Granting an IAM User Permissions to Operate a Specific Bucket

In this example, the authorized IAM user can access the authorized bucket and upload objects to the bucket using OBS Browser+, APIs, or SDKs, but cannot access the bucket on OBS Console. To allow the access through OBS Console, you need to create a custom policy to add the IAM user to the user group that has the obs:bucket:ListAllMyBuckets permission for all OBS resources. In this way, the IAM user can view the authorized bucket on OBS Console.

1. In the bucket list of OBS Console, click the required bucket to go to the Objects page.
2. In the navigation pane, choose Permissions > Bucket Policies.
3. Click Create.
4. Configure parameters listed in the table below to grant an IAM user the permissions to access the bucket (to list objects in the bucket) and to upload objects.

   Table 1 Parameters for granting the object listing and upload permissions

   Parameter		Description
   Configuration method		Choose Visual Editor.
   Policy Name		Enter a custom policy name.
   Policy content	Effect	Select Allow.
   	Principal	Select Current account. Specify an IAM user under the current account.
   	Resources	Method 1: Select Entire bucket (including the objects in it). Method 2: Select Current bucket and Specified objects. Set the resource path to * (indicating all objects in the bucket).
   	Actions	Choose Customize. Select the following actions: ListBucket (to list objects in the bucket and obtain the bucket metadata) PutObject (to upload objects) NOTE: In this example, only the upload action among object actions is selected. You can also select other object actions to grant corresponding permissions if needed. The asterisk (*) indicates all actions. To learn the supported actions and their meanings, see Actions.

5. Click Create in the lower right corner.