CI allows you to filter buckets by tag in the console or via the API, which is implemented based on authorization by tag.
Authorization steps
1. Log in to the CAM console with the root account Owner and enter the policy configuration page. 2. Grant sub-account SubUser access to buckets with the specified tag through the policy generator or policy syntax as follows:
2. Click Create Custom Policy > Create by Policy Generator.
3. On the permission configuration page, configure the following:
Effect: Use the default option Allow.
Service: Select CI.
Operation: Select Read > DescribeCIBuckets (querying the CI bucket list).
Resource: Select All resources.
Condition: Click Add other conditions. On the panel, configure the following:
Condition Key: Select qcs:resource_tag.
Operator: Select string_equal.
Condition Value: Enter a tag in the format of key&val. Here, replace key and val with the specified tag key and value respectively.
4. Click Next and enter the policy name.
5. Click Complete.
2. Click Create Custom Policy > Create by Policy Syntax.
3. Select Blank Template and click Next.
4. Enter a policy in the following format. Here, replace key and val with the specified tag key and value respectively.
{
"statement": [
{
"action": [
"ci:DescribeCIBuckets"
],
"condition": {
"string_equal":{
"qcs:resource_tag": "key&val"
}
},
"effect": "allow",
"resource": [
"*"
]
}
],
"version": "2.0"
}
5. Click Complete.
3. Associate the policy with the sub-account SubUser by locating the policy created in step 2 on the Policies page and clicking Associate User/User Group/Role on the right.
4. In the pop-up window, select the sub-account SubUser and click OK.
Viewing in the console
1. Log in to the CI console with the sub-account SubUser. 2. The Bucket List page automatically displays the list of buckets to which the sub-account has access.
At this point, you have granted the sub-account access to buckets with the specified tag (key and val).