Docs

Torch Object Storage

Common configuration scenarios

Denying access to buckets based on IP addresses

This topic explains how to restrict access to a bucket based on IP addresses.

Scenario

Principal: IAM user user of another account 210000****.

Resource: All objects in the bucketname bucket.

Restricted IP addresses: 192.168.1.0 and 1080:0:0:0:8:800:200C:417A.

tip

To allow access to the bucket only from specified IP addresses, change the value of the Conditional operator in this example to Not Equal To. If using the JSON view, change IpAddress to NotIpAddress.

Notes

If a configured permission does not take effect, we recommend that you retry later, as there is a delay.

Steps

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

Visual view

JSON view

Click Create policy.

On the Create Bucket Authorization Policy page, select Folder Read-Only and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, we select Deny. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Select Other main account, and enter the account ID. Then, click Add Field and enter the name of the IAM user you want to authorize under Sub account name. In this example, we enter user.
Resource	Resource scope	Specified object(s) is selected by default, and the Resource Path is required. In this example, we select All objects. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Action	General Action	The current template includes several pre-configured actions. You can leave them as they are or modify the allowed actions according to your needs. For more information on actions allowed by bucket policies, see Supported actions.
			Bucket Action
			Object Action
		Operational strategy	Use the default option, i.e., Include the above actions. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies.
Condition (Optional)	-	Click Add Field to specify the condition. Key: SourceIp Conditional operator: Equal To Value: 192.168.1.0 tip Both IPv4 and IPv6 addresses are supported. For more information, see Bucket policy templates and parameters. The IP addresses in this example are for reference only. Provide the IP address(es) according to your scenario. Click Add Field to set multiple IP addresses.

Save your settings by clicking Next.

After verifying the details, click Create.

Last updated: 2026.08.14 16:23:29