Granting authorization through bucket policies

Preparations

1. Create a bucket.
   Granting authorization through bucket policies only targets specified buckets, so you need to first create a bucket. For authorization on account dimension, please refer to [Granting authorization through access management (CAM)] (#cam) in this document.
2. Prepare the UIN of the account to be authorized
   This document assumes that the root account that owns the target bucket has a UIN of 100000000001, and that its sub-account has a UIN of 100000000011. The sub-account needs to be authorized to access the destination bucket.

   • To query the sub-accounts created under the main account, log in to the CAM Console and view them under User List.
   • To create a new sub-account, please see Creating a Custom Sub-User.

3. Open the [Add Policy] dialog box
   Enter the [Permission Management] page of the destination bucket and scroll down to [Permission Policy Settings]. Click [Add Policy], and then configure following the examples outlined in this document. For detailed instructions on how to add policies, see Adding Bucket Policies.

The following lists several authorization cases, which you can configure according to your actual needs.

Authorization Cases

Case 1: Granting a sub-account full permission for a specified directory

The configuration information is as follows:

Case 2: Granting a sub-account read permission for the files in a specified directory

The configuration information is as follows:

Case 3: Granting a sub-account read and write permission for specified files

The configuration information is as follows:

Case 4: Granting a sub-account read and write permission for all files in a specified directory while prohibiting read and write permission for specified files in the directory

For this case, we need to add two policies: an allow policy and a prohibit policy.

1. First add the allow policy. The configuration information is as follows:

2. Then add the prohibit policy. The configuration information is as follows:

5. Granting a sub-account read and write permission for files with specified prefixes
   The configuration information is as follows: