應用場景

用戶A（用戶ID為aaa11111111）有存儲桶examplebucket1-a和examplebucket12-a，A0為A的子用戶。A0、用戶B（用戶ID為bbb11111111）及其子用戶B0根據業務需要，希望能訪問A名下的存儲桶examplebucket1-a和examplebucket12-a。A0、B、B0需要的權限如下：

• 用戶B對A的存儲桶 examplebucket1-a和 examplebucket2-a有列舉和下載文件的權限。
• 子用戶B0對A的存儲桶 examplebucket1-a僅有下載以1為前綴文件的權限。
• 子用戶A0對A的存儲桶examplebucket2-a有列舉、下載、刪除文件的權限。

前提條件

開通對象存儲（經典版）Ⅰ型服務。

具體操作

用戶A登錄控制臺，進入“存儲桶列表”。

• 點擊examplebucket1-a后的“屬性”，點擊 “安全策略”>“編輯策略”>“編輯”，按如下規則編輯。

  {
    "Version":"2012-10-17",
    "Statement":[
      {
        "Sid":"UserBListGetObject",
        "Effect":"Allow",
        "Principal":{  
          "CTYUN": "arn:ctyun:iam::bbb11111111:root"
         },
        "Action":[
          "oos:GetObject",
          "oos:ListBucket"
        ],
        "Resource":[
          "arn:ctyun:oos:::examplebucket1-a/*",
          "arn:ctyun:oos:::examplebucket1-a"
        ]
      },
      {
        "Sid":"UserB0GetObject",
        "Effect":"Allow",
        "Principal":{ 
          "CTYUN": "arn:ctyun:iam::bbb11111111:user/B0"
         },
        "Action":"oos:GetObject",
        "Resource":[
          "arn:ctyun:oos:::examplebucket1-a/1*"
        ]
      }
    ]
  }
  

• 點擊examplebucket2-a后的“屬性”，點擊“安全策略”>“編輯策略”>“編輯”，按如下規則編輯。

  {
    "Version":"2012-10-17",
    "Statement":[
      {
        "Sid":"UserBGetListObject",
        "Effect":"Allow",
        "Principal":{  
          "CTYUN": "arn:ctyun:iam::bbb11111111:root"
         },
        "Action":[
          "oos:GetObject",
          "oos:ListBucket"
        ],
        "Resource":[
          "arn:ctyun:oos:::examplebucket2-a/*",
          "arn:ctyun:oos:::examplebucket2-a"
        ]
      },
      {
        "Sid":"UserA0GetListDeletObject",
        "Effect":"Allow",
        "Principal":{ 
          "CTYUN": "arn:ctyun:iam:: aaa11111111:user/A0"
         },
        "Action":[
          "oos:GetObject",
          "oos:ListBucket",
          "oos:DeleteObject"
        ],
        "Resource":[
          "arn:ctyun:oos:::examplebucket2-a/*",
          "arn:ctyun:oos:::examplebucket2-a"
        ]
      }
    ]
  }