A bucket (Bucket) in TOS serves as a globally unique namespace, functioning as a data container for storing object (Object) data. In TOS, permission control is implemented through IAM Policy, Bucket Policy, and bucket and object ACLs. Both bucket policies and ACLs are resource-based permission control mechanisms within TOS. Compared to bucket ACLs, bucket policies offer more flexible permission configurations. This article describes how to set, retrieve, and delete a bucket authorization policy (Policy).

Configure Bucket Policy

warning

To configure a bucket policy, you must have the tos:PutBucketPolicy permission. For detailed instructions, refer to the Permission Configuration Guide.

Users with this permission can freely modify bucket policies and may use this permission to obtain other permissions. We recommend that you configure this permission with caution.

Sample Code

The following code is used to configure the bucket policy for bucket examplebucket.

#include "TosClientV2.h"​
using namespace VolcengineTos;​
​
int main(void){​
   ​
    ​
    std::string region = "Your Region";​
    std::string accessKey = std::getenv("TOS_ACCESS_KEY");​
    std::string secretKey = std::getenv("TOS_SECRET_KEY");​
    ​
    std::string bucketName = "examplebucket";​
   ​
    std::string policy = R"({"Statement": [{"Sid": "internal public","Effect": "Allow","Action":​
["tos:ListBucket"],"Principal": "*","Resource": ["trn:tos:::examplebucket/*","trn:tos:::examplebucket"]}]})";​
    ​
   ​
    InitializeClient();​
    ​
    TosClientV2 client(region, accessKey, secretKey);​
    ​
    ​
    PutBucketPolicyInput input(bucketName);​
    input.setPolicy(Policy);​
    auto output = client.putBucketPolicy(input);​
    if (!output.isSuccess()) {​
        ​
        std::cout << "PutBucketPolicy failed." << output.error().String() << std::endl;​
       ​
        CloseClient();​
        return -1;​
    }​
    std::cout << "PutBucketPolicy success." << std::endl;​
  ​
    CloseClient();​
    return 0;​
}​

Retrieve Bucket Policy

warning

To obtain the bucket policy, you must have the tos:GetBucketPolicy permission. For specific operations, please refer to the Permission Configuration Guide.

Sample Code

The following code is used to retrieve the bucket policy for bucket examplebucket.

#include "TosClientV2.h"​
using namespace VolcengineTos;​
​
int main(void){​
    ​
    ​
    std::string region = "Your Region";​
    std::string accessKey = std::getenv("TOS_ACCESS_KEY");​
    std::string secretKey = std::getenv("TOS_SECRET_KEY");​
  ​
    std::string bucketName = "examplebucket";​
    ​
    ​
    InitializeClient();​
  ​
    TosClientV2 client(region, accessKey, secretKey);​
    ​
 ​
    GetBucketPolicyInput input(bucketName);​
    auto output = client.getBucketPolicy(input);​
    if (!output.isSuccess()) {​
       ​
        std::cout << "GetBucketPolicy failed." << output.error().String() << std::endl;​
      ​
        CloseClient();​
        return -1;​
    }​
   ​
    std::cout << "GetBucketPolicy success, the bucket policy is:" << output.result().getPolicy() << std::endl;​
  ​
    CloseClient();​
    return 0;​
}​

Bucket Deletion Policy

warning

To delete a policy, you must have the tos:DeleteBucketPolicy permission. For specific instructions, please refer to the Permission Configuration Guide.

Sample Code

The following code is used to delete the bucket policy for the bucket examplebucket.

#include "TosClientV2.h"​
using namespace VolcengineTos;​
​
int main(void){​
   ​
    std::string region = "Your Region";​
    std::string accessKey = std::getenv("TOS_ACCESS_KEY");​
    std::string secretKey = std::getenv("TOS_SECRET_KEY");​
    ​
    std::string bucketName = "examplebucket";​
    ​
​
    InitializeClient();​
 ​
    TosClientV2 client(region, accessKey, secretKey);​
    ​
​
    DeleteBucketPolicyInput input(bucketName);​
    auto output = client.deleteBucketPolicy(input);​
    if (!output.isSuccess()) {​
      ​
        std::cout << "DeleteBucketPolicy failed." << output.error().String() << std::endl;​
     ​
        CloseClient();​
        return -1;​
    }​
    std::cout << "DeleteBucketPolicy success." << std::endl;​
​
   ​
    CloseClient();​
    return 0;​
}​

Relevant Documentation

For more information about bucket policies, see Bucket Authorization Policy Management.

Last updated: 2025.09.25 14:22:45

Public security network record in Beijing: No. 11010802032137