使用RAM Policy Editor 工具新建ListObject,GetObject权限策略文本

image.png

放行GetObject，ListObject 操作

  1. {
  2.   "Version": "1",
  3.   "Statement": [
  4.     {
  5.       "Effect": "Allow",
  6.       "Action": [
  7.         "oss:ListObjects",
  8.         "oss:GetObject"
  9.       ],
  10.       "Resource": [
  11.         "acs:oss:*:*:fralychen"
  12.       ],
  13.       "Condition": {}
  14.     }
  15.   ]
  16. }

放行 fralychen/Delete/*下的 DeleteObject操作

  1. {
  2.     "Version": "1",
  3.     "Statement": [
  4.         {
  5.             "Effect": "Allow",
  6.             "Action": [
  7.                 "oss:Get*",
  8.                 "oss:list*",
  9.                 "oss:Put*"
  10.             ],
  11.             "Resource": [
  12.                 "acs:oss:*:*:*"
  13.             ],
  14.             "Condition": {}
  15.         },
  16.         {
  17.             "Effect": "Allow",
  18.             "Action": [
  19.                 "oss:DeleteObject"
  20.             ],
  21.             "Resource": [
  22.                 "acs:oss:*:*:fralychen/Delete/*"
  23.             ],
  24.             "Condition": {}
  25.         }
  26.     ]
  27. }

通过CreatPolicy接口新建名为 OSS-Object Policy

image.png

通过CreatRole接口新建角色OSS-Object

新建允许扮演可信实体为云账号(AccountID=11498773245**:role)下被授权的RAM用户（oss-object）

image.png

{ “Statement”: [ { “Action”: “sts:AssumeRole”, “Effect”: “Allow”, “Principal”: { “RAM”: [ “ acs:ram::11498773245**:role/oss-object” ] } } ], “Version”: “1” }

通过AttachPolicyToRole为OSS-Object授权OSS-Object

image.png