Available in Classic and VPC
You can set different access permissions for Ncloud Storage using NAVER Cloud Platform's Sub Account service. Sub Account offers both system-managed (System Managed) and user-defined (User Created) policies to help you configure management and operation permissions.
Note
Sub Account is a free service with no additional charges. For more information about Sub Account, see All Services > Management & Governance > Sub Account on the NAVER Cloud Platform portal and the Sub Account user guide.
System-managed policies
System-managed policies are pre-built, role-based policies that NAVER Cloud Platform provides for your convenience. When you assign one of these policies to a sub account, that account gets access to Ncloud Storage. Here are the available system-managed policies for Ncloud Storage:
| Policy name | Policy description |
|---|---|
| NCP_ADMINISTRATOR | Full access to all services, same as the main account. |
| NCP_INFRA_MANAGER | Access to all services, except My Account > Manage billing information and expense > Manage billing and payment on the console |
| NCP_FINANCE_MANAGER | Access limited to the Cost Explorer services and My Account > Manage billing information and expense > Manage billing and payment on the console |
| NCP_NCLOUD_STORAGE_MANAGER | Full access to all Ncloud Storage features. |
| NCP_NCLOUD_STORAGE_VIEWER | View-only access to all Ncloud Storage features. |
User-defined policies
User-defined policies let you create custom permissions. When you assign a user-defined policy to a sub account, that account can only perform the specific actions you've allowed. Here are the available user-defined policies for Ncloud Storage:
| Type | Action | Related action | Resource type | Action description |
|---|---|---|---|---|
| View | View/ListAllMyBuckets | - | Bucket | View bucket list. |
| View | View/ListBucket | - | Bucket | View bucket properties and object list. |
| View | View/ListBucketMultipartUploads | View/ListBucket | Bucket | View information on canceled or incomplete multipart upload. |
| View | View/ListMultipartUploadParts | View/ListBucket | Bucket | View object parts uploaded to the bucket via multipart upload. |
| View | View/ListBucketVersions | View/ListBucket | Bucket | View bucket metadata for all contained object versions. |
| View | View/GetBucketVersioning |
|
Bucket | View bucket versioning setting status. |
| View | View/GetObject | View/ListBucket | Bucket | View object properties and download object. |
| View | View/GetObjectVersion |
|
Bucket | View object properties with versioning enabled and download object. |
| View | View/GetBucketLocation |
|
Bucket | View information of the region where bucket is created. |
| View | View/GetLifecycleConfiguration |
|
Bucket | View bucket lifecycle configuration. |
| View | View/GetEncryptionConfiguration |
|
Bucket | View bucket encryption settings. |
| View | View/GetBucketCORS |
|
Bucket | View CORS settings. |
| View | View/GetObjectAttributes |
|
Bucket | View object properties (ETag, checksum, storage class, size, etc.). |
| View | View/GetObjectVersionAttributes |
|
Bucket | View properties (ETag, checksum, storage class, size, etc.) of object versions created with versioning enabled. |
| View | View/GetBucketObjectLockConfiguration |
|
Bucket | View Object Lock settings for a bucket. |
| View | View/GetObjectRetention |
|
Bucket | View retention period configured for an object. |
| View | View/GetObjectLegalHold |
|
Bucket | View the legal retention status configured for an object. |
| Change | Change/CreateBucket | View/ListAllMyBuckets | Bucket | Create bucket. |
| Change | Change/DeleteBucket |
|
Bucket | Delete bucket. |
| Change | Change/PutObject | View/ListBucket | Bucket | Upload object to bucket. |
| Change | Change/DeleteObject | View/ListBucket | Bucket | Delete object. |
| Change | Change/DeleteObjectVersion |
|
Bucket | Delete object with versioning enabled. |
| Change | Change/AbortMultipartUpload |
|
Bucket | Delete all incomplete multipart parts. |
| Change | Change/PutBucketVersioning |
|
Bucket | Bucket versioning for a bucket. |
| Change | Change/PutLifecycleConfiguration |
|
Bucket | Create new bucket lifecycle or update existing configuration. |
| Change | Change/PutEncryptionConfiguration |
|
Bucket | Change encryption settings. |
| Change | Change/PutBucketCORS |
|
Bucket | Change CORS settings. |
| Change | Change/RestoreObject |
|
Bucket | Restore object to access to archived object. |
| Change | Change/PutBucketObjectLockConfiguration |
|
Bucket | Create or change the default Object Lock retention settings for a bucket. |
| Change | Change/PutObjectRetention |
|
Bucket | Set or change the retention mode and retention expiration date for an object. |
| Change | Change/PutObjectLegalHold |
|
Bucket | Set or remove the legal retention status for an object. |
| Change | Change/BypassGovernanceRetention |
|
Bucket | Delete an object or change its retention settings by bypassing the retention period in Governance mode. |
Caution
If you grant permission for a specific action without granting the required related action permissions, the task may not be performed properly.
- To prevent this issue, when you grant action permissions, Sub Account automatically grants the related action permissions as well.
- However, if you deselect automatically granted related actions, the system considers this intentional and does not forcibly include them. Use caution when configuring permissions.