Permission Policy Example

{
    "version": "1",
    "statement": [
        {
            "action": [
                "wos:GetBucket"
            ],
            "resource": [
                "wsc:wos:*:*:testbucket"
            ],
            "effect": "allow"
        },
        {
            "action": [
                "wos:PutObject",
                "wos:GetObject",
                "wos:DeleteObject"
            ],
            "resource": [
                "wsc:wos:*:*:testbucket/*"
            ],
            "effect": "allow"
        }
    ]
}

This is an authorization policy. The parent account can use such a policy to authorize the sub-account through IAM. There is one statement in the policy (there can be multiple statements in one policy). The corresponding action, resource, and effect are specified in the statement.

The permissions of this policy configuration: list the information of all files in the space testbucket; upload files to the space testbucket; download the files in the space testbucket; delete the files in the space testbucket.

Configuration Rules

Version

version defines the version of the permission policy, and the currently supported version is “1”.

Statement

Authorization semantics are described through statements, which can contain multiple semantics according to business scenarios, each containing a description of action, effect, and resource. Each time a request is made, the system will match and check one by one. All successfully matched statements will be divided into allow and deny according to the effect setting, among which deny takes precedence. If all matches are passed, the request is authenticated. If the match is successful, there is a prohibition, or if no entry is matched successfully, the request is forbidden to access.

Action

Action refers to the operation of the S3 API or console provided by wos. The action rule is wos:{action_name}, which supports * wildcard, and can use * to represent 0 or more arbitrary English letters. For example, wos:List* means all S3 API or console operations provided by wos whose action_name starts with List. .
Action is a list, you can choose one or more of the actions, all action_name must be prefixed with “wos:”. There can be multiple actions.

Actions are divided into three categories: • Service-level operations, corresponding to operations similar to wos:GetService.
• Bucket level operations, corresponding to operations similar to wos:PutBucketLifecycle, wos:GetBucket, etc. The object of the operation is Bucket.
• Object level operation, corresponding to similar to wos:GetObject, wos:PutObject, wos:DeleteObject and wos:AbortMultipartUpload, the operation object is Object.

The corresponding relationship between specific action and S3 API is as follows:

• Service level

Note: If the GetService permission is assigned to the sub-account, the sub-account can obtain all the space owned by its parent account. (For the space created by the sub-account, the owner of the space is its parent account)

• Bucket level

• Object level

The corresponding relationship between specific actions and console operations is as follows:

• Service level

Note:

1. If the GetService permission is assigned to the sub-account, the sub-account can obtain all the space owned by its parent account. (For the space created by the sub-account, the owner of the space is its parent account)
2. All sub-accounts using the console must have GetService permission, otherwise other operations on the console may not be able to be used normally.
3. If the GetBucketAnalysis permission is assigned to the sub-account, the sub-account can view all the menu items under statistical analysis.

• Bucket level

Object level

resource
Resource refers to the resource stored on wos. The rule of resource is wsc:wos:{region}:{bucket_owner}:{bucket_name}/{object_name}, which supports * wildcard. You can use * to represent 0 or more arbitrary English letters. The region field is temporarily not supported and is set to “*”.
resource is also a list, which can contain one or more resources. There can be multiple resources.

For all service-level operations, it is not supported to assign specific resources, ie wsc:wos::😗.
For all bucket-level operations, only specific spaces are supported, ie wsc:wos:{region}:{bucket_owner}:{bucket_name}.
For all Object-level operations. Support assigning to specific files, ie wsc:wos:{region}:{bucket_owner}:{bucket_name}/{object_name}.

effect
Effect represents the result of authorization of the statement in this article, which is divided into allow and deny, which refer to passing and prohibiting respectively. When multiple statements are matched successfully at the same time, deny has a higher priority .
For example, it is expected that users are forbidden to delete a certain directory, but have full permissions for other files:

{
  "version": "1",
  "statement": [
    {
      "effect": "allow",
      "action": [
        "wos:*"
      ],
      "resource": [
        "wsc:wos:*:*:bucketname/*"
      ]
    },
    {
      "effect": "deny",
      "action": [
        "wos:DeleteObject"
      ],
      "resource": [
        "wsc:wos:*:*:bucketname/test/*"
      ]
    }
  ]
}