Tutorial: Use a RAM policy to allow a user to access OSS resources only over HTTPS-Object Storage Service(OSS)-阿里云帮助中心

OSS supports both HTTPS and HTTP. Because HTTP transmits data without encryption, it exposes your resources to interception and tampering. This tutorial shows you how to use a Resource Access Management (RAM) policy to block a specific RAM user's HTTP access to OSS while preserving their HTTPS access.

Background

RAM policies are user-based access control policies. They let you control what a specific RAM user or role can do, but they cannot block HTTP requests from all users to a bucket or object.

Prerequisites

Before you begin, ensure that you have:

A RAM user to apply the policy to
The AliyunOSSFullAccess, AliyunRAMFullAccess, and AliyunSTSAssumeRoleAccess policies attached to the account you use to log on to the RAM console

Configure the RAM policy

Step 1: Log on to the RAM console

Log on to the RAM console.

Step 2: Create a custom policy

Create a custom RAM policy that uses the acs:SecureTransport condition key to block HTTP requests. This key returns true when a request uses HTTPS and false when it uses HTTP. Setting Effect to Deny when acs:SecureTransport is false blocks all HTTP requests.

Use the Deny effect to block HTTP rather than the Allow effect to permit HTTPS. When acs:SecureTransport is configured, OSS disables automatic conversion between HTTP and HTTPS in both directions. A Deny-based policy explicitly rejects unencrypted requests regardless of how HTTPS is handled upstream.

Use the following policy document:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "oss:*"
      ],
      "Resource": [
        "acs:oss:*:*:*"
      ],
      "Condition": {
        "Bool": {
          "acs:SecureTransport": [
            "false"
          ]
        }
      }
    }
  ]
}

For instructions on creating a custom policy, see Create a custom policy.

Step 3: Attach the policy to the RAM user

Attach the RAM policy you created to the target RAM user. For instructions, see Grant permissions to a RAM user.

Verify the policy

After attaching the policy, verify that it blocks HTTP requests and allows HTTPS requests.

Verify that HTTP access is blocked

Use OSS SDK for Python to upload an object over HTTP. The endpoint uses the http:// scheme.

# -*- coding: utf-8 -*-
import oss2

# Authenticate with the RAM user's AccessKey credentials.
# Avoid hardcoding credentials in production — use environment variables instead.
auth = oss2.Auth('[$AccessKeyId]', '[$AccessKeySecret]')

# Use an HTTP endpoint to test that the policy blocks unencrypted requests.
bucket = oss2.Bucket(auth, 'http://oss-cn-hangzhou.aliyuncs.com', 'examplebucket')

# Upload a local file to the bucket.
bucket.put_object_from_file('exampleobject.txt', 'D:\\localpath\\examplefile.txt')

If the policy is working, the upload fails with a 403 AccessDenied error:

oss2.exceptions.AccessDenied: {'status': 403, 'x-oss-request-id': '6V37D53DMF67EBeDF5BDa095',
'details': {'HostId': 'examplebucket.oss-cn-hangzhou.aliyuncs.com',
'Message': 'You have no right to access this object because of bucket acl.',
'Code': 'AccessDenied', 'RequestId': '6V37D53DMF67EBeDF5BDa095'}}

Verify that HTTPS access is allowed

Upload the same object using an HTTPS endpoint. The only difference from the previous example is the https:// scheme in the endpoint URL.

# -*- coding: utf-8 -*-
import oss2

auth = oss2.Auth('[$AccessKeyId]', '[$AccessKeySecret]')

# Use an HTTPS endpoint.
bucket = oss2.Bucket(auth, 'https://oss-cn-hangzhou.aliyuncs.com', 'examplebucket')

bucket.put_object_from_file('exampleobject.txt', 'D:\\localpath\\examplefile.txt')

A successful upload returns:

Put object done, req_id: 6V37D53DMF67EBeDF5BDa095, status_code: 200

What's next

To learn more about RAM policies, see Grant permissions to a RAM user.