Object Storage - Identity and access management

Learn how to manage your identities and access your Object Storage resources.

Requirements

• A Public Cloud project in your OVHcloud account
• Access to your OVHcloud Control Panel

Instructions

Creating a user

From the OVHcloud Control Panel:

1. Choose Public Cloud from the top navigation bar.
2. In the left-hand menu, click Object Storage.
3. Choose the Object Storage users tab.
4. Click + Add User.

In the pop-up window, you can create a new user or select an existing user.

Once your user has been created, you will see the credentials:

Manage access to a container via a profile

You can define access to your containers via pre-defined profiles.

From the My containers tab, click on the more options ... button at the end of your container line, and then select Add a user to a container from the drop-down menu.

Select the user to add to your container and click Next.

Select the role of your user on your container and click on Confirm.

Manage access to an object via a profile

You can also set access to your objects via pre-defined profiles.

Click the more options ... button at the end of your object line and then select Add user to my object from the drop-down menu.

Select the user and click Next.

Select the access profile for this user and click Confirm.

Advanced resource access management

You can refine your permissions by importing a JSON configuration file. To do this, go to the Object Storage Users tab.

Click on the more options ... at the end of your user’s line, then Import Policy (JSON).

Some examples of JSON configuration files:

Read/write access to a bucket and its objects

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::hp-bucket", "arn:aws:s3:::hp-bucket/*"]
  }]
}

Read-only access to a bucket and its objects

{
  "Statement":[{
    "Sid": "ROContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads"],
    "Resource":["arn:aws:s3:::hp-bucket", "arn:aws:s3:::hp-bucket/*"]
  }]
}

Allow all operations on all project resources

{
  "Statement":[{
    "Sid": "FullAccess",
    "Effect": "Allow",
    "Action":["s3:*"],
    "Resource":["*"]
  }]
}

Read/write access to all objects in a specific folder (/home/user2) in a specific bucket (companybucket)

{
  "Statement":[{
    "Sid": "RWContainer",
    "Effect": "Allow",
    "Action":["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "s3:ListMultipartUploadParts", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:GetBucketLocation"],
    "Resource":["arn:aws:s3:::companybucket", "arn:aws:s3:::companybucket/home/user2/*"]
  }]
}

List of supported actions

Go further

For more information and tutorials, please see our other Object Storage support guides or explore the guides for other OVHcloud products and services.

If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

*S3 is a trademark filed by Amazon Technologies, Inc. OVHcloud's service is not sponsored by, endorsed by, or otherwise affiliated with Amazon Technologies, Inc.