--- title: "Object Storage - Identity and access management" description: "- A Public Cloud project in your OVHcloud account" url: https://docs.us.ovhcloud.com/en/storage-and-backup/object-storage/identity-and-access-management lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # Object Storage - Identity and access management ## Requirements - A [Public Cloud project](https://us.ovhcloud.com/public-cloud/) in your OVHcloud account #### OVHcloud Control Panel Access - **Direct link:** [Public Cloud Projects](https://manager.us.ovhcloud.com/#/public-cloud/pci/projects) - **Navigation path:** `Public Cloud` > Select your project   ## Instructions ### Creating a user Click on `Object Storage` in the left-hand menu. Choose the `Users` tab and click `+ Create User`. In the pop-up window, enter a description for your user and click `Create`. Once your user has been created, you will see the credentials: **Note:** By clicking on the _more options_ `...` button at the end of a user’s line, you can, among other things, download the Rclone configuration file, see the user’s secret key, and delete the user.   ### Manage access to a container via a profile You can define access to your containers via pre-defined profiles. From the `My containers` tab, click on the _more options_ `...` button at the end of your container line, and then select `Add user` from the drop-down menu. Select the user, choose a role, and click `Add`.   ### Advanced resource access management #### Overview By default, all resources (buckets, objects) and sub-resources (lifecycle configuration, website configuration, etc.) are private in Object Storage. Only the resource owner, i.e., the user account that creates it, has full control. Access to private resources can be granted via access policies. Access policies can be categorized broadly into two types: - user-based: access policies attached to a specific user are called user policies. A user policy is evaluated using Object Storage IAM permissions and applies only to the specific user it is attached to. - resource-based: bucket policies and ACLs are policies that are attached directly to specific resources **Note:** Bucket policies are a feature that is not yet available for Object Storage. This article is about user policies. You can refine your permissions by importing a JSON configuration file. To do this, go to the `Users` tab. Click on the _more options_ `...` at the end of your user’s line, then `Import a user access policy (JSON)`. **Note:** If you want to change a user’s rights, you may need to download the JSON configuration file in advance by selecting `Download the user access policy (JSON)`.   #### Understanding the user policy evaluation process At the moment, user permissions are evaluated as follows: 1. if exists, evaluate user policy else fallback to ACLs 1. check for an explicit deny: if there is an explicit deny, then deny permission, else, check for an explicit allow 2. check for an explicit allow: if there is an explicit allow, then allow permission 3. if there is no explicit deny nor explicit allow, then fallback to ACLs 2. fallback to ACLs **Note:** This evaluation process will be subject to change with the upcoming implementation of bucket policies. Some examples of JSON configuration files: **Read/write access to a bucket and its objects** ```json { "Statement":[{ "Sid": "RWContainer", "Effect": "Allow", "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"], "Resource":["arn:aws:s3:::", "arn:aws:s3:::/*"] }] } ``` **Read-only access to a bucket and its objects** ```json { "Statement":[{ "Sid": "ROContainer", "Effect": "Allow", "Action":["s3:GetObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads"], "Resource":["arn:aws:s3:::", "arn:aws:s3:::/*"] }] } ``` **Deny listing of all buckets owned by the parent account** **Note:** The (`s3:ListAllMyBuckets`) action is allowed by default for a given user. Add the `Deny` effect if you want to explicitly refuse the use of the `ListBuckets` API operation. ```json { "Statement":[{ "Sid": "DenyListBucket", "Effect": "Deny", "Action":["s3:ListAllMyBuckets"], "Resource":["*"] }] } ``` **Allow all operations on all project resources** ```json { "Statement":[{ "Sid": "FullAccess", "Effect": "Allow", "Action":["s3:*"], "Resource":["*"] }] } ``` **Read/write access to all objects in a specific folder (**`/home/user2`**) in a specific bucket (**``**)** ```json { "Statement":[{ "Sid": "RWContainer", "Effect": "Allow", "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"], "Resource":["arn:aws:s3:::", "arn:aws:s3:::/home/user2/*"] }] } ``` **Allow all operations to specific IPs by whitelisting authorized IPs** ```json { "Statement": [{ "Sid": "ExampleStatement01", "Effect": "Allow", "Action": "s3:*", "Resource": [ "arn:aws:s3:::companybucket", "arn:aws:s3:::companybucket/*" ], "Condition": { "IpAddress": { "aws:SourceIp": "10.0.0.5/16" } } }] } ``` **Note:** As a consequence of the current authorization process, **implicit** deny is **not** supported by OVHcloud Object Storage if the user is the bucket owner i.e., since ACLs are evaluated by default and since the bucket owner has FULL\_CONTROL ACL, if the user is the bucket owner and even if there is no explicit allow in the policy file, the user will be authorized. The following policy to attempt to allow read access to objects only to specific IPs will **not** work under current conditions if attached to the **bucket owner** i.e., even if the bucket owner makes his requests from IPs that are **not** in the specified range, the bucket owner will be **authorized**. ```json { "Statement": [{ "Sid": "ExampleStatement01", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": [ "arn:aws:s3:::/*" ], "Condition": { "IpAddress": { "aws:SourceIp": "10.0.0.5/16" } } }] } ``` The following policy to attempt to deny read access to objects to specific IPs by blacklisting unauthorized IPs will **not** work under current conditions if attached to the **bucket owner** because there is no explicit deny and requests from the specified IPs will not match the allow, therefore, we fall back to the ACLs. ```json { "Statement": [{ "Sid": "ExampleStatement01", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket", "s3:ListBucketVersions" ], "Resource": [ "arn:aws:s3:::/*" ], "Condition": { "NotIpAddress": { "aws:SourceIp": "10.0.0.5/16" } } }] } ```   ### List of supported actions | Action | Scope | | ------------------------------------- | ------ | | s3:AbortMultipartUpload | Object | | s3:BypassGovernanceRetention | Object | | s3:CreateBucket | Bucket | | s3:DeleteBucket | Bucket | | s3:DeleteObject | Object | | s3:DeleteBucketTagging | Bucket | | s3:DeleteBucketWebsite | Bucket | | s3:DeleteObject | Object | | s3:DeleteObjectTagging | Object | | s3:GetBucketAcl | Bucket | | s3:GetBucketCORS | Bucket | | s3:GetBucketLocation | Bucket | | s3:GetBucketLogging" | Bucket | | s3:GetBucketObjectLockConfiguration | Bucket | | s3:GetBucketTagging | Bucket | | s3:GetBucketVersioning | Bucket | | s3:GetBucketWebsite | Bucket | | s3:GetEncryptionConfiguration | Bucket | | s3:GetIntelligentTieringConfiguration | Bucket | | s3:GetLifecycleConfiguration | Bucket | | s3:GetObject | Object | | s3:GetObjectAcl | Object | | s3:GetObjectAttributes | Object | | s3:GetObjectLegalHold | Object | | s3:GetObjectRetention | Object | | s3:GetObjectTagging | Object | | s3:GetReplicationConfiguration | Bucket | | s3:ListAllMyBuckets | Bucket | | s3:ListBucket | Bucket | | s3:ListBucketMultipartUploads | Bucket | | s3:ListMultipartUploadParts | Object | | s3:ListBucketMultipartUploads | Bucket | | s3:ListBucketVersions | Bucket | | s3:ListMultipartUploadParts | Object | | s3:PutBucketAcl | Bucket | | s3:PutBucketCORS | Bucket | | s3:PutBucketLogging | Bucket | | s3:PutBucketObjectLockConfiguration | Bucket | | s3:PutBucketTagging | Bucket | | s3:PutBucketVersioning | Bucket | | s3:PutBucketWebsite | Bucket | | s3:PutEncryptionConfiguration | Bucket | | s3:PutIntelligentTieringConfiguration | Bucket | | s3:PutLifecycleConfiguration | Bucket | | s3:PutObject | Object | | s3:PutObjectAcl | Object | | s3:PutObjectLegalHold | Object | | s3:PutObjectRetention | Object | | s3:PutObjectTagging | Object | | s3:PutReplicationConfiguration | Object |   ## Go further Browse all the [Object Storage (S3™-compatible) guides](https://docs.us.ovhcloud.com/en/storage-and-backup/object-storage/landing-page-object-storage.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Object Storage](https://us.ovhcloud.com/public-cloud/object-storage/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project. \*S3 is a trademark filed by Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.