--- title: "Ncloud Storage permissions management" slug: "ncloudstorage-subaccount" updated: 2026-09-17T09:18:03Z published: 2026-09-17T09:18:03Z canonical: "guide.ncloud-docs.com/ncloudstorage-subaccount" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt > Use this file to discover all available pages before exploring further. # Ncloud Storage permissions management Available in Classic and VPC You can set different access permissions for Ncloud Storage using NAVER Cloud Platform's Sub Account service. Sub Account offers both system-managed (System Managed) and user-defined (User Created) policies to help you configure management and operation permissions. Note Sub Account is a free service with no additional charges. For more information about Sub Account, see [**All Services** > **Management & Governance** > **Sub Account**](https://www.ncloud.com/product/management/subAccount) on the NAVER Cloud Platform portal and the [Sub Account user guide](/docs/en/subaccount-overview). ## System-managed policies System-managed policies are pre-built, role-based policies that NAVER Cloud Platform provides for your convenience. When you assign one of these policies to a sub account, that account gets access to Ncloud Storage. Here are the available system-managed policies for Ncloud Storage: | Policy name | Policy description | | --- | --- | | NCP_ADMINISTRATOR | Full access to all services, same as the main account. | | NCP_INFRA_MANAGER | Access to all services, except **My Account** > **Manage billing information and expense** > **Manage billing and payment** on the console | | NCP_FINANCE_MANAGER | Access limited to the Cost Explorer services and **My Account** > **Manage billing information and expense** > **Manage billing and payment** on the console | | NCP_NCLOUD_STORAGE_MANAGER | Full access to all Ncloud Storage features. | | NCP_NCLOUD_STORAGE_VIEWER | View-only access to all Ncloud Storage features. | ## User-defined policies User-defined policies let you create custom permissions. When you assign a user-defined policy to a sub account, that account can only perform the specific actions you've allowed. Here are the available user-defined policies for Ncloud Storage: | Type | Action | Related action | Resource type | Action description | | --- | --- | --- | --- | --- | | View | View/ListAllMyBuckets | - | Bucket | View bucket list. | | View | View/ListBucket | - | Bucket | View bucket properties and object list. | | View | View/ListBucketMultipartUploads | View/ListBucket | Bucket | View information on canceled or incomplete multipart upload. | | View | View/ListMultipartUploadParts | View/ListBucket | Bucket | View object parts uploaded to the bucket via multipart upload. | | View | View/ListBucketVersions | View/ListBucket | Bucket | View bucket metadata for all contained object versions. | | View | View/GetBucketVersioning | - View/ListAllMyBuckets - View/ListBucket | Bucket | View bucket versioning setting status. | | View | View/GetObject | View/ListBucket | Bucket | View object properties and download object. | | View | View/GetObjectVersion | - View/ListBucket - View/GetObject | Bucket | View object properties with versioning enabled and download object. | | View | View/GetBucketLocation | - View/ListAllMyBuckets - View/ListBucket | Bucket | View information of the region where bucket is created. | | View | View/GetLifecycleConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | View bucket lifecycle configuration. | | View | View/GetEncryptionConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | View bucket encryption settings. | | View | View/GetBucketCORS | - View/ListAllMyBuckets - View/ListBucket | Bucket | View CORS settings. | | View | View/GetObjectAttributes | - View/ListBucket - View/GetObject | Bucket | View object properties (ETag, checksum, storage class, size, etc.). | | View | View/GetObjectVersionAttributes | - View/ListBucket - View/GetObjectVersion | Bucket | View properties (ETag, checksum, storage class, size, etc.) of object versions created with versioning enabled. | | View | View/GetBucketObjectLockConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | View Object Lock settings for a bucket. | | View | View/GetObjectRetention | - View/ListBucket - View/GetObject - View/GetObjectVersion | Bucket | View retention period configured for an object. | | View | View/GetObjectLegalHold | - View/ListBucket - View/GetObject - View/GetObjectVersion | Bucket | View the legal retention status configured for an object. | | Change | Change/CreateBucket | View/ListAllMyBuckets | Bucket | Create bucket. | | Change | Change/DeleteBucket | - View/ListAllMyBuckets - View/ListBucket | Bucket | Delete bucket. | | Change | Change/PutObject | View/ListBucket | Bucket | Upload object to bucket. | | Change | Change/DeleteObject | View/ListBucket | Bucket | Delete object. | | Change | Change/DeleteObjectVersion | - View/ListBucket - View/GetObject - View/GetObjectVersion - Change/DeleteObject | Bucket | Delete object with versioning enabled. | | Change | Change/AbortMultipartUpload | - View/ListBucket - Change/DeleteObject | Bucket | Delete all incomplete multipart parts. | | Change | Change/PutBucketVersioning | - View/ListAllMyBuckets - View/ListBucket | Bucket | Bucket versioning for a bucket. | | Change | Change/PutLifecycleConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | Create new bucket lifecycle or update existing configuration. | | Change | Change/PutEncryptionConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | Change encryption settings. | | Change | Change/PutBucketCORS | - View/ListAllMyBuckets - View/ListBucket | Bucket | Change CORS settings. | | Change | Change/RestoreObject | - View/ListBucket - View/GetObject - Change/PutObject | Bucket | Restore object to access to archived object. | | Change | Change/PutBucketObjectLockConfiguration | - View/ListAllMyBuckets - View/ListBucket | Bucket | Create or change the default Object Lock retention settings for a bucket. | | Change | Change/PutObjectRetention | - View/ListBucket - View/GetObject - View/GetObjectVersion | Bucket | Set or change the retention mode and retention expiration date for an object. | | Change | Change/PutObjectLegalHold | - View/ListBucket - View/GetObject - View/GetObjectVersion | Bucket | Set or remove the legal retention status for an object. | | Change | Change/BypassGovernanceRetention | - View/ListBucket - View/GetObject - View/GetObjectVersion - Change/DeleteObject - Change/DeleteObjectVersion - Change/PutObjectRetention | Bucket | Delete an object or change its retention settings by bypassing the retention period in Governance mode. | Caution If you grant permission for a specific action without granting the required related action permissions, the task may not be performed properly. - To prevent this issue, when you grant action permissions, Sub Account automatically grants the related action permissions as well. - However, if you deselect automatically granted related actions, the system considers this intentional and does not forcibly include them. Use caution when configuring permissions.