Permission Introduction
Updated at：2025-11-03
Permission definition
BOS permission management includes the following three types of permissions, allowing you to tailor permissions to fit your business scenarios.
Bucket standard permission definition:
| Permission name | Permission description |
|---|---|
| Private |
|
| Public-read |
|
| Public-read-write |
|
Definition of coarse-grained custom permissions
If the standard bucket permissions do not meet your usage requirements, you can opt to generate coarse-grained custom permissions as needed. These permissions allow you to configure READ, LIST, WRITE, MODIFY, and FULL_CONTROL access for specific users, as well as specify accessible resources, IP addresses, and referer allow lists.
The coarse-grained custom permissions supported by BOS are described as follows:
| Permission name | Operations supported by permissions |
|---|---|
| READ | Objects and related information in bucket can be read, but there is no list permission. The specific operation permissions include GetBucketLocation, HeadBucket, GetObject, GetObjectMeta, ListParts and RestoreObject. APIs corresponding to READ permissions include both bucket-level APIs such as GetBucketLocation and object-level APIs such as GetObject and ListParts. |
| LIST | List permissions, you can view the object list under the specified bucket and obtain all the unfinished MultipartUpload. The specific operation permissions include ListObjects and ListMultipartUploads. List permissions correspond to bucket-level APIs only. |
| WRITE | Creation, overwriting and deletion of objects in bucket are allowed, and specific operation permissions include PutObject, PostObject, InitiateMultipartUpload, UploadPart, CompleteMultipartUpload, AbortMultipartUpload, AppendObject, DeleteObject, DeleteMultipleObjects and FetchObject. WRITE permissions correspond to object-level APIs only. |
| MODIFY | Users with this permission can perform related write operations, such as PutObject and AppendObject, but cannot add or delete data. The primary purpose of this permission is to use it in combination with Deny to prevent tampering with bucket data. |
| FULL_CONTROL | All above permissions are included. In addition to all operation permissions of READ, LIST and WRITE, FULL_CONTROL also includes the following operation permissions: PutBucketAcl、GetBucketACL、PutBucketCors、GetBucketCors and DeleteBucketCors. FULL_CONTROL permissions correspond to both bucket-level and object-level APIs. |
Note:
- MODIFY only includes the writing operations of PutObject, AppendObject, etc. to the existing file, but does not include the addition and deletion operations of the file. If you need to prohibit IAM users or other users from modifying and deleting the existing BOS file, configure explicit Deny, modify and DeleteObject operations.
Definition of fine-grained custom permissions
If the coarse-grained custom permissions do not meet your advanced authorization needs, you can leverage the fine-grained custom permissions provided by BOS. These fine-grained permissions support control at both bucket and object levels.
Related permissions of bucket
| Related permissions of bucket | Supported operation |
|---|---|
| GetBucket | This permission means that users are allowed to obtain the contents of bucket and its related information, for example, listing objects in bucket, and listing all unfinished Multipart Upload in bucket when uploading in three steps |
| GetBucketAcl | This permission means that users are allowed to obtain the information of Bucket Acl |
| PutBucketAcl | This permission means that users are allowed to add the Bucket Acl |
| GetBucketCors | This permission means that users are allowed to obtain the cross-origin resource sharing (CORS) rules on bucket |
| PutBucketCors | This permission means that users are allowed to set or delete a cross-origin resource sharing (CORS) rule on the specified bucket |
| GetBucketStyle | This permission means that users are allowed to obtain or list Bucket Style rule |
| PutBucketStyle | This permission means that users are allowed to add or delete Bucket Style rule. |
| GetBucketMirroring | This permission means that users are allowed to obtain information related to bucket mirror back-to-origin. |
| PutBucketMirroring | This permission means that users are allowed to add or delete information related to bucket mirror back-to-origin |
| GetCopyRightProtection | This permission means that users are allowed to obtain the original image protection configuration information of bucket |
| PutCopyRightProtection | This permission means that users are allowed to enable or disable the original picture protection function of bucket |
Related permissions of object
| Related permissions of object | Supported operation |
|---|---|
| PutObject | This permission means that users are allowed to perform related operations of object upload, such as PutObject, PostObject, AppendObject, FetchObject, CopyObject, three-step upload and three-step copy |
| GetObject | Only GetObject and GetObjectMeta operations are supported. GetObject permissions correspond to object-level APIs only. |
| DeleteObject | This permission means that users are allowed to delete a single object or bulk delete objects |
| RenameObject | This permission means that users are allowed to rename the object |
| ListParts | This permission means that users are allowed to list all uploaded Parts of the UploadId specified in the three-step upload process, and users can view the current progress of the three-step upload |
| GetObjectMeta | This permission means that the user is allowed to list the meta information of the object |
| GetObjectAcl | This permission means that users are allowed to obtain Object Acl |
| PutObjectAcl | This permission means that users are allowed to add or delete Object Acl |
Description:
- Fine-grained and coarse-grained permissions (READ, LIST, WRITE, FULL_CONTROL, MODIFY) do not interfere with each other;
- Coarse-grained permissions take precedence over fine-grained permissions. If both types of permissions are assigned, the coarse-grained permissions will override the fine-grained permissions and take effect.
- Bucket-level fine-grained permissions refer to the operations related to bucket;
- Object-level fine-grained permissions specify operations directly associated with individual objects.