl PutObject PutObjectAcl	Enter a valid ACL permission. Possible values: private public-read public-read-write bucket-owner-read bucket-owner-full-control authenticated-read bucket-owner-entrusted For example, if the bucket policy condition is set to x-tos-acl is equal to public-read, an authorized account must set the x-tos-acl parameter to public-read in the request header when uploading objects or setting ACLs. Otherwise, the bucket policy will not take effect.
x-tos-copy-source	String	No	Used to specify the source bucket and object when copying an object. Supported actions: Put* PutObject	Enter a valid path for the source object. For example, if the bucket policy condition is set to x-tos-copy-source is equal to /bucket/object, an authorized account must set the x-tos-copy-source parameter to /bucket/object in the request header when calling the CopyObject API. Otherwise, the bucket policy will not take effect.
x-tos-metadata-directive	String	No	Whether to copy the metadata of the source object or replace with the metadata in the request. Supported actions: Put* PutObject	Enter COPY or REPLACE. COPY: Copy the metadata of the source object. REPLACE: Use the metadata in the request. For example, if the bucket policy condition is set to x-tos-metadata-directive is equal to COPY, an authorized account must set the x-tos-metadata-directive to COPY in the request header when calling the CopyObject API. Otherwise, the bucket policy will not take effect.
x-tos-server-side-encryption-kms-key-id	String	No	The ID of the key used to encrypt objects with SSE-KMS. This option only applies to PutObject.	Enter a KMS key ID. For example, if the bucket policy condition is set to x-tos-server-side-encryption-kms-key-id is equal to trn:kms:cn-beijing:200000**:keyrings/ring-test/keys/key-test, an authorized account must set the x-tos-server-side-encryption-kms-key-id parameter to trn:kms:cn-beijing:200000**:keyrings/ring-test/keys/key-test in the request header when uploading objects. Otherwise, the bucket policy will not take effect.
CurrentTime	Date	Yes	The time when the server receives a request, in the UTC time format yyyy-MM-ddTHH:mmZ, according to ISO 8601.	Enter a date in ISO 8601 format. For example, if the bucket policy condition is set to CurrentTime is greater than 2023-10-13T15:00:00Z, the time at which an authorized account performs the corresponding action must be after 2023-10-13T15:00:00Z. Otherwise, the bucket policy will not take effect.
EpochTime	Numeric	Yes	The number of seconds that have elapsed since midnight on January 1, 1970, UTC/GMT, excluding leap seconds.	Enter the number of seconds. For example, if the bucket policy condition is set to EpochTime is greater than 1697187692, the time at which an authorized account performs the corresponding action must be after 1697187692. Otherwise, the bucket policy will not take effect.
SecureTransport	Boolean	Yes	Whether to use Secure Sockets Layer (SSL) to encrypt connections.	Enter true or false. true: Use SSL. false: Do not use SSL. For example, if the bucket policy condition is set to SecureTransport bool true, an authorized account must use SSL when performing the corresponding action. Otherwise, the bucket policy will not take effect.
SourceIp	String	Yes	The source IP of the request.	Enter IP addresses or ranges. Use commas to separate multiple IP addresses. For example, if the bucket policy condition is set to SourceIp is equal to 192.168.0.1, the source IP address must be "192.168.0.1" when an authorized account performs the corresponding action. Otherwise, the bucket policy will not take effect.
UserAgent	String	Yes	The user agent of the request.	Enter the information of the agent and a wildcard (*), where applicable. For example, if the bucket policy condition is set to UserAgent is equal to tos go sdk v2.6.0, the agent user must be "tos go sdk v2.6.0" when an authorized account performs the corresponding action. Otherwise, the bucket policy will not take effect.
Referer	String	Yes	The URL from which the resource has been requested.	Enter a URL. For example, if the bucket policy condition is set to Referer is equal to http://console.volcengine.com, the request header must be http://console.volcengine.com when an authorized account performs the corresponding action. Otherwise, the bucket policy will not take effect.
SourceVpc	String	Yes	The VPC from which the request has been initiated.	Enter a VPC ID. For example, if the bucket policy condition is set to SourceVpc is equal to vpc-2d**ez0n, an authorized account must make the request from the vpc-2d**ez0n VPC when performing the corresponding action. Otherwise, the bucket policy will not take effect. warning TOS can only obtain the SourceVpc authentication context from requests sent through VPC endpoints. If the tos:SourceVpc condition is set only in bucket or IAM policies and the corresponding gateway endpoint is not created, TOS cannot obtain the SourceVpc context. This causes TOS to fail to identify the VPC source of the request and renders the tos:SourceVpc condition ineffective.
rolename	String	Yes	The name of the IAM role used to specify other cloud services or internal requests within TOS.	Enter a role name. For example, if the bucket policy condition is set to rolename is equal to ServiceRoleforReplicationAccessTOS, the principal must assume the "ServiceRoleforReplicationAccessTOS" role when accessing TOS. Otherwise, the bucket policy will not take effect.
NetPlane	String	Yes	The layer of network architecture from which the request has been initiated.	The value is fixed as public, indicating the request should come from the public network. For example, if the bucket policy condition is set to NetPlane is equal to public, an authorized account must make the request from the public network when performing the corresponding action. Otherwise, the bucket policy will not take effect.
DataAccessPointTrn	String	No	Grants permission to a specific access point.	Enter an access point TRN. For example, if the bucket policy condition is set to DataAccessPointTrn is equal to trn:tos:cn-beijing:214748**:accesspoint/bbb, the bucket policy will only apply when the principal accesses the bucket through the trn:tos:cn-beijing:214748**:accesspoint/bbb access point. tip Only use the DataAccessPointTrn condition when granting access point permissions. For more information, see Creating single-region access points.
DataAccessPointAccount	String	No	Grants permission to all access points within a specific account.	Enter an account ID. For example, if the bucket policy condition is set to DataAccessPointAccount is equal to 214748**, the bucket policy will only apply when the principal uses access points of the account 214748** to access the bucket. tip Only use the DataAccessPointAccount condition when granting access point permissions. For more information, see Creating single-region access points.
AccessPointNetworkOrigin	String	No	Grants permission to all access points with the specified network origin.	Enter VPC or Internet. VPC: Grants permission to access points whose network origin is VPC. Internet: Grants permission to access points whose network origin is Internet. For example, if the bucket policy condition is set to AccessPointNetworkOrigin is equal to VPC, the bucket policy will only apply when the principal uses access points with a VPC network origin to access the bucket. tip Only use the AccessPointNetworkOrigin condition when granting access point permissions. For more information, see Creating single-region access points.
volc:ViaConsole	String	Yes	Whether the request is made via the console.	Enter true or false. true: Access via the console. false: Access via APIs. For example, if the bucket policy condition is set to volc:ViaConsole is equal to true, an authorized account must access TOS via the console. Otherwise, the bucket policy will not take effect.
volc:ResourceTag/$	String	Yes	The tag (tag value + tag_key) attached to the resources that can be accessed.	Enter the tag of the resources that can be accessed. For example, if the bucket policy condition is set to volc:ResourceTag/project is equal to shortform video business, an authorized account can only access resources with the tag key project and the tag value shortform video business.
volc:RequestTag/$	String	No	The tag (tag value + tag_key) that must be included in the request.	Enter the tag to be passed in the request. For example, if the bucket policy condition is set to volc:RequestTag/project is equal to shortform video business, an authorized account must carry the tag key "project" and the tag value "shortform video business" in the request when performing the corresponding action. Otherwise, the bucket policy will not take effect.
volc:RequestTagKeys	String	No	The tag key(s) that must be included in the request.	Enter the tag key(s) to be passed in the request. For example, if the bucket policy condition is set to volc:RequestTagKeys is equal to shortform video business, an authorized account must carry the tag key "shortform video business" in the request when performing the corresponding action. Otherwise, the bucket policy will not take effect.
volc:SourceIp	String	Yes	The source IP of the request.	Enter IP addresses or ranges. Use commas to separate multiple IP addresses. For example, if the bucket policy condition is set to volc:SourceIp is equal to 192.168.0.1, the source IP address must be "192.168.0.1" when an authorized account performs the corresponding action. Otherwise, the bucket policy will not take effect.
volc:UserName	String	Yes	The IAM username of the requester.	Enter an IAM username. For example, if the bucket policy condition is set to volc:UserName is equal to sso-, the name prefix of the IAM users accessing TOS must be "sso-". Otherwise, the bucket policy will not take effect.
volc:RequestedRegion	String	Yes	The requested region.	Enter a region ID. For example, if the bucket policy condition is set to volc:RequestedRegion is equal to cn-beijing, the bucket policy will only take effect when the bucket in China (Beijing) is requested.
volc:CurrentTime	String	Yes	The time when the server receives a request, in the UTC time format yyyy-MM-ddTHH:mmZ, according to ISO 8601.	Enter a date in ISO 8601 format. For example, if the bucket policy condition is set to volc:CurrentTime is greater than 2023-10-13T15:00:00Z, the time at which an authorized account performs the corresponding action must be after 2023-10-13T15:00:00Z. Otherwise, the bucket policy will not take effect.
volc:PrincipalTrn	String	Yes	The TRN of the requester.	Enter a TRN. The TRN format varies according to the principal. IAM users (including those who log in via user SSO): trn:iam::${AccountId}:user/$ IAM roles (those who use temporary credentials after role assumption, including logging in via role SSO): trn:iam::${AccountId}:role/$ Root users (accounts or root users, not IAM users or roles of accounts): trn:iam::${AccountId}:root For example, the TRN of a requester accessing TOS must be "trn:iam::2100***4:user/tos_user" for the bucket policy to take effect under the following condition: "Condition":{ "StringEquals":{ "volc:PrincipalTrn":"trn:iam::2100***4:user/tos_user" } } warning Only use the volc:PrincipalTrn condition when creating bucket policies in JSON view.

Condition operators

In bucket policies, condition keys and condition operators are matched as follows.

Condition key	Condition operator
prefix delimiter versionid x-tos-acl x-tos-copy-source x-tos-metadata-directive UserAgent Referer x-tos-server-side-encryption-kms-key-id SourceVPC rolename volc:ResourceTag/$ volc:RequestTag/$ volc:RequestTagKeys volc:UserName volc:RequestedRegion DataAccessPointTrn DataAccessPointAccount AccessPointNetworkOrigin	Equal To: Exact matching. Not Equal To: Negated matching. Equal To (Case-Insensitive): Exact matching, ignoring case. Not Equal To (Case-Insensitive): Negated matching, ignoring case. Like: Case-sensitive matching. Values can include a multi-character match wildcard (). For example, Like abc matches all strings that start with abc. Not Like: Negated case-sensitive matching. Values can include a multi-character match wildcard (). For example, Not Like abc excludes all strings that start with abc.
max-keys CurrentTime EpochTime volc:CurrentTime	Equal To: Exact matching. Not Equal To: Negated matching. Less Than: "Less than" matching. Less Than or Equal To: "Less than or equals" matching. Greater Than: "Greater than" matching. Greater Than or Equal To: "Greater than or equals" matching.
SourceIp NetPlane volc:SourceIp	Equal To: The specified IP address or range. Not Equal To: All IP addresses except the specified IP address or range.
SecureTransport volc:ViaConsole	Boolean, with only two possible values: true or false.

warning

After configuring the prefix, delimiter, or max-keys conditions, you must carry the corresponding key-value pair when performing List operations. Otherwise, the bucket policy will not take effect.

Separate multiple values with commas (,).

If a value contains a comma (,), escape it with a forward slash (/).

Last updated: 2026.01.04 11:15:05