Docs

Torch Object Storage

Bucket policies

Creating a custom bucket policy in visual view

If the preset templates in TOS do not meet your needs, you can customize a bucket policy. TOS allows you to customize a bucket policy in the visual or JSON view. This topic describes how to customize a bucket policy in the visual view.

Background information

For more information on actions allowed by bucket policies, see Supported actions.

For more information on bucket policy parameters, see Bucket policy parameters.

Notes

By default, the owner of an account has full permissions. IAM users have no permissions by default. If an IAM user needs to perform any of the following operations, the account owner must grant the user the appropriate permissions using an IAM or bucket policy.

Configure bucket policies: tos:PutBucketPolicy

View bucket policy details: tos:GetBucketPolicy

Delete bucket policies: tos:DeleteBucketPolicy

Steps

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket policies. On the Bucket policies page, click Create policy.

At the bottom of the Create Bucket Authorization Policy page, select Custom Policy and click Next.

On the Create Bucket Authorization Policy page, set the following parameters.

Parameter	Description
Policy configuration method	Click Basic configuration and select Visual view. For instructions on how to configure a bucket policy in JSON view, see Creating a custom bucket policy in JSON view.
Policy name	Click Basic configuration and enter a name for your bucket policy. tip The policy name must be unique within a bucket.
Effect	Select whether the bucket policy results in an allow or a deny. Allow: Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Specified account: The bucket policy only applies to the specified account(s). Options: Current main account: Grants permissions to one or more IAM users or subusers of the current account. The account ID is displayed by default. Click Add Field to select IAM users from the dropdown menu under Sub account name. Other main account: Grants permissions to another account and its IAM users or subusers. Enter the account ID and IAM username(s). All users: The bucket policy applies to all users, including those who are anonymous and not authenticated. In this case, selecting Allow for the Effect setting may lead to data security risks. Use with caution.
User Policy	Select whether to include or exclude the specified user(s). You can only set the User Policy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above users: Denies specified users certain permissions. Exclude the above users: Denies certain permissions to all users except those specified. tip The "Exclude the above users" option is used only to deny permissions. It does not grant permissions. To grant specific users certain permissions, you must also create the corresponding permission policies. For guidance, see Using NotPrincipal to deny access to all users except those specified.
Resource	Current bucket: The policy takes effect on the current bucket. You can configure bucket actions in the Action section. Objects in bucket: The policy takes effect on the objects in the bucket. You can configure object actions in the Action section. All objects: The policy takes effect on all objects in the bucket. Specified object(s): If you select Specified object(s), click the Add Field icon to specify the object(s). tip Follow these guidelines when specifying an object: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. ".." cannot be used as a directory name.
Resource strategy	Select whether to include or exclude the specified resource(s). You can only set the resource strategy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above resources: Denies users access to the specified resources. Exclude the above resources: Denies users access to any resource except those specified. tip The "Exclude the above resources" option is used only to deny users access to certain resources. It does not grant permissions. To grant users access to certain resources, you must also create the corresponding permission policies. For guidance, see Using NotResource to deny users access to any resource except those specified.
Action	Select the action(s) to be authorized. For more information, see Supported actions.
Operational strategy	Select whether to include or exclude the specified action(s). How the operational strategy works depends on the effect you previously selected. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies. The options are explained below when Effect is Allow. Include the above actions: Allows users to perform the specified actions. Exclude the above actions: Allows users to perform any action except those specified. For guidance, see Using NotAction to allow users to perform any action except those specified.
Condition	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Then, click Next.

Confirm the configurations and click Create.

Then, you will see the bucket policy that you just created in the policy list.

Other operations

Edit a bucket policy

On the Bucket policies page, click the Visual view tab. Then, click Edit in the Action column of the policy you want to edit.

On the Bucket policies page, click the JSON view tab. Then, click Edit and find the policy you want to edit in the text box.

Delete a bucket policy

On the Bucket policies page, click the Visual view tab. In the Action column of the policy, click Delete. Then, confirm the deletion by clicking Delete in the box that appears.

Last updated: 2026.02.10 17:24:20