This topic provides guidance on using NotPrincipal, NotResource, and NotAction, along with typical authorization scenarios, for your reference.

Background information

NotPrincipal and NotResource must be used with "Effect":"Deny".

NotAction can be used with either "Effect":"Deny" or "Effect":"Allow".

Specifically:

Parameter	"Effect":"Deny"	"Effect":"Allow"
NotPrincipal	Denies certain permissions to all users except those specified in NotPrincipal.	Not supported
NotResource	Denies users access to any resource except those specified in NotResource.	Not supported
NotAction	Denies users permission to perform any action except those specified in NotAction.	Allows users to perform any action except those specified in NotAction.

For more information on NotPrincipal, NotResource, and NotAction, see Bucket policy parameters.

Scenarios

Block non-allowlist users using NotPrincipal

Deny access to non-allowlist resources using NotResource

Allow non-blocklist actions using NotAction

The following example illustrates how to block all users except User example_a from accessing objects in the test/ directory via a bucket policy.

After blocking all users except User example_a, you must create a corresponding bucket policy with an "Effect": "Allow" to grant example_a permissions for the specified objects.

Scenario

Principal: IAM user example_a.

Resource: Objects in the test directory within the "example" bucket.

Actions: GetObject, PutObject, DeleteObject, GetObjectVersion, and DeleteObjectVersion.

Steps

Log in to the TOS console.

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

On the Buckets page, click the name of the bucket.

In the left navigation pane, select Permissions > Bucket policies.

Edit the policy using your preferred view.

Visual view:

Block non-allowlist users using NotPrincipal

Deny access to non-allowlist resources using NotResource

Allow non-blocklist actions using NotAction

Click Create policy.

At the bottom of the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, we select Deny. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
		Other accounts	Select Current main account. Then, click Add Field and select the IAM user you want to authorize from the drop-down menu under Sub account name. In this example, we use example_a.
		User Policy	Select Exclude the above users.
Resource	Resource scope	Select Objects in bucket and Specified object(s). Then, click Add Field and set Resource path to test/. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/*. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Resource		Resource strategy	Select Include the above resources.
Action	General Action	Leave this section empty.
		Leave this section empty.	Bucket Action
		Object Action	Select GetObject, PutObject, DeleteObject, GetObjectVersion, and DeleteObjectVersion.
		Operational strategy	Use the default option, i.e., Include the above actions. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Click Create policy.

At the bottom of the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, we select Deny. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
		Other accounts	Select Current main account. Then, click Add Field and select the IAM user you want to authorize from the drop-down menu under Sub account name. In this example, we use example_a.
		User Policy	Select Include the above users.
Resource	Resource scope	Select Objects in bucket and Specified object(s). Then, click Add Field and set Resource path to test/. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/*. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Resource		Resource strategy	Select Exclude the above resources.
Action	General Action	Leave this section empty.
		Leave this section empty.	Bucket Action
		Object Action	Select GetObject, PutObject, DeleteObject, GetObjectVersion, and DeleteObjectVersion.
		Operational strategy	Use the default option, i.e., Include the above actions. The options are explained below when Effect is Deny. Include the above actions: Denies users permission to perform the specified actions. Exclude the above actions: Denies users permission to perform any action except those specified. tip The "Exclude the above actions" option is used only to deny users permission to perform certain actions. It does not grant permissions. To grant users permission to perform certain actions, you must also create the corresponding permission policies.
Condition (Optional)	-	Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

Click Create policy.

At the bottom of the Create Bucket Authorization Policy page, select Custom Policy and click Next.

Configure the following parameters.

Category	Parameter	Description
Basic configuration	Policy configuration method	Use the default option, i.e., Visual view.
Basic configuration		Policy name	Enter a name for the policy. The policy name must be unique within a bucket.
Effect	Effect	Select the effect of the policy. In this example, use the default value. Allow (Default): Allows the matched requests. Deny: Denies the matched requests.
Authorized user	Authorized user	Use the default option, i.e., Specified account.
Authorized user		Other accounts	Select Current main account. Then, click Add Field and select the IAM user you want to authorize from the drop-down menu under Sub account name. In this example, we use example_a.
Resource	Resource scope	Select Objects in bucket and Specified object(s). Then, click Add Field and set Resource path to test/. Follow these guidelines when specifying a resource: Resource paths can contain Chinese characters, letters, numbers, and common symbols. Resource paths can point to the entire bucket, an object, or a directory. When granting permissions to a directory, use a wildcard () at the end, for example, test/*. Resource paths cannot start with a forward slash (/) or backslash (\). Consecutive forward slashes (/) are not allowed. .. cannot be used as a directory name.
Action	General Action	Leave this section empty.
		Bucket Action	Select DeleteBucket.
		Object Action	Select DeleteObject.
		Operational strategy	Select Exclude the above actions. This option allows users to perform any action except those specified.
Condition (Optional)	-	It is optional. Click the Add Field icon and set the condition and value. For more information, see Conditions.

Save your settings by clicking Next.

After verifying the details, click Create.

Then, you will see the bucket policy that you just created in the policy list.

JSON view:

Block non-allowlist users using NotPrincipal
Deny access to non-allowlist resources using NotResource
Allow non-blocklist actions using NotAction

Click Edit. Then, copy the following content into the text box, and click Save.

{
"Statement": [
{
"Sid": "Custom Policy-1e31",
"Effect": "Deny",
"NotPrincipal":["210000****/example_a"],
"Action": [
"tos:GetObject",
"tos:PutObject",
"tos:DeleteObject",
"tos:GetObjectVersion",
"tos:DeleteObjectVersion"
],
"Resource": [
"trn:tos:::example/test/*"
]
}
]
}

Next steps

Block non-allowlist users using NotPrincipal

Deny access to non-allowlist resources using NotResource

After blocking all users except User example_a, create another bucket policy to grant example_a permissions for objects within the test/ directory. For instructions, see Creating a custom bucket policy in JSON view. Example policy:

Torch Object Storage