A single-region access point provides a dedicated domain name for a bucket and enables you to configure permission policies for each access point. To use the access point, you must delegate access to it. Afterwards, all access through the access point is restricted to actions explicitly permitted by its policy. This topic explains how to create a single-region access point, define its policy, and delegate access.

Notes

Each access point can only be associated with one bucket. Once a bucket is associated with an access point, it cannot be changed.

There is a maximum of 100 access points per region per account.

The total JSON description size of access point policies per account cannot exceed 20 KB.

Scenario

Company A has ten departments that use a unified data lake for workloads such as model training and inference. Although these departments access data from the same bucket, each department requires access to different data and directories. For example:

Departments 1 to 3 need read and write access to objects under databucket/raw.

Departments 4 to 6 need read access to objects under databucket/processed.

Departments 7 to 10 need read and write access to objects under databucket/features.

In this scenario, Company A can create three access points through the (210015****) account that owns the bucket. Then, Company A can configure permission policies and delegate access control for the bucket to these access points. These departments can then access the corresponding data through the different access points.

Step 1: Create an access point

Log in to the TOS console.

In the left navigation pane, select Access point > Single-Region Access Point.

On the Single-Region Access Point page, click Create a Single-Region Access Point.

On the Create a Single-Region Access Point page, configure the following parameters.

Parameter	Description	Example value
Access Point Name	Enter a name for the single-region access point. The access point names must: Contain only lowercase (a–z) and uppercase (A–Z) letters, hyphens (-), and numbers. Be between 3 and 50 characters long. Not start or end with a hyphen (-); not end with -tosalias. tip Access point names must be unique within each region of each account.	Departments 1–3: ap1 Departments 4–6: ap2 Departments 7–10: ap3
Bucket	Select the bucket that will be attached to the single-region access point. Only one bucket can be selected.	Departments 1–3: databucket Departments 4–6: databucket Departments 7–10: databucket
Network source	Select the type of network access for the access point. Options: Internet: Allows requests from both the public and private networks when accessing TOS resources via the access point. VPC: Only allows requests from the specified VPC when accessing TOS resources via the access point. After selecting this option, select a VPC from the dropdown menu.	Departments 1–3: Internet Departments 4–6: Internet Departments 7–10: Internet

Once you have finished configuring, click Select.

After creating the single-region access point, click its name to view details such as the TRN, alias, and external endpoint on the Overview tab.

Step 2: Create permission policies for the access point

You can create access point policies using either a visual or JSON editor. Choose the method that best suits your needs.

Creating an access point policy in visual view

Log in to the TOS console.

In the left navigation pane, select Access point > Single-Region Access Point.

On the Single-Region Access Point page, click the single-region access point you want to manage.

On the single-region access point details page, click the Permission tab.

On the Visual view tab, click Create policy.

Under Select template, choose a policy template and click Next step.

In this scenario, select Folder Read and Write for departments 1–3 and 7–10, and Folder Read-Only for departments 4–6.

Under Configure policy, configure the following parameters and click Next step.

Parameter	Description	Example value
Policy configuration method	Select Visual view.	Visual view
Policy name	Enter a name for the access point policy.	Departments 1–3: Folder Read and Write-fb8e Departments 4–6: Folder Read-Only-b6ec Departments 7–10: Folder Read and Write-yu3i
Effect	Select whether the policy results in an allow or a deny. Allow: Allows the matched requests. Deny: Denies the matched requests.	Allow
Authorized user	Specified account: The policy only applies to the specified account(s). Options: Current main account: Grants permissions to one or more IAM users or subusers of the current account. The account ID is displayed by default. Click Add row to select IAM users from the dropdown menu under Sub account name. Other main account: Grants permissions to another account and its IAM users or subusers. Enter the account ID and IAM username(s). All users: The policy applies to all users, including those who are anonymous and not authenticated. In this case, selecting Allow for the Effect setting may lead to data security risks. Use with caution.	Select Current main account, click Add row, and select the corresponding IAM usernames from the dropdown menu. The IAM user assigned to each department group is as follows: Departments 1–3: ai-dev Departments 4–6: data-dev Departments 7–10: model-dev
User Policy	Select whether to include or exclude the specified user(s). You can only set the User Policy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above users: Denies specified users certain permissions. Exclude the above users: Denies certain permissions to all users except those specified. tip The "Exclude the above users" option is used only to deny permissions. It does not grant permissions. To grant specific users certain permissions, you must also create the corresponding permission policies. For guidance, see Using NotPrincipal to deny access to all users except those specified.	None
Resource	Current Single-Region Access Point: The policy applies to the bucket attached to the single-region access point. You can configure bucket actions in the Action section. Objects in bucket: The policy takes effect on the objects in the bucket. You can configure object actions in the Action section. All objects: The policy takes effect on all objects in the bucket. Specified object(s): If you select Specified object(s), click the Add row icon to specify the object(s).	Select Current Single-Region Access Point, Objects in bucket, and Specified object(s). Then, enter the resource path. The path to the required resources for each department group is as follows: Departments 1–3: raw/* Departments 4–6: processed/* Departments 7–10: features/*
Resource strategy	Select whether to include or exclude the specified resource(s). You can only set the resource strategy parameter when Effect is set to Deny. The options are explained below when Effect is Deny. Include the above resources: Denies users access to the specified resources. Exclude the above resources: Denies users access to any resource except those specified. tip The "Exclude the above resources" option is used only to deny users access to certain resources. It does not grant permissions. To grant users access to certain resources, you must also create the corresponding permission policies. For guidance, see Using NotResource to deny users access to any resource except those specified.	None
Action	Select the action(s) to be authorized. For more information, see Supported actions.	Use the default actions set in the template.
Operational strategy	Select whether to include or exclude the specified action(s). How the operational strategy works depends on the effect you previously selected. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies. The options are explained below when Effect is Allow. Include the above actions: Allows users to perform the specified actions. Exclude the above actions: Allows users to perform any action except those specified. For guidance, see Using NotAction to allow users to perform any action except those specified.	Include the above actions
Condition	Click the Add row icon and set the condition and value. For more information, see Conditions.	None

Under Confirm policy, click Select.

Creating an access point policy in JSON view

Log in to the TOS console.

In the left navigation pane, select Access point > Single-Region Access Point.

On the Single-Region Access Point page, click the single-region access point you want to manage.

On the single-region access point details page, click the Permission tab.

Click the JSON view tab.

Click Edit and enter the policy content.

The parameters in an access point policy have the same meaning as those in a bucket policy, except for Resource and NotResource. For more information, see Bucket policy parameters.

Parameter	Description
Resource	The resources that the policy will apply to. Follow these guidelines when specifying the resource: To manipulate a bucket, set Resource to the access point TRN. For example, "Resource": "trn:tos:cn-beijing:214748**:accesspoint/bbb". To manipulate objects in a bucket, set Resource to <access point TRN>/object/<resource path within the bucket>. For example, to manipulate "test/", set Resource to "trn:tos:cn-beijing:214748*:accesspoint/bbb/object/test/". tip On the Single-Region Access Point page, click the access point you want to check. Then, on the Overview tab, locate the access point TRN.
NotResource	This parameter must be used in conjunction with "Effect":"Deny". When combined with "Effect":"Deny", it denies access to all resources except those specified by NotResource. Follow these guidelines when specifying the resource: To manipulate a bucket, set Resource to the access point TRN. For example, "Resource": "trn:tos:cn-beijing:214748**:accesspoint/bbb". To manipulate objects in a bucket, set Resource to <access point TRN>/object/<resource path within the bucket>. For example, to manipulate "test/", set Resource to "trn:tos:cn-beijing:214748*:accesspoint/bbb/object/test/".

Example policy:

For departments 1–3
For departments 4–6
For departments 7–10

{
"Statement": [
{
"Sid": "Folder Read and Write-fb8e",
"Effect": "Allow",
"Principal": [
"210015****/ai-dev"
],
"Action": [
"tos:ListBucket",
"tos:HeadBucket",
"tos:ListBucketVersions",
"tos:ListBucketMultipartUploads",
"tos:AbortMultipartUpload",
"tos:GetObject",
"tos:PutObject",
"tos:GetObjectAcl",
"tos:PutObjectAcl",
"tos:GetObjectVersion",
"tos:ListMultipartUploadParts"
],
"Resource": [
"trn:tos:cn-beijing:210015****:accesspoint/ap1",
"trn:tos:cn-beijing:210015****:accesspoint/ap1/object/raw/*"
],
}
]
}

Once you have finished configuring, click Select.

Step 3: Delegate access control for the bucket to an access point

When accessing bucket resources via an access point, the system evaluates both the access point policy and the bucket policy. Access is granted only if both policies permit it. Access will be denied if either policy denies or does not authorize the operation. After creating a single-region access point policy, you must configure bucket policies for the associated bucket to delegate access to the access point. Then, you can access the resources of the bucket through the access point.

TOS provides a visual permission delegation feature. On the Access point permission delegation panel, you can select a delegation type. The system then automatically generates the corresponding authorization statement. After you verify the details, the system authomatically creates the statements within the bucket policies of the associated bucket. This feature simplifies complex bucket policy configurations and enables permission isolation based on access points.

Log in to the TOS console.

In the left navigation pane, select Access point > Single-Region Access Point.

On the Single-Region Access Point page, click the single-region access point you want to manage.

On the single-region access point details page, click the Permission tab.

On the Visual view tab, click Access point permission delegation.

Under Select delegate type, set the Delegation type, and then click Generation Policy.

Delegation type	Description	Example value
DataAccessPointTrn	Delegates access to the current access point. After delegation, this access point becomes available.	Select AccessPointNetworkOrigin and Internet.
DataAccessPointAccount	Delegates access to all access points within the current account. After delegation, all access points within the current account become available.
AccessPointNetworkOrigin	Delegates access to all access points with the specified network source. After delegation, all access points with the specified network source become available. After selecting "AccessPointNetworkOrigin", select the type of network access. Options: VPC: Delegates access to access points whose network origin is VPC. Internet: Delegates access to access points whose network origin is Internet.

After confirming that the policy content is correct, click Submit under Generation Policy.

Next steps

Once you have successfully delegated access to the access points, you can share access point aliases with the departments, allowing them to access related resources through these access points. For instructions, see Using single-region access points.

Torch Object Storage