Sub-Account Access to Bucket List

Overview

Sub-account By default, there is no permission to pull the bucket list. Therefore, when you log in to the COS console using a subaccount, you cannot view the overview data, bucket list, and other management items that require authorization.
Sub-account Bucket lists can be accessed in two ways:

• By Add a Favorite Path: This method is for scenes where some sub-accounts have object operation permissions but do not have access to the bucket list. The access path can be a specific bucket or a directory under a bucket. Make sure the added path is authorized.
• By Add Preset Policy: You can add a preset policy QcloudCOSGetServiceAccess (obtain bucket list access permissions) for the sub-account through the root account to access the bucket list. In this method, you can also view the overview statistics on the console.

  Note

  This feature applies to scenes where you log in to the console through a sub-account to access the bucket list.

Adding a Favorite Path

By default, the sub-account is not granted the preset policy (QcloudCOSGetServiceAccess). At this time, the sub-account has no permission to pull the bucket list. However, when the root account authorizes the sub-account user permissions (such as data reading, data writing, etc.) to a bucket, the sub-account can access the corresponding bucket through Add a Favorite Path.

Prerequisites

The sub-account has been authorized user permissions for a bucket by the root account. For details, see Set Access Permission.

Directions

1. Use sub-account to log in to the COS console and go to Favorite Path page, click Add a Favorite Path.
2. In the Add a Favorite Path pop-up, select the region where the bucket is located and input the favorites path. The configuration are described as follows:
   • Region: Select the region that corresponds to the bucket that you are authorized to access.
   • Favorites Path: Enter the name of the bucket that is authorized to access (for example, examplebucket-1250000000), or enter the path of the object in the bucket, for example, examplebucket-1250000000/doc/exampleobject.txt.
3. After confirming that the region and favorites path are correct, click OK. Then, you can add the authorized bucket or the path of the object in the bucket.
4. Click File List on the right; you can see the objects to which the root account authorizes permissions to the sub-account.

Adding Preset Policy

Add Preset Policy QcloudCOSGetServiceAccess (obtain bucket list access permissions) for sub-account to access the bucket list.

Note

• The preset policies QcloudCOSFullAccess or QcloudCOSReadOnlyAccess can also authorize sub-accounts permission to access the bucket list. However, due to the wide range of permissions authorized by these two policies, for security reasons, their use is not recommended.
• The overview statistics depend on the access permissions of the bucket list. When the sub-account needs to pull statistical data, make sure that the root account has added the preset policy QcloudCOSGetServiceAccess for the sub-account. Otherwise, it will prompt that you do not have permission to access the statistical data.

1. Log in to the CAM console with your root account and enter the user list page.
2. Find the sub-account to which you want to add the policy and click Authorization on the right to go to the Association Policy page.
3. In the policy list, search for and add the preset policy QcloudCOSGetServiceAccess (bucket list access permission for COS).
4. Click OK to complete the policy association.
5. Click the sub-account user name to enter the sub-account details page. You can see the added policies here. You can unbind the policy when you no longer need to use it.

   Description

   At this point, you have added a preset policy to the sub-account through the root account. Now, you can log in to the COS console through the sub-account and view the bucket list and overview statistics normally.