The put_vector_bucket_policy interface sets the access policy for vector buckets. This article explains how to update or add policies using the put_vector_bucket_policy interface in the TOS Vectors Python SDK.

Notes

You need to fill in the region and access domain in the sample code according to your actual situation. For details, see Region and Access Domain (Endpoint).

To prevent key leakage, the sample code in this article reads the Access Key ID and Secret Access Key from environment variables. Therefore, before using the SDK, you need to configure long-term access credentials. For details, see Configure Long-term Access Credentials.

The TOS Vectors Python SDK supports temporary access credentials and also supports mechanisms like timeout settings and retry policies. You can configure these flexibly based on business needs to enhance application security. For details, see Common Configuration Scenarios.

Permissions required

The primary account has full permissions by default, but IAM users have no permissions by default. If a sub-account needs to perform the put_vector_bucket_policy operation, the primary account must grant the following permissions to the sub-account through IAM policies and bucket policies:

tosvectors:PutVectorBucketPolicy

Code example

Set the IAM policy for the vector bucket

# Set the IAM policy for the vector bucket​
import os​
import json​
import tos​
​
# Retrieve AK and SK information from environment variables.​
ak = os.getenv("TOS_ACCESS_KEY")​
sk = os.getenv("TOS_SECRET_KEY")​
# Fill in your endpoint and your region with the endpoint corresponding to the bucket's region. # For example, for China (Beijing), set your endpoint to https://tosvectors-cn-beijing.volces.com and your region to cn-beijing.​
endpoint = os.getenv("TOS_ENDPOINT")​
region = os.getenv("TOS_REGION")​
vector_bucket_name = os.getenv("TOS_BUCKET")​
account_id = os.getenv("TOS_ACCOUNT_ID")​
​
try:​
    # Create a VectorClient object; all vector operations are handled through VectorClient.​
    client = tos.VectorClient(ak, sk, endpoint, region)​
​
    # Get account ID​
​
    # Define an IAM policy that allows access to vector buckets.​
    policy = {​
        "Version": "2012-10-17",​
        "Statement": [​
            {​
                "Effect": "Allow",​
                "Principal": [account_id],​
                "Action": "tosvectors:GetVectorBucket",​
                "Resource": f"trn:tosvectors:{region}:{account_id}:bucket/{vector_bucket_name}",​
            }​
        ],​
    }​
​
    # Convert the strategy to a JSON string.​
    policy_json = json.dumps(policy, indent=2)​
​
    # Set the vector bucket policy​
    result = client.put_vector_bucket_policy(​
        vector_bucket_name=vector_bucket_name, account_id=account_id, policy=policy_json​
    )​
​
    # Print the operation result.​
    print("Set the IAM policy for the vector bucket successfully.")​
    print("Request ID:", result.request_id)​
    print("Status Code:", result.status_code)​
​
except tos.exceptions.TosClientError as e:​
    # The operation failed and a client exception was caught. This is usually due to invalid request parameters or a network exception.​
    print("fail with client error, message:{}, cause: {}".format(e.message, e.cause))​
except tos.exceptions.TosServerError as e:​
    # The operation failed and a server exception occurred. See the response for the error details.​
    print("fail with server error, code: {}".format(e.code))​
    # Use the request ID for troubleshooting purposes. We strongly recommend including the request ID in the logs.​
    print("error with request id: {}".format(e.request_id))​
    print("error with message: {}".format(e.message))​
    print("error with http code: {}".format(e.status_code))​
    print("error with ec: {}".format(e.ec))​
    print("error with request url: {}".format(e.request_url))​
except Exception as e:​
    print("fail with unknown error: {}".format(e))​
​