通过RAM对OSS进行权限管理

最新推荐文章于 2023-12-14 16:52:52 发布

l386913

最新推荐文章于 2023-12-14 16:52:52 发布

阅读量2.3k

点赞数

分类专栏： linux 基础知识文章标签：阿里云安全云计算

本文链接：https://blog.youkuaiyun.com/jialiu111111/article/details/122132059

版权

linux 基础知识专栏收录该内容

58 篇文章

订阅专栏

本文介绍如何使用RAM对OSS进行权限管理，包括自定义访问权限设置。提供了多个示例，如授权用户管理指定存储空间、限定IP地址访问等。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

通过RAM对OSS进行权限管理 - 访问控制 - 阿里云-官网文档

RAM自定义访问权限设置

权限策略示例

示例1：授权RAM用户管理一个名为myphotos的存储空间。

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ]
        }
    ]
}

示例2：授权RAM用户列出并读取一个存储空间中的资源。

授权RAM用户通过OSS SDK或OSS命令行工具列出并读取一个存储空间中的资源。存储空间名称为myphotos

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "oss:ListObjects",
            "Resource": "acs:oss:*:*:myphotos"
        },
        {
            "Effect": "Allow",
            "Action": "oss:GetObject",
            "Resource": "acs:oss:*:*:myphotos/*"
        }
    ]
}

授权RAM用户能够通过OSS控制台进行操作

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss:ListBuckets",
                      "oss:GetBucketStat",
                      "oss:GetBucketInfo",
                      "oss:GetBucketTagging",
                      "oss:GetBucketAcl" 
                      ],    
            "Resource": "acs:oss:*:*:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetBucketAcl"
            ],
            "Resource": "acs:oss:*:*:myphotos"
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl"
            ],
            "Resource": "acs:oss:*:*:myphotos/*"
        }
    ]
}

示例3：授权RAM用户通过特定的IP地址访问OSS。

在Allow授权中增加IP限制：允许通过192.168.0.0/16, 172.12.0.0/16两个IP地址段读取myphotos中的信息

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss:ListBuckets",
                      "oss:GetBucketStat",
                      "oss:GetBucketInfo",
                      "oss:GetBucketTagging",
                      "oss:GetBucketAcl" 
                      ], 
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ],
            "Condition":{
                "IpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16", "172.12.0.0/16"]
                }
            }
        }
    ]
}

在Deny授权中增加IP限制：如果源IP不在192.168.0.0/16中，则禁止对OSS执行任何操作。

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss:ListBuckets",
                      "oss:GetBucketStat",
                      "oss:GetBucketInfo",
                      "oss:GetBucketTagging",
                      "oss:GetBucketAcl" 
                      ], 
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ]
        },
        {
            "Effect": "Deny",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:*"
            ],
            "Condition":{
                "NotIpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16"]
                }
            }
        }
    ]
}