All Documents
Current Document
Content is empty
If you don't find the content you expect, please try another search term
Found 0 result in total
Content is empty
If you don't find the content you expect, please try another search term
Last updated：2021-04-28 11:04:11
By default, all KS3 resources, including buckets, objects, and related sub-resources such as lifecycle and ACL configurations, are private. They are accessible only to the resource owner, that is, the Kingsoft Cloud account that created the resources. The creator of a bucket can access all resources in the bucket.
The resource owner can configure an access policy to grant access permissions to other users.
Buckets and objects are the main resources of KS3, and they have associated resources. Buckets have the following sub-resources:
Objects have the following sub-resources:
An account, or Kingsoft Cloud account, is the owner of Kingsoft Cloud resources. Resource usage is measured and billed on the account level. You must register an account before you can use the services provided by Kingsoft Cloud. In general, the username of an account is the identifier used for logging in to Kingsoft Cloud.
An account is the owner of the cloud computing resources under its name. It has full control over these resources. It is also the owner of the orders and bills for these resources. An account can access and manage any cloud computing resources that it owns.
An IAM user is an authorization entity under an account. It is also a type of resource that belongs to the account. An IAM user does not own any cloud computing resources. Resource usage is not measured or billed on the IAM user level. An IAM user can manage the resources of an account after authorization from the account. The resources that an IAM user manages belong to an account and are paid for by the account. An IAM user does not have independent bills.
After an IAM user is authorized by an account, the IAM user can obtain a password or an AccessKey, with which the IAM user can log in to the Kingsoft Cloud console and call APIs to manage the resources of the account.
A role is a type of virtual user or shadow user. It is an IAM user type. This type of virtual user has a defined identity, can be assigned a set of permissions through a policy, but does not have a password or an AccessKey. The difference between a role and an IAM user mainly lies in the way it is used. A role needs to be assigned to an entity user. The entity user then obtains a temporary security token for the role, with which the entity user can access authorized resources as the role.
All KS3 resources are private by default. They are accessible only to the resource owner, that is, the Kingsoft Cloud account that created the resources.
KS3 provides a series of operations to manage KS3 resources.
Access policies are classified into resource-based policies and user policies. A resource-based policy is an access policy attached to a resource (a bucket or an object), such as a bucket policy or an ACL. A user policy is an access policy attached to a user under an account.
<AccessControlPolicy>
<Owner>
<ID>Owner-User-Id</ID>
<DisplayName>Owner-User-Name</DisplayName>
</Owner>
<AccessControlList>
<Grant>
<Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser">
<ID>User2-Id</ID>
<DisplayName>User2-Name</DisplayName>
</Grantee>
<Permission>READ</Permission>
</Grant>
...
</AccessControlList>
</AccessControlPolicy>{
"Version":"2008-10-17",
"Statement":[{
"Sid":"1",
"Effect":"Allow",
"Principal":{"KSC":["krn:ksc:iam:::11123:root"]},
"Action":["ks3:*"],
"Resource":["krn:ksc:ks3:::mybucket","krn:ksc:ks3:::mybucket/*"]
}]
}You can manage the access to KS3 resources by using IAM. By using IAM, you can create IAM users, user groups, and roles under an account, and add user policies to allow them to access KS3 resources.
{
"Version":"2015-11-01",
"Statement":[{
"Effect":"Allow",
"Action":["ks3:*"],
"Resource":["krn:ksc:ks3:::mybucket","krn:ksc:ks3:::mybucket/*"]
}]
}Pure Mode