Control OSS access with RAM policies

OSS storage model

OSS uses a flat storage model to store objects as key-value pairs. All objects belong directly to a bucket, and no physical directory hierarchy exists. The 'directories' displayed in the console are created by using the prefixes of object keys and a delimiter (/) to simulate a folder hierarchy.

For the bucket examplebucket, the console displays the following directory structure and object keys:

examplebucket
├── Development/                     # Key: Development/ (directory object)
│   ├── Alibaba Cloud.pdf            # Key: Development/Alibaba Cloud.pdf
│   ├── ProjectA.docx                # Key: Development/ProjectA.docx
│   └── ProjectB.docx                # Key: Development/ProjectB.docx
├── Marketing/                       # Key: Marketing/ (directory object)
│   ├── data2020.xlsx                # Key: Marketing/data2020.xlsx
│   └── data2021.xlsx                # Key: Marketing/data2021.xlsx
├── Private/                         # Key: Private/ (directory object)
│   └── 2017/                        # Key: Private/2017/ (directory object)
│       ├── images.zip               # Key: Private/2017/images.zip
│       └── promote.pptx             # Key: Private/2017/promote.pptx
└── oss-dg.pdf                       # Key: oss-dg.pdf

A directory object's key ends with /. OSS uses this suffix to identify directories. In storage, all objects, including directory objects, are stored flat.

Because OSS has no true directory hierarchy, granting access to a 'directory' means granting access to all objects with a specific prefix. For example, granting access to the Development/ directory is equivalent to granting access to all objects whose keys start with Development/.

Bucket, directory, and object request differences

Different operations require different API requests and Resource configurations.

GET /?prefix=Development/&delimiter=/ HTTP/1.1
Host: examplebucket.oss-cn-hangzhou.aliyuncs.com

Console vs. API/SDK access

Console access requires navigating from the bucket list to the target directory, which needs more permissions than direct API or SDK calls.

Policy design

Read/write access to Development/ requires two permission types:

1. List permission: List objects in Development/ (oss:ListObjects), with a Condition that restricts listing to the Development prefix.

2. Read/write permissions: Read and upload files in Development/ (oss:GetObject, oss:PutObject), with Resource set to examplebucket/Development/*.

Create and attach a policy

1. Go to the Policies page in the RAM console and click Create Policy.

2. On the JSON tab, enter the following policy document:

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "oss:ListObjects",
         "Resource": "acs:oss:*:*:examplebucket",
         "Condition": {
           "StringLike": {
             "oss:Prefix": [
               "Development",
               "Development/*"
             ]
           }
         }
       },
       {
         "Effect": "Allow",
         "Action": [
           "oss:GetObject",
           "oss:PutObject",
           "oss:GetObjectAcl"
         ],
         "Resource": "acs:oss:*:*:examplebucket/Development/*"
       }
     ]
   }

   Policy analysis:

   • First statement: Grants list permission on the bucket, using Condition with oss:Prefix to restrict listing to the Development directory and subdirectories.

   • Second statement: Grants read/write access to all objects under Development/*.

3. Click OK, enter a Policy Name (such as AllowAnneAccessDevelopment), and click OK to complete the creation.

4. Go to the Users page, find the RAM user Anne, and add permissions by attaching the newly created policy.

Create a user group and add members

1. Go to the RAM user group list and click Create User Group (such as DenyPrivateAccessGroup).

2. Click Add Group Members, and add the RAM users who need to be denied access to the Private/ folder to the user group.

Create and attach a deny policy

1. Go to the Policies page in the RAM console and click Create Policy.

2. On the JSON tab, enter the following policy document:

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": "oss:*",
         "Resource": "acs:oss:*:*:examplebucket/Private/*"
       },
       {
         "Effect": "Deny",
         "Action": "oss:ListObjects",
         "Resource": "acs:oss:*:*:examplebucket",
         "Condition": {
           "StringLike": {
             "oss:Prefix": [
               "Private/",
               "Private/*"
             ]
           }
         }
       }
     ]
   }

   Policy analysis:

   • First statement: Denies all operations on objects under Private/.

   • Second statement: Denies listing Private/ contents, preventing users from viewing the file list.

3. Click OK, enter a Policy Name (such as DenyAccessPrivateFolder), and click OK to complete the creation.

4. Go to the Groups page, find the user group, and add permissions by attaching the policy that you just created.

If a group member attempts to list or download files in the Private/ folder, OSS returns a permission denied error.