适用于 XML 请求的 IAM 权限

下表列出了在给定资源上运行每个 Cloud Storage XML 方法所需的 Identity and Access Management (IAM) 权限。

方法	资源	子资源	必需的 IAM 权限1
DELETE	bucket		storage.buckets.delete
DELETE	object		storage.objects.delete
DELETE	object	uploadId	storage.multipartUploads.abort
GET			storage.buckets.list
GET	bucket		storage.objects.list
GET	bucket	acls3	storage.buckets.get storage.buckets.getIamPolicy
GET	bucket	非 ACL 元数据	storage.buckets.get
GET	bucket	uploads	storage.multipartUploads.list
GET	object		storage.objects.get
GET	object	acls3	storage.objects.get storage.objects.getIamPolicy
GET	object	encryption	storage.objects.get
GET	object	retention	storage.objects.get
GET	object	uploadId	storage.multipartUploads.listParts
HEAD	bucket		storage.buckets.get
HEAD	object		storage.objects.get
POST	object		storage.objects.create storage.objects.delete4 storage.objects.setRetention5
POST	object	uploadId	storage.multipartUploads.create storage.objects.create storage.objects.delete4
POST	object	uploads	storage.multipartUploads.create storage.objects.create storage.objects.setRetention5
PUT	bucket		storage.buckets.create storage.buckets.enableObjectRetention6
PUT	bucket	acls3	storage.buckets.get storage.buckets.getIamPolicy storage.buckets.setIamPolicy storage.buckets.update
PUT	bucket	非 ACL 元数据	storage.buckets.update
PUT7	object		storage.objects.create storage.objects.get2 storage.objects.delete4 storage.objects.setRetention5
PUT	object	acls3	storage.objects.get storage.objects.getIamPolicy storage.objects.setIamPolicy storage.objects.update
PUT	object	compose	storage.objects.create storage.objects.get storage.objects.delete4 storage.objects.setRetention5
PUT	object	retention	storage.objects.setRetention storage.objects.update storage.objects.overrideUnlockedRetention8
PUT	object	uploadId	storage.multipartUploads.create storage.objects.create
GET	Projects.hmacKeys		storage.hmacKeys.get
POST	Projects.hmacKeys		storage.hmacKeys.create storage.hmacKeys.update storage.hmacKeys.delete

¹ 如果您在请求中使用 x-goog-user-project 标头或 userProject 查询字符串参数，则除了发出请求所需的正常 IAM 权限之外，您还必须拥有所指定项目 ID 的 serviceusage.services.use 权限。

² 如果请求包含 x-goog-copy-source 标头，则访问源存储分区需要此权限。

³ 此子资源不适用于启用了统一存储分区级访问权限的存储分区。

⁴ 只有在插入的对象与存储分区中现有的对象名称相同时，才需要这项权限。

⁵ 仅当请求包含 x-goog-object-lock-mode 和 x-goog-object-lock-retain-until-date 标头时，才需要此权限。

⁶ 仅当请求包含 x-goog-bucket-object-lock-enabled 标头且该标头设为 true 时，才需要此权限。

⁷ 无需任何权限即可发出与可续传上传关联的 PUT 请求。

⁸ 仅当请求包含 x-goog-bypass-governance-retention 标头且该标头设为 true 时，才需要此权限。

后续步骤

• 如需查看角色及其所含权限的列表，请参阅适用于 Cloud Storage 的 IAM 角色。