Help & DocumentationCloud Access ManagementBusiness Use CaseCOS CasesAuthorizing Cross-Account ’s Sub-account Read/Write Access to Specified File

Authorizing Cross-Account ’s Sub-account Read/Write Access to Specified File

Last updated: 2019-12-25 16:10:09


The enterprise account, CompanyGranter (ownerUin: 12345678; appID: 1250000000), has an object, Object1, that is located in the dir1 directory of the Bucket1 bucket in the Guangzhou region. The sub-account of another enterprise account, CompanyGrantee (ownerUin: 87654321), requires read/write permission for Object1.

This involves permission propagation.

Step 1: CompanyGrantee creates the following policy according to policy syntax.

    "version": "2.0",
         "effect": "allow",
         "action": "cos:*",
         "resource": "qcs::cos:ap-shanghai:uid/1250000000:Bucket1-1250000000/dir1/Object1"

Step 2: associate the sub-account with the policy. To learn how to associate a policy with a user account, see Authorization Management.

Step 3: the CompanyGranter enterprise account grants CompanyGrantee enterprise account access to Object1 by configuring the policy and ACL in the COS Console. For more information, see COS documentation.