如何通过Service ID访问IBM COS存储桶？权限配置与SDK使用咨询

Can I access COS directly using a Service ID and its API, or do I need to create Service Credentials for each Service ID? #

You cannot directly use a Service ID alone to access IBM COS. Service IDs are identity entities in IBM IAM, but they don’t provide the actual authentication credentials required by the COS Python SDK.

You must create Service Credentials tied to the Service ID. These credentials generate the necessary authentication details (like an API key or IAM token configuration) that the SDK uses to authenticate requests to COS. Each Service ID can have multiple Service Credentials, which is useful for credential rotation or assigning different credential types to distinct use cases.

How to restrict a Service ID's read/write permissions to a specific bucket? #

To enforce granular access control, follow these practical steps using IBM IAM:

• Create a custom IAM policy: Define the exact permissions the Service ID needs, targeting only your specific bucket. For example, to allow basic read/write access to my-target-bucket, include actions like s3:GetObject, s3:PutObject, and s3:ListBucket, and specify the bucket’s Cloud Resource Name (CRN) as the resource.
• Bind the policy to the Service ID: Associate the custom policy with your target Service ID. This ensures the Service ID only inherits the permissions defined in the policy, preventing access to other buckets or unauthorized actions.
• Optional: Add prefix-level restrictions: If you need even finer control (e.g., only allow access to objects under my-target-bucket/docs/), include the prefix in the resource CRN, like crn:v1:bluemix:public:cloud-object-storage:global:a/<your-account-id>:<bucket-name>/docs/*.
• Stick to the least privilege principle: Avoid broad permissions like s3:* – only include the specific actions the Service ID must perform to do its job.

内容的提问来源于stack exchange，提问作者B.Tong