Access management methods in Object Storage: Overview

Object Storage incorporates various access management methods:

• Yandex Identity and Access Management (IAM)
• Access control list (ACL)
• Bucket policy
• Public access
• Security Token Service
• Pre-signed URLs

Also, enabled encryption may affect access to buckets and objects in Object Storage. For more information about working with encrypted buckets, see Encryption in Object Storage.

The flow chart below shows how these methods work together in Object Storage.

The checks follow this algorithm:

1. IAM and bucket ACL:
   • If the request passes the IAM or bucket ACL check, it is checked whether the bucket policy is configured.
   • If the request fails the IAM and bucket ACL checks, it is checked whether public access to the bucket is enabled.
2. Public access:
   • If public access to perform the action is enabled, it is checked whether the bucket policy is configured.
   • If public access to perform the action is disabled, an access check based on the object ACL is performed.
3. Bucket policy:
   • If the bucket policy is configured:
     1. If the request meets at least one of the Deny rules in the bucket policy, an access check based on the object ACL is performed.
     2. If the request meets at least one of the Allow rules in the bucket policy, it is checked whether there is access via Security Token Service.
     3. If the request does not meet any of the bucket policy rules, an access check based on the object ACL is performed.
   • If the bucket policy is not configured, it is checked whether there is access via Security Token Service.
4. Security Token Service:
   • If the request is made using Security Token Service:
     1. If the request meets at least one of the Deny rules in the policy for the temporary key, an access check based on the object ACL is performed.
     2. If the request meets at least one of the Allow rules in the policy for the temporary key, access will be allowed.
     3. If the request does not meet any of the policy rules for the temporary key, an access check based on the object ACL is performed.
   • If the request is made directly, access will be allowed.
5. Object ACL:
   • If the request passes the object ACL check, access will be allowed.
   • If the request fails the object ACL check, access will be denied.

Identity and Access ManagementIdentity and Access Management

Identity and Access Management: Basic method for managing access in Yandex Cloud using role assignment. Enables the basic access control policy. For more details, see Which roles exist in the service.

Access grantees include:

• Yandex account
• Service account
• Federated user
• System group
• Public group

Access is granted to a cloud, folder, or bucket.

Access control list (ACL)Access control list (ACL)

An access control list (ACL) is a list of action permissions stored directly in Object Storage. Enables the basic access control policy. ACL permissions for buckets and objects are different; see Permission types for details.

Access grantees include:

• Yandex account
• Service account
• Federated user
• System group
• Public group

Access is granted to a bucket or object.

Bucket policyBucket policy

A bucket policy is a list of rules that prohibit or allow actions when certain conditions are met. Allows you to granularly differentiate access to buckets, objects and groups of objects.

Access grantees include:

• Yandex account
• Service account
• Federated user
• Anonymous user

Access is granted to a bucket, object, or a group of objects.

Public accessPublic access

Public access defines access permissions for anonymous users to read objects, list of objects and bucket settings.

Access is granted to a bucket.

Security Token ServiceSecurity Token Service

Security Token Service: Identity and Access Management component to get temporary access keys compatible with AWS S3 API.

With temporary keys, you can set up granular access to buckets for multiple users with a single service account.

Pre-signed URLsPre-signed URLs

Pre-signed URLs are a way of giving anonymous users temporary access to certain actions in Object Storage using URLs that contain request authorization data in their parameters.

Access is granted to a bucket or object.

See alsoSee also

• Configuring access permissions for a bucket using Identity and Access Management
• Editing a bucket ACL
• Editing an object ACL
• Managing a bucket policy
• Configuring public access to a bucket
• Accessing a bucket using Security Token Service