产品动态
产品公告
cos:PutObject操作。其中，qcs:ip，表示生效条件的类型是 IP。ip_equal，表示生效条件的判断方法是判断 IP 地址是否相等。["10.217.182.3/24","111.21.33.72/24"]，表示生效条件判断的规定值。若用户处于数组中任意一个 IP 所在的网段，条件判断都为 true。{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"allow","action":["name/cos:PutObject"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"ip_equal":{"qcs:ip":["10.217.182.3/24","111.21.33.72/24"]}}}]}
条件键 | 适用请求 | 含义 | 类型 |
所有请求 | 检查请求是否使用了 HTTPS 协议 | Boolean | |
所有请求 | 请求来源的 IP 网段 | IP | |
所有 https 请求 | https 请求使用的 TLS 版本 | Numeric | |
所有请求 | 请求的 Host 头部 | String |
cos:content-type适用于需要使用请求头部Content-Type的上传类请求（PutObject 等），条件键cos:response-content-type只适用于 GetObject 请求，因为只有该请求支持请求参数response-content-type。条件键 | 适用请求 | 检测请求头部/请求参数 | 类型 |
PutObject PostObject InitiateMultipartUpload | 请求头部：x-cos-storage-class | String | |
GetObject DeleteObject PostObjectRestore PutObjectTagging GetObjectTagging DeleteObjectTagging HeadObject | 请求参数：versionid | String | |
GetBucket GetBucketObjectVersions ListMultipartUploads ListLiveChannels | 请求参数：prefix | String | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-acl | String | |
该请求头适用范围广，关注代表性请求，例如带请求体的请求 | 请求头部：Content-Length | Numeric | |
该请求头适用范围广，关注代表性请求，例如带请求体的请求 | 请求头部：Content-Type | String | |
GetObject | 请求参数：response-content-type | String | |
PutBucket PutBucketTagging | 请求头部：x-cos-tagging 请求参数：tagging | String | |
PutObject PutObject-Copy InitiateMultipartUpload CompleteMultipartUpload | 请求头部：x-cos-forbid-overwrite | String | |
PutObject PutObject-Copy InitiateMultipartUpload PutObjectRetention | 请求头部：x-cos-object-lock-mode 请求体字段：PutObjectRetention 请求体的 Retention.Mode | String | |
PutObject PutObject-Copy InitiateMultipartUpload PutObjectRetention | 请求头部：x-cos-object-lock-remaining-retention-days 请求体字段：PutObjectRetention 请求体的 Retention.RetainUntilDate | Timestamp | |
PutObject PutObject-Copy InitiateMultipartUpload PutObjectRetention | 请求头部：x-cos-object-lock-remaining-retention-days 请求体字段：PutObjectRetention 请求体的 Retention.RetainUntilDate | Timestamp | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-grant-read | String | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-grant-read-acp | String | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-grant-write | String | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-grant-write-acp | String | |
PutObject PutObject-Copy PostObject PutObjectACL PutBucket PutBucketACL InitiateMultipartUpload | 请求头部：x-cos-grant-full-control | String |
条件操作符 | 含义 | 类型 |
string_equal | 字符串等于（区分大小写） | String |
string_not_equal | 字符串不等于（区分大小写） | String |
string_like | 字符串相似（区分大小写），当前支持在字符串前后添加通配符 *，例如image/* | String |
ip_equal | IP 等于 | IP |
ip_not_equal | IP 不等于 | IP |
numeric_equal | 数值等于 | Numeric |
numeric_not_equal | 数值不等于 | Numeric |
numeric_greater_than | 数值大于 | Numeric |
numeric_greater_than_equal | 数值大于等于 | Numeric |
numeric_less_than | 数值小于 | Numeric |
numeric_less_than_equal | 数值小于等于 | Numeric |
_if_exist成为一个条件操作符。例如string_equal_if_exist。条件操作符是否包含_if_exist的区别在于请求不带条件键对应的请求头或请求参数时如何处理。_if_exist，例如string_equal，当请求不带对应的请求头/请求参数时，默认不命中条件，即为False。_if_exist，例如string_equal_if_exist，当请求不带对应的请求头/请求参数时，默认命中条件，即为True。{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"allow","action":["name/cos:GetObject"],"condition":{"string_equal":{"cos:versionid":"MTg0NDUxNTc1NjIzMTQ1MDAwODg"}},"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"]}]}
string_equal或string_equal_if_exist，condition 命中情况和请求是否通过如下表所示。条件操作符 | 请求 | 是否命中 condition | 请求是否通过 |
string_equal | 不带 versionid | FALSE | 不通过 |
string_equal_if_exist | 不带 versionid | TRUE | 通过 |
string_equal | 带 versionid，是指定的 | TRUE | 通过 |
string_equal_if_exist | 带 versionid，是指定的 | TRUE | 通过 |
string_equal | 带 versionid，不是指定的 | FALSE | 不通过 |
string_equal_if_exist | 带 versionid，不是指定的 | FALSE | 不通过 |
{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"deny","action":["name/cos:GetObject"],"condition":{"string_equal":{"cos:versionid":"MTg0NDUxNTc1NjIzMTQ1MDAwODg"}},"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"]}]}
string_equal或string_equal_if_exist，condition 命中情况和请求是否被拒绝如下表所示。条件操作符 | 请求 | 是否命中 condition | 请求拒绝/不拒绝 |
string_equal | 不带 versionid | FALSE | 不拒绝 |
string_equal_if_exist | 不带 versionid | TRUE | 拒绝 |
string_equal | 带 versionid，是指定的 | TRUE | 拒绝 |
string_equal_if_exist | 带 versionid，是指定的 | TRUE | 拒绝 |
string_equal | 带 versionid，不是指定的 | FALSE | 不拒绝 |
string_equal_if_exist | 带 versionid，不是指定的 | FALSE | 不拒绝 |
cos:response-content-type条件键时，条件值"image/jpeg" 必须经过 urlencode 转换为 "image%2Fjpeg"，再填入存储桶策略中。{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"allow","action":["*"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_equal":{"cos:response-content-type":"image%2Fjpeg"}}},{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"deny","action":["*"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_not_equal_if_exist":{"cos:response-content-type":"image%2Fjpeg"}}}]}
{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"allow","action":["*"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_equal_if_exist":{"cos:response-content-type":"image%2Fjpeg"}}},{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"deny","action":["*"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_not_equal":{"cos:response-content-type":"image%2Fjpeg"}}}]}
{"version":"2.0","statement":[{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"allow","action":["name/cos:GetObject"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_equal":{"cos:response-content-type":"image%2Fjpeg"}}},{"principal":{"qcs":["qcs::cam::uin/1250000000:uin/1250000001"]},"effect":"deny","action":["name/cos:GetObject"],"resource":["qcs::cos:ap-guangzhou:uid/1250000000:examplebucket-1250000000/*"],"condition":{"string_not_equal_if_exist":{"cos:response-content-type":"image%2Fjpeg"}}}]}
文档反馈