Certification and permission management
What's the difference between bucket ACL and STS?
BOS permissions are divided into resource-based permissions and user-based permissions.
- Resource-based permission controls which users can access a resource; [Bucket ACL](BOS/API Reference/Access control.md#Bucket permission control) is a resource-based permission.
- User-based permission manages which resources a user can access. [STS Temporary Authorization](BOS/API Reference/Access control.md#Temporary authorized access) is a user-based permission.
Bucket ACL and STS permission controls rely on ACL files, with similar syntax that supports fields like grantee (omitted in STS as it is user-based), permission, resource, and condition.
For usage scenarios, bucket ACL is more appropriate when the grantee is a Baidu AI Cloud account or all users (including anonymous users). STS is more suitable for temporary authorization scenarios, such as when a mobile device needs to temporarily upload an image.
What is the difference between GetObject permission and read permission?
The GetObject permission only includes two API operations: GetObject and GetObjectMeta; whereas the READ permission includes the API operations under GetObject permission, as well as three additional API operations: GetBucketLocation, HeadBucket, and ListParts. For more details, refer to [Bucket Access Control](BOS/API Reference/Access control.md#Bucket permission control).
When object permission and bucket permission conflict, which one shall prevail?
In object permission settings, the default permissions for objects inherit those of the parent bucket. Users can also configure specific objects as public read or private, depending on their needs. When an object's read permission conflicts with its bucket's permission, the object's permission takes precedence.
How to configure an account in BOS with create and read-write permission but no delete permissions?
This can be achieved by uploading an ACL file to configure fine-grained permissions for the bucket. For details, refer to [Permission Control via Uploading ACL Files](BOS/API Reference/Access control.md#Permission Control via ACL File Upload).
