# 身份策略授权参考 云服务在IAM预置了常用的权限，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。 除IAM服务外，[Organizations](https://support.huaweicloud.com/productdesc-organizations/org_01_0011.html)服务中的[服务控制策略](https://support.huaweicloud.com/usermanual-organizations/org_03_0065.html)（Service Control Policy，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。 SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM身份策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。 IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：[IAM服务与Organizations服务权限访问控制的区别](https://support.huaweicloud.com/organizations_faq/org_06_0004.html)。 本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。 - 如何使用这些元素编辑IAM自定义身份策略，请参考[创建自定义身份策略](https://support.huaweicloud.com/usermanual-iam5/iam_01_0917.html)。 - 如何使用这些元素编辑SCP自定义策略，请参考[创建SCP](https://support.huaweicloud.com/usermanual-organizations/org_03_0035.html)。 #### 操作（Action） 操作（Action）即为身份策略中支持的授权项。 - "访问级别"列描述如何对操作进行分类（List、Read和Write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。 - "资源类型"列指每个操作是否支持资源级权限。 - 资源类型支持通配符号\*表示所有。如果此列没有值（-），则必须在身份策略语句的Resource元素中指定所有资源类型（"\*"）。 - 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。 - 资源类型列中必需资源在表中用星号（\*）标识，表示使用此操作必须指定该资源类型。 关于CC定义的资源类型的详细信息请参见[资源类型（Resource）]。 - "条件键"列包括了可以在身份策略语句的Condition元素中支持指定的键值。 - 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。 - 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。 - 如果此列条件键没有值（-），表示此操作不支持指定条件键。 关于CC定义的条件键的详细信息请参见[条件（Condition）]。 - "别名"列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见[身份策略兼容性说明](https://support.huaweicloud.com/iam5_faq/iam_01_1103.html)。 您可以在身份策略语句的Action元素中指定以下CC的相关操作。 表1CC支持的授权项 | 授权项 | 描述 | 访问级别 | 资源类型（\*为必须） | 条件键 | 别名 | |:---|:---|:---|:---|:---|:---| | cc:cloudConnections:create | 授予创建云连接权限。 | Write | cloudConnection \* | - | - | | cc:cloudConnections:create | 授予创建云连接权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:delete | 授予删除云连接权限。 | Write | cloudConnection \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:update | 授予更新云连接权限。 | Write | cloudConnection \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:get | 授予查询云连接详情权限。 | Read | cloudConnection \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:list | 授予查询云连接列表权限。 | List | cloudConnection \* | - | - | | cc:cloudConnections:tag | 授予为云连接实例打标签权限。 | Tagging | cloudConnection \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:tag | 授予为云连接实例打标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:unTag | 授予为云连接实例删除标签权限。 | Tagging | cloudConnection \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:unTag | 授予为云连接实例删除标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnections:listTags | 授予查询为云连接资源的标签列表权限。 | List | cloudConnection \* | - | - | | cc:networkInstances:create | 授予创建网络实例权限。 | Write | networkInstance \* | - | - | | cc:networkInstances:create | 授予创建网络实例权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:create | 授予创建网络实例权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:VpcId] - [cc:VirtualGatewayId] - [cc:EnterpriseRouterId] | - | | cc:networkInstances:delete | 授予删除网络实例权限。 | Write | networkInstance \* | - [cc:VpcId] - [cc:VirtualGatewayId] - [cc:EnterpriseRouterId] | - | | cc:networkInstances:delete | 授予删除网络实例权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:delete | 授予删除网络实例权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:update | 授予更新网络实例权限。 | Write | networkInstance \* | - [cc:VpcId] - [cc:VirtualGatewayId] - [cc:EnterpriseRouterId] | - | | cc:networkInstances:update | 授予更新网络实例权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:update | 授予更新网络实例权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:get | 授予查询网络实例详情权限。 | Read | networkInstance \* | - | - | | cc:networkInstances:get | 授予查询网络实例详情权限。 | Read | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:get | 授予查询网络实例详情权限。 | Read | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:networkInstances:list | 授予查询网络实例列表权限。 | List | networkInstance \* | - | - | | cc:bandwidthPackages:create | 授予创建带宽包权限。 | Write | bandwidthPackage \* | - | - | | cc:bandwidthPackages:create | 授予创建带宽包权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:delete | 授予删除带宽包权限。 | Write | bandwidthPackage \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:update | 授予更新带宽包权限。 | Write | bandwidthPackage \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:get | 授予查询带宽包详情权限。 | Read | bandwidthPackage \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:list | 授予查询带宽包列表权限。 | List | bandwidthPackage \* | - | - | | cc:bandwidthPackages:tag | 授予为带宽包打标签权限。 | Tagging | bandwidthPackage \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:tag | 授予为带宽包打标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:unTag | 授予为带宽包删除标签权限。 | Tagging | bandwidthPackage \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:unTag | 授予为带宽包删除标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:listTags | 授予查询带宽包资源的标签列表权限。 | List | bandwidthPackage \* | - | - | | cc:bandwidthPackages:associate | 授予关联带宽包权限。 | Write | bandwidthPackage \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:associate | 授予关联带宽包权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:associate | 授予关联带宽包权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:disassociate | 授予解关联带宽包权限。 | Write | bandwidthPackage \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:disassociate | 授予解关联带宽包权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:bandwidthPackages:disassociate | 授予解关联带宽包权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:create | 授予创建域间带宽权限。 | Write | interRegionBandwidth \* | - | - | | cc:interRegionBandwidths:create | 授予创建域间带宽权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:create | 授予创建域间带宽权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:BandwidthPackageId] | - | | cc:interRegionBandwidths:delete | 授予删除域间带宽权限。 | Write | interRegionBandwidth \* | [cc:BandwidthPackageId] | - | | cc:interRegionBandwidths:delete | 授予删除域间带宽权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:delete | 授予删除域间带宽权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:update | 授予更新域间带宽权限。 | Write | interRegionBandwidth \* | [cc:BandwidthPackageId] | - | | cc:interRegionBandwidths:update | 授予更新域间带宽权限。 | Write | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:update | 授予更新域间带宽权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:get | 授予查询域间带宽详情权限。 | Read | interRegionBandwidth \* | - | - | | cc:interRegionBandwidths:get | 授予查询域间带宽详情权限。 | Read | cloudConnection \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:get | 授予查询域间带宽详情权限。 | Read | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:interRegionBandwidths:list | 授予查询域间带宽列表权限。 | List | interRegionBandwidth \* | - | - | | cc:cloudConnectionRoutes:get | 授予查询云连接路由详情权限。 | Read | - | - | - | | cc:cloudConnectionRoutes:list | 授予查询云连接路由列表权限。 | List | - | - | - | | cc:authorisation:create | 授予创建虚拟私有云授权的权限。 | Write | - | - | - | | cc:authorisation:delete | 授予删除虚拟私有云授权的权限。 | Write | - | - | - | | cc:authorisation:update | 授予更新虚拟私有云授权基本信息的权限。 | Write | - | - | - | | cc:authorisation:list | 授予查询虚拟私有云授权列表权限。 | List | - | - | - | | cc:authorisation:listPermissions | 授予查询被授权的虚拟私有云列表权限。 | List | - | - | - | | cc:crossBorderConsent:show | 授予查询明示同意跨境转移个人数据的权限。 | Read | - | - | - | | cc:crossBorderConsent:create | 授予允许用户明示同意跨境转移个人数据的权限。 | Write | - | - | - | | cc:quota:list | 授予查询配额列表权限。 | List | - | - | - | | cc:capability:list | 授予查询云连接、中心网络和分支网络能力列表权限。 | List | - | - | - | | cc:centralNetwork:create | 授予创建中心网络权限。 | Write | centralNetwork \* | - | - | | cc:centralNetwork:create | 授予创建中心网络权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetwork:delete | 授予删除中心网络权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:update | 授予更新中心网络权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:update | 授予更新中心网络权限。 | Write | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:get | 授予查询中心网络详情权限。 | Read | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:list | 授予查询中心网络列表权限。 | List | centralNetwork \* | - | - | | cc:centralNetwork:tag | 授予为中心网络添加标签权限。 | Tagging | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:tag | 授予为中心网络添加标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:unTag | 授予删除中心网络标签权限。 | Tagging | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:unTag | 授予删除中心网络标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:listTags | 授予查询中心网络标签权限。 | List | centralNetwork \* | - | - | | cc:centralNetwork:createPolicy | 授予创建中心网络策略权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:createPolicy | 授予创建中心网络策略权限。 | Write | - | [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetwork:applyPolicy | 授予应用中心网络策略权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:deletePolicy | 授予删除中心网络策略权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:listPolicies | 授予查询中心网络策略列表权限。 | List | centralNetwork \* | - | - | | cc:centralNetwork:listChangeSet | 授予查询当前策略与被应用策略变化集权限。 | List | centralNetwork \* | - | - | | cc:centralNetwork:listConnections | 授予查询中心网络连接列表权限。 | List | centralNetwork \* | - | - | | cc:centralNetwork:updateConnection | 授予更新中心网络连接权限。 | Write | centralNetwork \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetwork:updateConnection | 授予更新中心网络连接权限。 | Write | - | [cc:GlobalConnectionBandwidthId] | - | | cc:centralNetworkAttachment:createGdgw | 授予创建中心网络GDGW附件权限。 | Write | centralNetworkAttachment \* | - | - | | cc:centralNetworkAttachment:createGdgw | 授予创建中心网络GDGW附件权限。 | Write | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:createGdgw | 授予创建中心网络GDGW附件权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:EnterpriseRouterId] - [cc:GlobalDcGatewayId] | - | | cc:centralNetworkAttachment:updateGdgw | 授予更新中心网络GDGW附件权限。 | Write | centralNetworkAttachment \* | - [cc:GlobalDcGatewayId] - [cc:EnterpriseRouterId] | - | | cc:centralNetworkAttachment:updateGdgw | 授予更新中心网络GDGW附件权限。 | Write | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:updateGdgw | 授予更新中心网络GDGW附件权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:getGdgw | 授予查询中心网络GDGW附件详情权限。 | Read | centralNetworkAttachment \* | - [cc:GlobalDcGatewayId] - [cc:EnterpriseRouterId] | - | | cc:centralNetworkAttachment:getGdgw | 授予查询中心网络GDGW附件详情权限。 | Read | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:getGdgw | 授予查询中心网络GDGW附件详情权限。 | Read | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:listGdgws | 授予查询中心网络GDGW附件列表权限。 | List | centralNetworkAttachment \* | - | - | | cc:centralNetworkAttachment:listGdgws | 授予查询中心网络GDGW附件列表权限。 | List | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:listGdgws | 授予查询中心网络GDGW附件列表权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:createErRouteTable | 授予创建中心网络er-route-table附件权限。 | Write | centralNetworkAttachment \* | - | - | | cc:centralNetworkAttachment:createErRouteTable | 授予创建中心网络er-route-table附件权限。 | Write | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:createErRouteTable | 授予创建中心网络er-route-table附件权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetworkAttachment:updateErRouteTable | 授予更新中心网络er-route-table附件权限。 | Write | centralNetworkAttachment \* | [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetworkAttachment:updateErRouteTable | 授予更新中心网络er-route-table附件权限。 | Write | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:updateErRouteTable | 授予更新中心网络er-route-table附件权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:getErRouteTable | 授予查询中心网络er-route-table附件详情权限。 | Read | centralNetworkAttachment \* | [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetworkAttachment:getErRouteTable | 授予查询中心网络er-route-table附件详情权限。 | Read | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:getErRouteTable | 授予查询中心网络er-route-table附件详情权限。 | Read | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:listErRouteTables | 授予查询中心网络er-route-table附件列表权限。 | List | centralNetworkAttachment \* | - | - | | cc:centralNetworkAttachment:listErRouteTables | 授予查询中心网络er-route-table附件列表权限。 | List | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:listErRouteTables | 授予查询中心网络er-route-table附件列表权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:delete | 授予删除中心网络附件权限。 | Write | centralNetworkAttachment \* | - [cc:GlobalDcGatewayId] - [cc:EnterpriseRouterId] - [cc:MultipleEnterpriseRouterIds] | - | | cc:centralNetworkAttachment:delete | 授予删除中心网络附件权限。 | Write | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:delete | 授予删除中心网络附件权限。 | Write | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:list | 授予查询中心网络附件列表权限。 | List | centralNetworkAttachment \* | - | - | | cc:centralNetworkAttachment:list | 授予查询中心网络附件列表权限。 | List | centralNetwork \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:centralNetworkAttachment:list | 授予查询中心网络附件列表权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:siteNetwork:createP2P | 授予创建P2P类型的分支网络权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:list | 授予查询分支网络列表权限。 | List | siteNetwork \* | - | - | | cc:siteNetwork:get | 授予查询分支网络详情权限。 | Read | siteNetwork \* | - | - | | cc:siteNetwork:update | 授予更新分支网络权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:delete | 授予删除分支网络权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:disassociateBandwidth | 授予解关联分支网络带宽权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:associateBandwidth | 授予关联分支网络带宽权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:updateBandwidthSize | 授予更新分支网络带宽大小权限。 | Write | siteNetwork \* | - | - | | cc:siteNetwork:updateBandwidth | 授予更新分支网络带宽权限。 | Write | siteNetwork \* | - | - | | cc:gcbandwidth:list | 授予查询骨干带宽列表的权限。 | List | gcbandwidth \* | - | cc:gcbandwidths:list | | cc:gcbandwidth:list | 授予查询骨干带宽列表的权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:list | | cc:gcbandwidth:get | 授予查询骨干带宽详情的权限。 | Read | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:get | | cc:gcbandwidth:create | 授予创建骨干带宽的权限。 | Write | gcbandwidth \* | - | cc:gcbandwidths:create | | cc:gcbandwidth:create | 授予创建骨干带宽的权限。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:create | | cc:gcbandwidth:update | 授予更新骨干带宽的权限。 | Write | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:update | | cc:gcbandwidth:delete | 授予删除骨干带宽的权限。 | Write | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:delete | | cc:gcbandwidth:getRelations | 授予查询骨干带宽绑定关系的权限。 | Read | gcbandwidth \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:get | | cc:gcbandwidth:associateInstance | 授予实例绑定骨干带宽的权限。 | Write | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:update | | cc:gcbandwidth:associateInstance | 授予实例绑定骨干带宽的权限。 | Write | - | [cc:gcbAssociateResourceType] | cc:gcbandwidths:update | | cc:gcbandwidth:disassociateInstance | 授予取消实例绑定骨干带宽的权限。 | Write | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [cc:gcbAssociateResourceType] | cc:gcbandwidths:update | | cc:gcbandwidth:listSupportBinding | 授予查询支持绑定的骨干带宽的权限。 | List | gcbandwidth \* | - | cc:gcbandwidths:list | | cc:gcbandwidth:listSupportBinding | 授予查询支持绑定的骨干带宽的权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:list | | cc:gcbandwidth:listTags | 授予查询骨干带宽资源标签权限。 | List | gcbandwidth \* | - | - cc:gcbandwidths:listByTag - cc:gcbandwidths:countByTag - cc:gcbandwidths:getTags - cc:gcbandwidths:listTags | | cc:gcbandwidth:tag | 授予创建骨干带宽资源标签权限。 | Tagging | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:createTags | | cc:gcbandwidth:tag | 授予创建骨干带宽资源标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:createTags | | cc:gcbandwidth:unTag | 授予删除骨干带宽资源标签权限。 | Tagging | gcbandwidth \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:deleteTags | | cc:gcbandwidth:unTag | 授予删除骨干带宽资源标签权限。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | cc:gcbandwidths:deleteTags | | cc:cloudConnectionAttachments:list | 授予查询企业云连接网络实例列表权限。 | List | cloudConnectionAttachment \* | - | - | | cc:cloudConnectionAttachments:list | 授予查询企业云连接网络实例列表权限。 | List | - | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnectionAttachments:tag | 授予为企业云连接网络实例添加标签权限。 | Tagging | cloudConnectionAttachment \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnectionAttachments:tag | 授予为企业云连接网络实例添加标签权限。 | Tagging | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnectionAttachments:unTag | 授予删除企业云连接网络实例标签权限。 | Tagging | cloudConnectionAttachment \* | [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnectionAttachments:unTag | 授予删除企业云连接网络实例标签权限。 | Tagging | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | cc:cloudConnectionAttachments:listTags | 授予查询企业云连接网络实例标签权限。 | List | cloudConnectionAttachment \* | - | - | | cc:cloudConnectionInterSiteConnection:createGlobalConnectionBandwidth | 授予创建企业云连接跨站连接下的全域互联带宽权限。 | Write | - | - | - | | cc:cloudConnectionInterSiteConnection:deleteGlobalConnectionBandwidth | 授予删除企业云连接跨站连接下的全域互联带宽权限。 | Write | - | - | - | CC的API通常对应着一个或多个授权项。[表2]展示了API与授权项的关系，以及该API需要依赖的授权项。 表2API与授权项的关系 | API | 对应的授权项 | 依赖的授权项 | |:---|:---|:---| | [POST /v3/{domain_id}/ccaas/cloud-connections](https://support.huaweicloud.com/api-cc/CreateCloudConnection.html) | cc:cloudConnections:create | - | | [PUT /v3/{domain_id}/ccaas/cloud-connections/{id}](https://support.huaweicloud.com/api-cc/UpdateCloudConnection.html) | cc:cloudConnections:update | - | | [DELETE /v3/{domain_id}/ccaas/cloud-connections/{id}](https://support.huaweicloud.com/api-cc/DeleteCloudConnection.html) | cc:cloudConnections:delete | - | | [GET /v3/{domain_id}/ccaas/cloud-connections/{id}](https://support.huaweicloud.com/api-cc/ShowCloudConnection.html) | cc:cloudConnections:get | - | | [GET /v3/{domain_id}/ccaas/cloud-connections](https://support.huaweicloud.com/api-cc/ListCloudConnections.html) | cc:cloudConnections:list | - | | [POST /v3/{domain_id}/ccaas/cloud-connections/filter](https://support.huaweicloud.com/api-cc/ListCloudConnectionsByTags.html) | cc:cloudConnections:list | - | | [POST /v3/{domain_id}/ccaas/cloud-connections/{id}/tag](https://support.huaweicloud.com/api-cc/TagCloudConnection.html) | cc:cloudConnections:tag | - | | [POST /v3/{domain_id}/ccaas/cloud-connections/{id}/untag](https://support.huaweicloud.com/api-cc/UntagCloudConnection.html) | cc:cloudConnections:unTag | - | | [GET /v3/{domain_id}/ccaas/cloud-connections/tags](https://support.huaweicloud.com/api-cc/ListCloudConnectionTags.html) | cc:cloudConnections:listTags | - | | [POST /v3/{domain_id}/ccaas/network-instances](https://support.huaweicloud.com/api-cc/CreateNetworkInstance.html) | cc:networkInstances:create | - | | [PUT /v3/{domain_id}/ccaas/network-instances/{id}](https://support.huaweicloud.com/api-cc/UpdateNetworkInstance.html) | cc:networkInstances:update | - | | [DELETE /v3/{domain_id}/ccaas/network-instances/{id}](https://support.huaweicloud.com/api-cc/DeleteNetworkInstance.html) | cc:networkInstances:delete | - | | [GET /v3/{domain_id}/ccaas/network-instances/{id}](https://support.huaweicloud.com/api-cc/ShowNetworkInstance.html) | cc:networkInstances:get | - | | [GET /v3/{domain_id}/ccaas/network-instances](https://support.huaweicloud.com/api-cc/ListNetworkInstances.html) | cc:networkInstances:list | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages](https://support.huaweicloud.com/api-cc/CreateBandwidthPackage.html) | cc:bandwidthPackages:create | - | | [PUT /v3/{domain_id}/ccaas/bandwidth-packages/{id}](https://support.huaweicloud.com/api-cc/UpdateBandwidthPackage.html) | cc:bandwidthPackages:update | - | | [DELETE /v3/{domain_id}/ccaas/bandwidth-packages/{id}](https://support.huaweicloud.com/api-cc/DeleteBandwidthPackage.html) | cc:bandwidthPackages:delete | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages/{id}](https://support.huaweicloud.com/api-cc/ShowBandwidthPackage.html) | cc:bandwidthPackages:get | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages](https://support.huaweicloud.com/api-cc/ListBandwidthPackages.html) | cc:bandwidthPackages:list | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages/filter](https://support.huaweicloud.com/api-cc/ListBandwidthPackagesByTags.html) | cc:bandwidthPackages:list | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/tag](https://support.huaweicloud.com/api-cc/TagBandwidthPackage.html) | cc:bandwidthPackages:tag | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/untag](https://support.huaweicloud.com/api-cc/UntagBandwidthPackage.html) | cc:bandwidthPackages:unTag | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages/tags](https://support.huaweicloud.com/api-cc/ListBandwidthPackageTags.html) | cc:bandwidthPackages:listTags | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/associate](https://support.huaweicloud.com/api-cc/AssociateBandwidthPackage.html) | cc:bandwidthPackages:associate | - | | [POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/disassociate](https://support.huaweicloud.com/api-cc/DisassociateBandwidthPackage.html) | cc:bandwidthPackages:disassociate | - | | [POST /v3/{domain_id}/ccaas/inter-region-bandwidths](https://support.huaweicloud.com/api-cc/CreateInterRegionBandwidth.html) | cc:interRegionBandwidths:create | - | | [PUT /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}](https://support.huaweicloud.com/api-cc/UpdateInterRegionBandwidth.html) | cc:interRegionBandwidths:update | - | | [DELETE /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}](https://support.huaweicloud.com/api-cc/DeleteInterRegionBandwidth.html) | cc:interRegionBandwidths:delete | - | | [GET /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}](https://support.huaweicloud.com/api-cc/ShowInterRegionBandwidth.html) | cc:interRegionBandwidths:get | - | | [GET /v3/{domain_id}/ccaas/inter-region-bandwidths](https://support.huaweicloud.com/api-cc/ListInterRegionBandwidths.html) | cc:interRegionBandwidths:list | - | | [GET /v3/{domain_id}/ccaas/cloud-connection-routes/{id}](https://support.huaweicloud.com/api-cc/ShowCloudConnectionRoutes.html) | cc:cloudConnectionRoutes:get | - | | [GET /v3/{domain_id}/ccaas/cloud-connection-routes](https://support.huaweicloud.com/api-cc/ListCloudConnectionRoutes.html) | cc:cloudConnectionRoutes:list | - | | [POST /v3/{domain_id}/ccaas/authorisations](https://support.huaweicloud.com/api-cc/CreateAuthorisation.html) | cc:authorisation:create | - | | [DELETE /v3/{domain_id}/ccaas/authorisations/{id}](https://support.huaweicloud.com/api-cc/DeleteAuthorisation.html) | cc:authorisation:delete | - | | [PUT /v3/{domain_id}/ccaas/authorisations/{id}](https://support.huaweicloud.com/api-cc/UpdateAuthorisation.html) | cc:authorisation:update | - | | [GET /v3/{domain_id}/ccaas/authorisations](https://support.huaweicloud.com/api-cc/ListAuthorisations.html) | cc:authorisation:list | - | | [GET /v3/{domain_id}/ccaas/permissions](https://support.huaweicloud.com/api-cc/ListPermissions.html) | cc:authorisation:listPermissions | - | | [GET /v3/{domain_id}/ccaas/quotas](https://support.huaweicloud.com/api-cc/ListCloudConnectionQuotas.html) | cc:quota:list | - | | [GET /v3/{domain_id}/gcn/quotas](https://support.huaweicloud.com/api-cc/ListCentralNetworkQuotas.html) | cc:quota:list | - | | [GET /v3/{domain_id}/ccaas/capabilities](https://support.huaweicloud.com/api-cc/ListCloudConnectionCapabilities.html) | cc:capability:list | - | | [GET /v3/{domain_id}/gcn/capabilities](https://support.huaweicloud.com/api-cc/ListCentralNetworkCapabilities.html) | cc:capability:list | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages/sites](https://support.huaweicloud.com/api-cc/ListBandwidthPackageSites.html) | cc:capability:list | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages/levels](https://support.huaweicloud.com/api-cc/ListBandwidthPackageLevels.html) | cc:capability:list | - | | [GET /v3/{domain_id}/ccaas/bandwidth-packages/lines](https://support.huaweicloud.com/api-cc/ListBandwidthPackageLines.html) | cc:capability:list | - | | [POST /v3/{domain_id}/gcn/central-networks](https://support.huaweicloud.com/api-cc/CreateCentralNetwork.html) | cc:centralNetwork:create | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [DELETE /v3/{domain_id}/gcn/central-networks/{central_network_id}](https://support.huaweicloud.com/api-cc/DeleteCentralNetwork.html) | cc:centralNetwork:delete | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [PUT /v3/{domain_id}/gcn/central-networks/{central_network_id}](https://support.huaweicloud.com/api-cc/UpdateCentralNetwork.html) | cc:centralNetwork:update | - | | [GET /v3/{domain_id}/gcn/central-networks/{central_network_id}](https://support.huaweicloud.com/api-cc/ShowCentralNetwork.html) | cc:centralNetwork:get | - | | [GET /v3/{domain_id}/gcn/central-networks](https://support.huaweicloud.com/api-cc/ListCentralNetworks.html) | cc:centralNetwork:list | - | | [POST /v3/{domain_id}/gcn/central-networks/filter](https://support.huaweicloud.com/api-cc/ListCentralNetworksByTags.html) | cc:centralNetwork:list | - | | [POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/tag](https://support.huaweicloud.com/api-cc/TagCentralNetwork.html) | cc:centralNetwork:tag | - | | [POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/untag](https://support.huaweicloud.com/api-cc/UntagCentralNetwork.html) | cc:centralNetwork:unTag | - | | [GET /v3/{domain_id}/gcn/central-networks/tags](https://support.huaweicloud.com/api-cc/ListCentralNetworkTags.html) | cc:centralNetwork:listTags | - | | [POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies](https://support.huaweicloud.com/api-cc/CreateCentralNetworkPolicy.html) | cc:centralNetwork:createPolicy | - er:instances:get - er:routeTables:get | | [POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/apply](https://support.huaweicloud.com/api-cc/ApplyCentralNetworkPolicy.html) | cc:centralNetwork:applyPolicy | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}](https://support.huaweicloud.com/api-cc/DeleteCentralNetworkPolicy.html) | cc:centralNetwork:deletePolicy | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies](https://support.huaweicloud.com/api-cc/ListCentralNetworkPolicies.html) | cc:centralNetwork:listPolicies | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/change-set](https://support.huaweicloud.com/api-cc/ListCentralNetworkPolicyChangeSet.html) | cc:centralNetwork:listChangeSet | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/connections](https://support.huaweicloud.com/api-cc/ListCentralNetworkConnections.html) | cc:centralNetwork:listConnections | - | | [PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/connections/{connection_id}](https://support.huaweicloud.com/api-cc/UpdateCentralNetworkConnection.html) | cc:centralNetwork:updateConnection | - cc:gcbandwidth:get - cc:gcbandwidth:list - cc:gcbandwidth:associateInstance - cc:gcbandwidth:disassociateInstance - cc:gcbandwidths:update | | [POST /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments](https://support.huaweicloud.com/api-cc/CreateCentralNetworkGdgwAttachment.html) | cc:centralNetworkAttachment:createGdgw | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}](https://support.huaweicloud.com/api-cc/UpdateCentralNetworkGdgwAttachment.html) | cc:centralNetworkAttachment:updateGdgw | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}](https://support.huaweicloud.com/api-cc/ShowCentralNetworkGdgwAttachment.html) | cc:centralNetworkAttachment:getGdgw | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments](https://support.huaweicloud.com/api-cc/ListCentralNetworkGdgwAttachments.html) | cc:centralNetworkAttachment:listGdgws | - | | [POST /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments](https://support.huaweicloud.com/api-cc/CreateCentralNetworkErRouteTableAttachment.html) | cc:centralNetworkAttachment:createErRouteTable | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}](https://support.huaweicloud.com/api-cc/UpdateCentralNetworkErRouteTableAttachment.html) | cc:centralNetworkAttachment:updateErRouteTable | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}](https://support.huaweicloud.com/api-cc/ShowCentralNetworkErRouteTableAttachment.html) | cc:centralNetworkAttachment:getErRouteTable | - | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments](https://support.huaweicloud.com/api-cc/ListCentralNetworkErRouteTableAttachments.html) | cc:centralNetworkAttachment:listErRouteTables | - | | [DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments/{attachment_id}](https://support.huaweicloud.com/api-cc/DeleteCentralNetworkAttachment.html) | cc:centralNetworkAttachment:delete | - er:instances:get - er:routeTables:get - er:routeTables:listPropagations - er:routeTables:enablePropagation - er:routeTables:disablePropagation - er:routeTables:listAssociations - er:routeTables:associate - er:routeTables:disassociate | | [GET /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments](https://support.huaweicloud.com/api-cc/ListCentralNetworkAttachments.html) | cc:centralNetworkAttachment:list | - | | [POST /v3/{domain_id}/dcaas/p2p-site-networks](https://support.huaweicloud.com/api-cc/CreateP2PSiteNetwork.html) | cc:siteNetwork:createP2P | - | | [GET /v3/{domain_id}/dcaas/site-networks](https://support.huaweicloud.com/api-cc/ListSiteNetworks.html) | cc:siteNetwork:list | - | | [GET /v3/{domain_id}/dcaas/site-networks/{site_network_id}](https://support.huaweicloud.com/api-cc/ShowSiteNetwork.html) | cc:siteNetwork:get | - | | [PUT /v3/{domain_id}/dcaas/site-networks/{site_network_id}](https://support.huaweicloud.com/api-cc/UpdateSiteNetwork.html) | cc:siteNetwork:update | - | | [DELETE /v3/{domain_id}/dcaas/site-networks/{site_network_id}](https://support.huaweicloud.com/api-cc/DeleteSiteNetwork.html) | cc:siteNetwork:delete | - | | [POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/disassociate](https://support.huaweicloud.com/api-cc/DisassociateSiteNetworkBandwidth.html) | cc:siteNetwork:disassociateBandwidth | - | | [POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/associate](https://support.huaweicloud.com/api-cc/AssociateSiteNetworkBandwidth.html) | cc:siteNetwork:associateBandwidth | - | | [POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/update-bandwidth-size](https://support.huaweicloud.com/api-cc/UpdateSiteNetworkBandwidthSize.html) | cc:siteNetwork:updateBandwidthSize | - | | [POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/update-bandwidth](https://support.huaweicloud.com/api-cc/UpdateSiteNetworkBandwidth.html) | cc:siteNetwork:updateBandwidth | - | | [GET /v3/{domain_id}/dcaas/site-network/capabilities](https://support.huaweicloud.com/api-cc/ListSiteNetworkCapabilities.html) | cc:capability:list | - | | [GET /v3/{domain_id}/dcaas/site-network/quotas](https://support.huaweicloud.com/api-cc/ListSiteNetworkQuotas.html) | cc:quota:list | - | | [GET /v3/{domain_id}/gcb/gcbandwidths](https://support.huaweicloud.com/api-cc/ListGlobalConnectionBandwidths.html) | cc:gcbandwidth:list | - | | [GET /v3/{domain_id}/gcb/gcbandwidths/{id}](https://support.huaweicloud.com/api-cc/ShowGlobalConnectionBandwidth.html) | cc:gcbandwidth:get | - | | [POST /v3/{domain_id}/gcb/gcbandwidths](https://support.huaweicloud.com/api-cc/CreateGlobalConnectionBandwidth.html) | cc:gcbandwidth:create | - | | [PUT /v3/{domain_id}/gcb/gcbandwidths/{id}](https://support.huaweicloud.com/api-cc/UpdateGlobalConnectionBandwidth.html) | cc:gcbandwidth:update | - | | [DELETE /v3/{domain_id}/gcb/gcbandwidths/{id}](https://support.huaweicloud.com/api-cc/DeleteGlobalConnectionBandwidth.html) | cc:gcbandwidth:delete | - | | [POST /v3/{domain_id}/gcb/gcbandwidths/{id}/associate-instance](https://support.huaweicloud.com/api-cc/AssociateGlobalConnectionBandwidthInstance.html) | cc:gcbandwidth:associateInstance | - | | [POST /v3/{domain_id}/gcb/gcbandwidths/{id}/disassociate-instance](https://support.huaweicloud.com/api-cc/DisassociateGlobalConnectionBandwidthInstance.html) | cc:gcbandwidth:disassociateInstance | - | | [GET /v3/{domain_id}/gcb/gcbandwidths/support-bindings](https://support.huaweicloud.com/api-cc/ListSupportBindingConnectionBandwidths.html) | cc:gcbandwidth:listSupportBinding | - | | [POST /v3/gcb/resource-instances/filter](https://support.huaweicloud.com/api-cc/ListGcbResourceByTag.html) | cc:gcbandwidth:listTags | - | | [POST /v3/gcb/resource-instances/count](https://support.huaweicloud.com/api-cc/CountGcbResourceByTag.html) | cc:gcbandwidth:listTags | - | | [POST /v3/gcb/{resource_id}/tags/create](https://support.huaweicloud.com/api-cc/BatchCreateGcbResourceTags.html) | cc:gcbandwidth:tag | - | | [POST /v3/gcb/{resource_id}/tags](https://support.huaweicloud.com/api-cc/CreateGcbResourceTag.html) | cc:gcbandwidth:tag | - | | [POST /v3/gcb/{resource_id}/tags/delete](https://support.huaweicloud.com/api-cc/BatchDeleteGcbResourceTags.html) | cc:gcbandwidth:unTag | - | | [DELETE /v3/gcb/{resource_id}/tags/{tag_key}](https://support.huaweicloud.com/api-cc/DeleteGcbResourceTag.html) | cc:gcbandwidth:unTag | - | | [GET /v3/gcb/{resource_id}/tags](https://support.huaweicloud.com/api-cc/ListGcbResourceTags.html) | cc:gcbandwidth:listTags | - | | [GET /v3/gcb/tags](https://support.huaweicloud.com/api-cc/ListGcbTenantTags.html) | cc:gcbandwidth:listTags | - | #### 资源类型（Resource） 资源类型（Resource）用于定义身份策略生效的资源范围。如[表3]中某项操作已指定了对应的资源类型，则在包含该操作的身份策略语句中选择填写对应资源的URN时，身份策略仅对该指定资源生效；未填写对应资源的URN时，身份策略将对指定资源类型下所有资源生效；如未指定资源类型，Resource默认取值为"\*"，身份策略将作用于所有资源。此外，您也可在身份策略中设置条件，进一步精细化限定资源类型。 CC定义了以下可以在自定义身份策略的Resource元素中使用的资源类型。 表3CC支持的资源类型 | 资源类型 | URN | |:---|:---| | cloudConnection | cc::\:cloudConnection:\ | | gcbandwidth | cc::\:gcbandwidth:\ | | interRegionBandwidth | cc::\:interRegionBandwidth:\ | | cloudConnectionAttachment | cc::\:cloudConnectionAttachment:\/\ | | networkInstance | cc::\:networkInstance:\ | | siteNetwork | cc::\:siteNetwork:\ | | bandwidthPackage | cc::\:bandwidthPackage:\ | | cloudConnectionSegment | cc::\:cloudConnectionSegment:\/\ | | centralNetwork | cc::\:centralNetwork:\ | | centralNetworkAttachment | cc::\:centralNetworkAttachment:\ | #### 条件（Condition） **条件键概述** 条件（Condition）是身份策略生效的特定条件，包括[条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)和[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 - 条件键表示身份策略语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。 - 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：[全局条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)。 - 服务级条件键（前缀通常为服务缩写，如cc:）仅适用于对应服务的操作，详情请参见[表4]。 - 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。 - 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 **CC支持的服务级条件键** CC定义了以下可以在自定义身份策略的Condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。 表4CC支持的服务级条件键 | 服务级条件键 | 类型 | 单值/多值 | 说明 | |:---|:---|:---|:---| | [cc:VpcId] | string | 单值 | 根据指定的虚拟私有云资源ID过滤访问。 | | [cc:VirtualGatewayId] | string | 单值 | 根据指定的专线虚拟网络资源ID过滤访问。 | | [cc:EnterpriseRouterId] | string | 单值 | 根据指定的企业路由器资源ID过滤访问。 | | [cc:MultipleEnterpriseRouterIds] | string | 多值 | 根据指定的多个企业路由器资源ID过滤访问。 | | [cc:BandwidthPackageId] | string | 单值 | 根据指定的带宽包资源ID过滤访问。 | | [cc:GlobalConnectionBandwidthId] | string | 单值 | 根据指定的全域互联带宽资源ID过滤访问。 | | [cc:GlobalDcGatewayId] | string | 单值 | 根据指定的全域接入网关资源ID过滤访问。 | | [cc:gcbAssociateResourceType] | string | 单值 | 根据绑定的全球互联带宽资源资源类型过滤访问。 | **条件键示例** - cc:VpcId 示例：根据指定的虚拟私有云资源ID过滤访问网络实例的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:networkInstances:create", "cc:networkInstances:delete", "cc:networkInstances:update" ], "Condition": { "StringEquals": { "cc:VpcId": [ "xxx" ] } } } ] } ``` - cc:VirtualGatewayId 示例：根据指定的专线虚拟网络资源ID过滤访问网络实例的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:networkInstances:create", "cc:networkInstances:delete", "cc:networkInstances:update" ], "Condition": { "StringEquals": { "cc:VirtualGatewayId": [ "xxx" ] } } } ] } ``` - cc:EnterpriseRouterId 示例：根据指定的企业路由器资源ID过滤访问中心网络全域接入网关附件的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:centralNetworkAttachment:createGdgw", "cc:centralNetworkAttachment:updateGdgw", "cc:centralNetworkAttachment:getGdgw", "cc:centralNetworkAttachment:delete" ], "Condition": { "StringEquals": { "cc:EnterpriseRouterId": [ "xxx" ] } } } ] } ``` - cc:MultipleEnterpriseRouterIds 示例：根据指定的多个企业路由器资源ID过滤访问中心网络及中心网络路由表附件的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:centralNetwork:create", "cc:centralNetwork:createPolicy", "cc:centralNetworkAttachment:createErRouteTable", "cc:centralNetworkAttachment:updateErRouteTable", "cc:centralNetworkAttachment:getErRouteTable", "cc:centralNetworkAttachment:delete" ], "Condition": { "StringEquals": { "cc:MultipleEnterpriseRouterIds": [ "xxx" ] } } } ] } ``` - cc:BandwidthPackageId 示例：根据指定的带宽包资源ID过滤访问域间带宽实例的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:interRegionBandwidths:create", "cc:interRegionBandwidths:delete", "cc:interRegionBandwidths:update" ], "Condition": { "StringEquals": { "cc:BandwidthPackageId": [ "xxx" ] } } } ] } ``` - cc:GlobalConnectionBandwidthId 示例：根据指定的全域互联带宽资源ID过滤访问更新中心网络连接的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:centralNetwork:updateConnection" ], "Condition": { "StringEquals": { "cc:GlobalConnectionBandwidthId": [ "xxx" ] } } } ] } ``` - cc:GlobalDcGatewayId 示例：根据指定的全域接入网关资源ID过滤访问中心网络全域接入网关附件的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:centralNetworkAttachment:createGdgw", "cc:centralNetworkAttachment:updateGdgw", "cc:centralNetworkAttachment:getGdgw", "cc:centralNetworkAttachment:delete" ], "Condition": { "StringEquals": { "cc:GlobalDcGatewayId": [ "xxx" ] } } } ] } ``` - cc:gcbAssociateResourceType 示例：根据全球互联带宽资源资源类型过滤访问资源绑定或解绑骨干带宽的权限。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Allow", "Action": [ "cc:gcbandwidth:associateInstance", "cc:gcbandwidth:disassociateInstance", ], "Condition": { "StringEquals": { "cc:gcbAssociateResourceType": [ "xxx" ] } } } ] } ```