Skip to content

Volcengine Role Authorization¶

Go to Users > Access Control > Role Management, click Create Role: Select Other Account, enter the Guance account ID.

Enter the role name and skip the policy management, successfully create a new role.
Select the new role and click the role name.

Switch to Trust Relationships and modify the trust policy.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<External ID>"
        }
      },
      "Principal": {
        "IAM": [
          "trn:iam::<Guance Account ID>:user/<Guance Username>"
        ]
      }
    }
  ]
}

Go to Permission Policies, click "Create Custom Policy".

Enter the policy name, then enter the policy in the JSON editor and submit.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "tos:GetObject",
                "tos:PutObject",
                "tos:ListBucket",
                "tos:ListBucketVersions",
                "tos:HeadBucket",
                "tos:RestoreObject"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

After the policy is submitted successfully, click Add Permission.

Select the previously created new role and submit.