一、存储桶访问权限 vs 匿名用户访问权限
存储桶的 Access Policy 有三种：
Private私有，不设置任何策略，如果设置 Anonymouse Access Role 将变成Custom。
Public公开，任何人都拥有对该存储桶上传、下载、删除文件的能力。
Custom自定义策略。
存储桶的 Anonymouse Access Role 有四种：
none、readony、writeonly、readwrite
除none外， Role 必须作用于 Prefix
readonly，anonymous download access is allowed includes being able to list objects on the desired prefix
匿名用户允许下载，允许对指定前缀路径下的对象列表。
writeonly，anonymous uploads are allowed includes being able to list incomplete uploads on the desired prefix
匿名用户允许上传，以及对指定前缀路径下的未上传完毕的对象列表。
readwrite，anonymous access to upload and download all objects. This also means full public access.
匿名用户允许对所有的对象上传和下载。亦即public access。
none，default (no policy) it means that all operations need to be authenticated towards desired bucket and prefix.
默认没有配置策略，针对目标存储桶和前缀所有的操作都需要被认证。
《参考》： minio-hows-bucket-policy-related-to-anonymous-authorized-access
存储桶访问权限，定义的是桶级别的，即 /*；匿名用户访问权限，定义的是路径级别的；
| 存储桶 | Access Policy | Anonymouse Access Role | mc anonymous get | mc anonymous list |
|---|---|---|---|---|
| test-none | n/a |
private |
||
| test-public | public |
public |
bucket-public/* => readwrite | |
| test-private | private |
custom |
||
| test-custom | custom |
custom |
bucket-custom/rw/* => readwrite bucket-custom/ro/* => readonly bucket-custom/wo/* => writeonly |
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/bucket-public
bucket-public/* => readwrite
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/bucket-private
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/bucket-custom
bucket-custom/rw/* => readwrite
bucket-custom/ro/* => readonly
bucket-custom/wo/* => writeonly
二、匿名用户访问权限设置 （Anonymous Access Rule）
- Prefix 输入
/可将规则应用于bucket根目录下的所有前缀和对象。 - 不要将通配符
*作为前缀的一部分，除非它是前缀名称的显式部分。 - 控制台会自动在生成的IAM策略的相应部分添加一个星号。
通过 mc anonymous get 获取访问权限
https://min.io/docs/minio/linux/reference/minio-mc/mc-anonymous-set.html
注意：
mc policy已经被mc anonymous取代
[root@VM-201-74-centos ~]# mc policy
mc: Please use 'mc anonymous'
三、mc anonymous set 设置访问权限
创建3个存储桶 uploads、downloads、public
查看当前访问权限
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/uploads
Access permission for `rhobs/uploads` is `private`
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/downloads
Access permission for `rhobs/downloads` is `private`
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/public
Access permission for `rhobs/public` is `private`
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/uploads
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/downloads
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/public
设置访问权限
mc anonymous set upload rhobs/uploads
mc anonymous set download rhobs/downloads
mc anonymous set public rhobs/public
再次查看访问权限
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/uploads
Access permission for `rhobs/uploads` is `upload`
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/downloads
Access permission for `rhobs/downloads` is `download`
[root@VM-201-74-centos .mc]# mc anonymous get rhobs/public
Access permission for `rhobs/public` is `public`
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/uploads
uploads/* => writeonly
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/downloads
downloads/* => readonly
[root@VM-201-74-centos .mc]# mc anonymous list rhobs/public
public/* => readwrite
| 存储桶 | Access Policy | Anonymous Access |
|---|---|---|
| uploads | custom | Prefix: / Access: writeonly
|
| downloads | custom | Prefix: / Access: readonly
|
| public | public | Prefix: / Access: readwrite
|
