AI 助理
备案控制台
文档
输入文档关键字查找
首页 对象存储 操作指南 OSS ON云盒 OSS ON云盒支持的Bucket操作 权限管理 RAM Policy常见示例

RAM Policy常见示例

更新时间：
产品详情
我的收藏
重要

本文中含有需要您注意的重要提示信息，忽略该信息可能对您的业务造成影响，请务必仔细阅读。

通过RAM Policy，您可以集中管理您的用户（例如员工、系统或应用程序），以及控制用户可以访问您名下哪些资源的权限，例如授权RAM用户列举并读取某个云盒Bucket的资源。

前提条件

  • 仅华东1（杭州）、华南1（深圳）、华南2（河源）、华北2（北京）、西南1（成都）地域支持使用OSS ON云盒服务。

  • 已购买云盒。具体操作，请参见购买云盒。

为RAM用户授权自定义的权限策略

  1. 创建自定义权限策略。

    您可以结合实际使用场景，选用下文列举的常见授权示例，然后通过脚本配置方式创建自定义权限策略。具体操作，请参见创建自定义权限策略。

    关于权限策略中包含版本号（Version）和授权语句（Statement），以及授权语句中包含的授权效力（Effect）、操作（Action）、资源（Resource）以及限制条件（Condition，可选项）等更多信息，请参见RAM Policy。

    重要

    在OSS ON云盒中，Resource支持使用通配符星号（*）来指代某类具体的资源。Resource的格式为acs:oss-cloudbox:{region}:{bucket_owner}:cloudbox/{cloudbox_id}/bucket/{bucket_name}/object/{object_name}。

    • 当Resource为acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*，表示名为examplebucket的云盒Bucket下的所有资源，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

    • 当Resource为acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/abc*.txt，表示云盒ID中cb-f8z7yvzgwfkl9q0h****examplebucket下前缀为abc且格式为.txt的所有文件。

  2. 为RAM用户授予自定义权限策略。

    为RAM用户授予步骤1创建好的RAM Policy。具体操作，请参见为RAM用户授权。

示例一：授予RAM用户对某个云盒Bucket的完全控制权限

以下示例为授权RAM用户对名为examplebucket的云盒Bucket拥有完全控制权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

警告

授予用户对云盒Bucket的完全控制权限有极高风险，应尽量避免。

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss-cloudbox:*",
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
            ]
        }
    ]
}

示例二：拒绝RAM用户删除某个云盒Bucket下多个文件的权限

以下示例为拒绝RAM用户删除名为examplebucket的云盒Bucket下前缀为abc且格式为.txt的所有文件，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

{
  "Version": "1",
  "Statement": [
        {
         "Effect": "Deny",
         "Action": [
           "oss-cloudbox:DeleteObject"
         ],
         "Resource": [
           "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/abc*.txt"
         ]
     }
   ]
}

示例三：授予RAM用户列举并读取某个Bucket下所有资源的权限

  • 通过OSS SDK或命令行工具ossutil

    以下示例为授予RAM用户通过OSS SDK或OSS命令行工具列举并读取名为examplebucket的云盒Bucket下所有资源的权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss-cloudbox:ListObjects",
            "Resource": "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
        },
        {
            "Effect": "Allow",
            "Action": "oss-cloudbox:GetObject",
            "Resource": "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
        }
    ]
}

  • 通过OSS控制台

    以下示例为授予RAM用户通过OSS控制台列举并读取名为examplebucket的云盒Bucket下所有资源的权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss-cloudbox:ListBuckets",
                      "oss-cloudbox:GetBucketInfo",
                      "oss-cloudbox:GetBucketLifecycle",
                      "oss-cloudbox:GetBucketVersioning",
                      "oss-cloudbox:GetBucketAcl"
                      ],
            "Resource": "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:ListObjects",
                "oss-cloudbox:GetBucketAcl"
            ],
            "Resource": "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:GetObject",
                "oss-cloudbox:GetObjectAcl"
            ],
            "Resource": "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
        }
    ]
}

示例四：拒绝RAM用户删除某个Bucket的权限

以下示例用于拒绝RAM用户删除名为examplebucket的云盒Bucket，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

{
  "Version": "1",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "oss-cloudbox:*",
          "Resource": [
              "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket",
              "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
          ]
      },
        {
         "Effect": "Deny",
         "Action": [
           "oss-cloudbox:DeleteBucket"
         ],
         "Resource": [
           "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
         ]
     }
   ]
}

示例五：授予RAM用户访问某个云盒Bucket下多个目录的权限

假设用于存放照片的云盒Bucket为examplebucket，该Bucket下有一些目录，代表照片的拍摄地，每个拍摄地目录下还包含了年份子目录。

mybucket[Bucket]
  ├── beijing
  │   ├── 2014
  │   └── 2015
  ├── hangzhou
  │   ├── 2013
  │   ├── 2014
  │   └── 2015 
  └── qingdao
      ├── 2014
      └── 2015

您希望授予RAM用户访问mybucket/hangzhou/2014/和mybucket/hangzhou/2015/目录的只读权限。目录级别的授权属于授权的高级功能，根据使用场景不同，授权策略的复杂程度也不同，以下几种场景可供参考。

  • 授予RAM用户仅拥有读取目录examplebucket/hangzhou/2014/和examplebucket/hangzhou/2015/中文件内容的权限

    由于RAM用户知道文件的完整路径，建议直接使用完整的文件路径来读取目录下的文件内容。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:GetObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2014/*",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2015/*"
            ]
        }
    ]
}

  • 授予RAM用户使用OSS命令行工具访问目录examplebucket/hangzhou/2014/和examplebucket/hangzhou/2015/并列举目录中文件的权限

    RAM用户不清楚目录中有哪些文件，可以使用OSS命令行工具或API直接获取目录信息，此场景下需要添加ListObjects权限。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:GetObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2014/*",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2015/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:ListObjects"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
            ],
            "Condition":{
                "StringLike":{
                    "oss-cloudbox:Prefix": [
                        "hangzhou/2014/*",
                        "hangzhou/2015/*"
                     ]
                }
            }
        }
    ]
}

  • 授予RAM用户使用OSS控制台访问目录的权限

    使用OSS控制台访问目录mybucket/hangzhou/2014/和mybucket/hangzhou/2015/时，RAM用户可以从根目录开始，逐层进入要访问的目录。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss-cloudbox:ListBuckets",
                      "oss-cloudbox:GetBucketInfo",
                      "oss-cloudbox:GetBucketLifecycle",
                      "oss-cloudbox:GetBucketVersioning",
                      "oss-cloudbox:GetBucketAcl"
                      ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:GetObject",
                "oss-cloudbox:GetObjectAcl"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2014/*",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/hangzhou/2015/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:ListObjects"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
            ],
            "Condition": {
                "StringLike": {
                    "oss-cloudbox:Delimiter": "/",
                    "oss-cloudbox:Prefix": [
                        "",
                        "hangzhou/",
                        "hangzhou/2014/*",
                        "hangzhou/2015/*"
                    ]
                }
            }
        }
    ]
}

示例六：拒绝RAM用户删除某个Bucket下任意文件的权限

以下示例用于拒绝RAM用户删除名为examplebucket的云盒Bucket下任意文件的权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

{
  "Version": "1",
  "Statement": [
        {
         "Effect": "Deny",
         "Action": [
           "oss-cloudbox:DeleteObject"
         ],
         "Resource": [
           "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
         ]
     }
   ]
}

示例七：拒绝RAM用户访问指定标签Object的权限

以下为添加Deny策略，用于拒绝RAM用户访问存名为examplebucket的云盒Bucket下对象标签为status:ok以及key1:value1的Object的权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "oss-cloudbox:GetObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:174649585760****:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
            ],
            "Condition": {
                "StringEquals": {
                    "oss-cloudbox:ExistingObjectTag/status":"ok",
                    "oss-cloudbox:ExistingObjectTag/key1":"value1"
                }
            }
        }
    ]
}

示例八：授予RAM用户通过特定的IP地址访问OSS的权限

  • 在Allow授权中增加IP地址限制

    以下示例为在Allow授权中增加IP地址限制，授予RAM用户仅允许通过192.168.0.0/16、198.51.100.0/24两个IP地址段读取名为examplebucket云盒Bucket下所有资源的权限，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss-cloudbox:ListBuckets",
                      "oss-cloudbox:GetBucketInfo",                      
                      "oss-cloudbox:GetBucketAcl"
                      ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:ListObjects",
                "oss-cloudbox:GetObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
            ],
            "Condition":{
                "IpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16", "198.51.100.0/24"]
                }
            }
        }
    ]
}

  • 在Deny授权中增加IP地址限制

    以下示例为在Deny授权中增加IP地址限制，拒绝源IP地址不在192.168.0.0/16范围内的RAM用户对名为examplebucket云盒Bucket执行任何操作，该Bucket所属的云盒ID为cb-f8z7yvzgwfkl9q0h****。

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss-cloudbox:ListBuckets",
                      "oss-cloudbox:GetBucketInfo",                      
                      "oss-cloudbox:GetBucketAcl"
                      ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss-cloudbox:ListObjects",
                "oss-cloudbox:GetObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket",
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/*"
            ]
        },
        {
            "Effect": "Deny",
            "Action": "oss-cloudbox:*",
            "Resource": [
                "acs:oss-cloudbox:*:*:cloudbox/cb-f8z7yvzgwfkl9q0h****/*"
            ],
            "Condition":{
                "NotIpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16"]
                }
            }
        }
    ]
}

示例九：通过RAM或STS服务向其他用户授权

通过RAM或STS服务授权IP地址为192.168.0.1的用户使用Java SDK客户端执行以下操作。

  • 列举examplebucket中以foo为前缀的对象。

  • 允许向examplebucket中上传、下载和删除以file开头的对象。

符合上述场景的RAM Policy配置示例如下：

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "oss-cloudbox:GetBucketAcl",
                "oss-cloudbox:ListObjects"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:177530505652XXXX:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket"
            ],
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:UserAgent": "java-sdk",
                    "oss-cloudbox:Prefix": "foo"
                },
                "IpAddress": {
                    "acs:SourceIp": "192.168.0.1"
                }
            }
        },
        {
            "Action": [
                "oss-cloudbox:PutObject",
                "oss-cloudbox:GetObject",
                "oss-cloudbox:DeleteObject"
            ],
            "Resource": [
                "acs:oss-cloudbox:*:177530505652XXXX:cloudbox/cb-f8z7yvzgwfkl9q0h****/bucket/examplebucket/object/file*"
            ],
            "Effect": "Allow",
            "Condition": {
               "StringEquals": {
                    "acs:UserAgent": "java-sdk"
                },
                "IpAddress": {
                    "acs:SourceIp": "192.168.0.1"
                }
            }
        }
    ]
}

上一篇：云盒Bucket Policy下一篇：防盗链
文档推荐