Overview
COS allows you to filter buckets by tag in the console or via the API, which is implemented based on authorization by tag.
Prerequisites
The bucket has been configured with bucket tags. If no configuration is set, please refer to the Set Bucket Tag guide to configure. A sub-account has been created, such as username SubUser. If no role is created, see Create Sub-User guide to proceed. Authorization steps
1. Log in to the CAM console with the root account Owner and enter the policy configuration page. 2. Grant sub-account SubUser access to buckets with the specified tag through the policy generator or policy syntax as follows:
2. Click Create Custom Policy > Create by Policy Generator.
3. On the permission configuration page, configure the following:
Effect: use the default option Allow.
Service: Select COS.
Action: Select List action > GetService (List buckets).
Resource: Select All resources.
Condition: Click Add other conditions. On the panel, configure the following:
Condition Key: Select qcs:resource_tag.
Operator: Select string_equal.
Condition Value: Enter a tag in the format of key&val. Here, replace key and value with the tag key and value respectively.
4. Click Next and enter the policy name.
5. Click OK to complete the process.
2. Click Create Custom Policy > Create by Policy Syntax.
3. Select Blank Template and click Next.
4. Enter a policy in the following format. Here, replace key and value with the specified tag key and value respectively.
{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action":[
"name/cos:GetService"
],
"resource": "*",
"condition":{
"for_any_value:string_equal": {
"qcs:resource_tag": [
"key&value"
]
}
}
}
]
}
5. Click OK to complete the process.
3. Associate the policy with the sub-account SubUser by locating the policy created in step 2 on the Policies page and clicking Associate User/User Group/Role on the right.
4. In the pop-up window, select the sub-account SubUser and click OK to associate sub-account SubUser with the policy.
Viewing in the console
1. Log in to the COS console with the sub-account SubUser. 2. The Bucket List page automatically displays the list of buckets to which the sub-account has access.
At this point, you have granted the sub-account access to buckets with the specified tag (key and value).
Calling the API
Note:
Unlike the console, the GetService API cannot automatically display the list of buckets to which the sub-account has access and requires you to pass in tag parameters.
The GetService API currently allows you to pass in only one tag.
1. Initiate a request with the key of the sub-account SubUser.
2. Call the GetService API to pass in the tag filtering parameters such as (key,value). Below is a sample request. For more information, see GET Service (List Buckets). GET /?tagkey=key1&tagvalue=value1 HTTP/1.1
Host: service.cos.myqcloud.com
Date: Fri, 24 May 2019 11:59:51 GMT
Authorization: Auth String