Torch Object Storage
Torch Object Storage
Torch Object Storage
Document
What's New
Announcements
Billing
Billable items
Billing method
Getting Started
User Guide
Working with buckets
Basic configurations
Managing lifecycle
Back-to-origin rules
Event notification
Intelligent Tiering
Permissions
Domain management
Fault tolerance and disaster recovery
Cross-region replication
Same-region replication
Data redundancy
Image processing
ObjectSet
Working with objects
Managing folders
Monitoring and alerting
Metric monitoring
Access control
Bucket policies
Common configuration scenarios
Authorizing IAM users of the current account
Authorizing other accounts
Managing access via tools and SDKs
Managing public read access
Data security
Access points
Multi-region access points (MRAP)
Single-region access points (SRAP)
Converged access points (CAP)
DevMind
TOS accelerator
SenseFlow
TOS Agent
Data processing
Basic concepts
Image processing
Media processing
Document preview
Task processing
Data subscription
Flow control management
Quality of Service (QoS) policies
Hierarchical namespace (HNS)
User guide
Tool reference
Best practices
TOS Vectors
User guide
API reference
Vector bucket
Vector index
SDK reference
Python-Vectors
Vector bucket
Vector index
Java-Vectors
Vector bucket
Vector index
Node.js-Vectors
Vector bucket
Vector index
Tool Guide
tosutil
Common commands
Upload, download, and copy objects
Share objects
Auxiliary commands
Common examples
TOS Browser
FSX
FSX best practices
TOS PyTorch Connector
tosfsspec
API Reference
Signature Mechanism
The header contains a signature
Bucket
Basic Bucket Operations
Bucket Lifecycle
Access Monitor
Bucket ACL
Bucket CORS
Bucket Policy
Back-to-origin Rules
Bucket Replication
Versioning
Static Website
Event Notification
Custom Domain
Server-side encryption
Transfer Acceleration
Data Processing
Image processing
Media processing
Video transcoding
Audio transcoding
video to GIF
Document preview
File decompression
Log Storage
Retention Policy
Requester pays
TLS version
Object
Basic Object Operations
Object ACL
Fetch Object
Symbolic Link
WORM object
Multipart Upload
SDK Reference
Java
Pre-signing Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload Object
Download Object
Upload and Download Speed Limit
Copy Object
List Object
Data Processing
Image Processing
Video Processing
Audio Processing
Log Configuration
Hierarchical Namespace
Bucket base interface
Introduction to Typical Scenes
Python
Data processing
Pre-signature mechanism
Bucket interface
Basic bucket interface
Manage bucket configuration
Object interface
Upload object
Download object
Copy object
List objects
Introduction to typical scenes
C
Object Interface
Upload object
C++
Pre-signature Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload Object
Download Object
Copy Object
List Objects
Data Processing
Go
Object Interface
Upload Object
Download Object
Copy Object
List Objects
Manage Objects
Bucket Interface
Manage Bucket Configuration
Data Processing
Log Configuration
Introduction to Typical Scenes
Pre-signature Mechanism
Node.js
Pre-signature Mechanism
Bucket Interface
Basic Bucket Interface
Manage Bucket Configuration
Object Interface
Upload object
Download object
Copy object
List objects
Data Processing
Image Processing
Introduction to Typical Scenes
Browser.js
Pre-signature Mechanism
Upload Object
Download Object
Copy Object
List Objects
Manage Objects
Data Processing
.NET
Bucket Interface
Object Interface
Upload Object
Download Object
List Objects
Introduction to Typical Scenes
PHP
Bucket Interface
Object Interface
Download Object
Data Processing
Exception Handling
Android
Bucket Interface
Object Interface
Upload Object
Download Object
Exception Handling
iOS
Bucket Interface
Object Interface
Upload Object
Download Object
Harmony
Pre-signature Mechanism
Bucket Interface
Object Interface
Upload Object
Download Object
List Objects v2
Introduction to Typical Scenarios
Rust
Pre-signing mechanism
Bucket interface
Basic bucket operations
Lifecycle rules
Bucket ACLs
Cross-origin resource sharing
Bucket inventory
Back-to-origin rules
Bucket replication
Static website hosting
Event notification
Custom domain
Server-side encryption
Object interface
Basic operation
Access control
Error Codes
01-SERVICE_ERROR
02-AUTH
03-ACCESS_CONTROL
04-QOS
05-REQUEST
06-BUCKET
07-LIFECYCLE
08-ACL
09-CORS
10-POLICY
11-MIRROR
12-REPLICATION
13-WEBSITE
14-NOTIFICATION
15-ENCRYPT
16-CUSTOMDOMAIN
17-OBJECT
18-TAG
19-MULTIPART
20-STORAGE_CLASS
21-CALLBACK
22-DATA_PROCESS
23-BATCH
24-STORAGE_LENS
25-INVENTORY
26-DIRECTORY_BUCKET
FAQ
Best Practices
AIGC-Doubao LLMs
Accessing TOS with third-party tools
Granting temporary access
Data migration
Data processing
Checking data integrity
Performance optimization
- Documentation
Torch Object StorageSDK ReferencePythonObject interfaceManage objectsManage object access permissions (Python SDK)
Copy page
Download PDFManage objects
Manage object access permissions (Python SDK)
Copy pageDownload PDFManage object access permissions (Python SDK)
This article explains how to get and set object access permissions. Object access permissions take precedence over bucket permissions. If an object does not have access permissions set, bucket permissions apply.
Set object read and write permissions
warning
To set object read and write permissions, you must have tos:PutObjectACL permission or WRITE_ACP object ACL permission. For details, see Permission Configuration Guide.
Object ACL description
Object ACL permissions include the following types.
Access permission | Description | Access permission value |
Access permission | Description | Access permission value |
READ | Allow the grantee to read object data and its metadata | tos.PermissionType.Permission_Read |
READ_ACP | Allow grantees to read object ACL | tos.PermissionType.Permission_Read_Acp |
WRITE_ACP | Allow the grantee to write ACLs for applicable objects | tos.PermissionType.Permission_Write_Acp |
FULL_CONTROL | Allow the grantee READ, READ_ACP, and WRITE_ACP permissions on the object | tos.PermissionType.Permission_Full_Control |
You can specify detailed ACL permissions in the request body or set them in the request header.
Specify detailed ACL permissions in the request body
import os
import tos
from tos import GranteeType, CannedType, PermissionType
from tos.models2 import Grantee, Grant, Owner
# Retrieve AKSK information from environment variables.
ak = os.getenv('TOS_ACCESS_KEY')
sk = os.getenv('TOS_SECRET_KEY')
endpoint = "your endpoint"
region = "your region"
bucket_name = 'bucket-test'
# Object key, for example, if the file is example_object.txt under example_dir, fill in as example_dir/example_object.txt
object_key = 'object-key'
try:
client = tos.TosClientV2(ak, sk, endpoint, region)
# Grantee is the account ID
grantee1 = Grantee(GranteeType.Grantee_User, id='account id', display_name='account display name')
# Grantee is all users in a predefined group
grantee2 = Grantee(GranteeType.Grantee_Group, canned=CannedType.Canned_All_Users)
# Grant Permission_Full_Control to the specified account ID
grant_1 = Grant(grantee1, PermissionType.Permission_Full_Control)
# Grant Permission_Read to all users
grant_2 = Grant(grantee2, PermissionType.Permission_Read)
client.put_object_acl(bucket_name, object_key, grants=[grant_1, grant_2],
owner=Owner("object owner id", 'object owner name'))
except tos.exceptions.TosClientError as e:
# Operation failed, catch client error, usually caused by invalid request parameters or network issues
print('fail with client error, message:{}, cause: {}'.format(e.message, e.cause))
except tos.exceptions.TosServerError as e:
# Operation failed, catch server error, detailed error information can be obtained from the response
print('fail with server error, code: {}'.format(e.code))
# request id can be used to locate specific issues, it is strongly recommended to save it in the log.
print('error with request id: {}'.format(e.request_id))
print('error with message: {}'.format(e.message))
print('error with http code: {}'.format(e.status_code))
print('error with ec: {}'.format(e.ec))
print('error with request url: {}'.format(e.request_url))
except Exception as e:
print('fail with unknown error: {}'.format(e))
Set access permissions in the request header
There are six categories of read and write permissions for objects set through the x-tos-acl request header.
Access permission | Description | Access permission value |
Access permission | Description | Access permission value |
Private | Private. The object owner has all permissions; other users have no permission to operate the object. | tos.ACLType.ACL_Private |
Public Read | Public Read. The object owner has all permissions; other users have read-only permission for the object. | tos.ACLType.ACL_Public_Read |
Authenticated user read | The object owner has all permissions; authenticated users have read permission for the object. | tos.ACLType.ACL_Authenticated_Read |
Bucket owner read | The object owner has all permissions; the bucket owner has read permission for this object. | tos.ACLType.ACL_Bucket_Owner_Read |
The bucket owner has all permissions | Bucket owners and object owners have all permissions on the object | tos.ACLType.ACL_Bucket_Owner_Full_Control |
The following code sets the object's read and write permissions using x-tos-acl.
import os
import tos
# Retrieve AKSK information from environment variables.
ak = os.getenv('TOS_ACCESS_KEY')
sk = os.getenv('TOS_SECRET_KEY')
endpoint = "your endpoint"
region = "your region"
bucket_name = 'bucket-test'
# Object key, for example, if the file is example_object.txt under example_dir, fill in as example_dir/example_object.txt
object_key = 'object-key'
try:
client = tos.TosClientV2(ak, sk, endpoint, region)
# Set object ACL to private
client.put_object_acl(bucket_name, object_key, acl=tos.ACLType.ACL_Private)
except tos.exceptions.TosClientError as e:
# Operation failed, catch client error, usually caused by invalid request parameters or network issues
print('fail with client error, message:{}, cause: {}'.format(e.message, e.cause))
except tos.exceptions.TosServerError as e:
# Operation failed, catch server error, detailed error information can be obtained from the response
print('fail with server error, code: {}'.format(e.code))
# request id can be used to locate specific issues, it is strongly recommended to save it in the log.
print('error with request id: {}'.format(e.request_id))
print('error with message: {}'.format(e.message))
print('error with http code: {}'.format(e.status_code))
print('error with ec: {}'.format(e.ec))
print('error with request url: {}'.format(e.request_url))
except Exception as e:
print('fail with unknown error: {}'.format(e))
The following code sets the object's read and write permissions via the x-tos-grant-* request header.
import os
import tos
# Retrieve AKSK information from environment variables.
ak = os.getenv('TOS_ACCESS_KEY')
sk = os.getenv('TOS_SECRET_KEY')
endpoint = "your endpoint"
region = "your region"
bucket_name = 'bucket-test'
# Object key, for example, if the file is example_object.txt under example_dir, fill in as example_dir/example_object.txt
object_key = 'object-key'
try:
client = tos.TosClientV2(ak, sk, endpoint, region)
# Grant user ID 1000000001 FULL_CONTROL permission, and grant READ permission on the bucket to all users.
client.put_object_acl(bucket_name, object_key, grant_full_control='id="1000000001"', grant_read='canned="AllUsers"')
except tos.exceptions.TosClientError as e:
# Operation failed, catch client error, usually caused by invalid request parameters or network issues
print('fail with client error, message:{}, cause: {}'.format(e.message, e.cause))
except tos.exceptions.TosServerError as e:
# Operation failed, catch server error, detailed error information can be obtained from the response
print('fail with server error, code: {}'.format(e.code))
# request id can be used to locate specific issues, it is strongly recommended to save it in the log.
print('error with request id: {}'.format(e.request_id))
print('error with message: {}'.format(e.message))
print('error with http code: {}'.format(e.status_code))
print('error with ec: {}'.format(e.ec))
print('error with request url: {}'.format(e.request_url))
except Exception as e:
print('fail with unknown error: {}'.format(e))
Related documentation
Get object read and write permissions
warning
To get an object's access permissions, you must have the tos:GetObjectACL permission or the object's ACL READ_ACP permission. For detailed operations, see the permission configuration guide.
Example code
The following code retrieves the access permissions for object object-test in bucket-test.
import os
import tos
# # Retrieve AKSK information from environment variables.
ak = os.getenv('TOS_ACCESS_KEY')
sk = os.getenv('TOS_SECRET_KEY')
endpoint = "your endpoint"
region = "your region"
bucket_name = 'bucket-test'
# Object key, for example, if the file is example_object.txt under example_dir, fill in as example_dir/example_object.txt
object_key = 'object-key'
try:
# Create a TosClientV2 object to perform operations on buckets and objects
client = tos.TosClientV2(ak, sk, endpoint, region)
# Obtain permissions on the object
out = client.get_object_acl(bucket_name, object_key)
print('owner_id={}'.format(out.owner.id))
for grant in out.grants:
print('permission={}'.format(grant.permission.value))
print('id={}'.format(grant.grantee.id))
print('type={}'.format(grant.grantee.type))
print('canned={}'.format(grant.grantee.canned))
except tos.exceptions.TosClientError as e:
# Operation failed, catch client error, usually caused by invalid request parameters or network issues
print('fail with client error, message:{}, cause: {}'.format(e.message, e.cause))
except tos.exceptions.TosServerError as e:
# Operation failed, catch server error, detailed error information can be obtained from the response
print('fail with server error, code: {}'.format(e.code))
# request id can be used to locate specific issues, it is strongly recommended to save it in the log.
print('error with request id: {}'.format(e.request_id))
print('error with message: {}'.format(e.message))
print('error with http code: {}'.format(e.status_code))
print('error with ec: {}'.format(e.ec))
print('error with request url: {}'.format(e.request_url))
except Exception as e:
print('fail with unknown error: {}'.format(e))
Related documentation
Last updated: 2025.09.17 18:22:10
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
