Authorizing a Sub-account Under Another Root Account to Operate Buckets Under the Local Root Account

Overview

Two buckets examplebucket1-1250000000 and examplebucket2-1250000000 exist under root account A (whose app ID is 1250000000). Due to business requirements, sub-account B0 under root account B wants to operate the two buckets under root account A. The following describes how to authorize the permission.

Directions

Authorizing Root Account B to Operate Buckets Under Root Account A

1. Use the root account A to log in to the COS console.
2. Click Bucket List, locate the bucket to be authorized, and click the bucket name to enter the bucket details page.
3. Click the Permission Management tab to switch to the Permission Management page.
4. Locate Policy Permission Settings, click Add Policy, and enter the following form items:
   • Effect: Allowed.
   • User: Click Add User. Select Root Account for User Type and enter the UIN of root account B, such as 100000000002 for Account ID.
   • Resource: Select resources as required. By default, the entire bucket is selected.
   • Resource Path: It needs to be specified only when Resource is specified. Specify it as required.
   • Action: Click Add Action. Select all operations. If only some operations need to be authorized, you can select one or more required operations.
   • Condition: Enter it as required. If it is not required, leave it blank.
5. Click OK. In this case, root account B is granted relevant permissions to operate the bucket.
6. To authorize relevant permissions to operate other buckets, repeat the preceding steps.

Authorizing Sub-Account B0 to Operate Buckets Under Account A

1. Use root account B to log in to the CAM console and go to the Policy Management page.

2. Select Create Custom Policy > Create by Policy Syntax, select a blank template, and click next step: Modify Policy.

3. Enter the following form:

   • Policy Name: Define a unique and meaningful policy name, such as cos-child-account.

   • Remarks: Enter it at random, which is optional.

   • Modify Policy Content:

     {
         "version": "2.0",
         "statement": [
             {
                 "action": "cos:*",
                 "effect": "allow",
                 "resource": "qcs::cos::uid/1250000000:examplebucket1-1250000000/*"
             }
         ]
     }
     

     1250000000 in uid/1250000000 indicates the UID of root account A, and examplebucket1-1250000000 is the name of the authorized bucket. The bucket resource examplebucket1-1250000000/* can also be *, indicating that all buckets under account A that root account B has permission to operate are authorized to sub-account B0.

4. Click Finish, and then the policy is created.

5. Find the created policy in the policy list and click Associate User/Group/Role on the right.
   

6. In the pop-up window, select sub-account B0 and click OK.
   After authorization, you can use the key of sub-account B0 to operate buckets under account A.