COS policy for restic with minimal permission.

README.md

COS Policy for Restic

适用于 Restic 腾讯云 COS 最小权限策略.

本策略只允许备份, 不允许删除备份 (但要注意恶意攻击者仍可把所有的备份文件替换为空文件).

变量:

• $UID: 腾讯云 uid, 形如 uid/1250000000
• $BUCKET: 存储桶名称, 形如 examplebucket-1250000000
• $RESTIC_REPO_PREFIX: Restic 存储库前缀, 例如 laptop-backup

restic.policy.json

{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": [
                "cos:HeadObject",
                "cos:GetBucket",
                "cos:GetObject",
                "cos:PutObject"
            ],
            "resource": [
                "qcs::cos::$UID:$BUCKET/$RESTIC_REPO_PREFIX",
                "qcs::cos::$UID:$BUCKET/$RESTIC_REPO_PREFIX/*"
            ]
        },
        {
            "effect": "allow",
            "action": [
                "cos:DeleteObject"
            ],
            "resource": [
                "qcs::cos::$UID:$BUCKET/$RESTIC_REPO_PREFIX/locks/*"
            ]
        },
        {
            "effect": "allow",
            "action": [
                "cos:HeadBucket",
                "cos:GetBucket",
                "cos:GetBucketLocation"
            ],
            "resource": [
                "qcs::cos::$UID:$BUCKET"
            ]
        }
    ]
}