# 身份策略授权参考 云服务在IAM预置了常用的权限，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。 除IAM服务外，[Organizations](https://support.huaweicloud.com/productdesc-organizations/org_01_0011.html)服务中的[服务控制策略](https://support.huaweicloud.com/usermanual-organizations/org_03_0065.html)（Service Control Policy，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。 SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM身份策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。 IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：[IAM服务与Organizations服务权限访问控制的区别](https://support.huaweicloud.com/organizations_faq/org_06_0004.html)。 本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。 - 如何使用这些元素编辑IAM自定义身份策略，请参考[创建自定义身份策略](https://support.huaweicloud.com/usermanual-iam5/iam_01_0917.html)。 - 如何使用这些元素编辑SCP自定义策略，请参考[创建SCP](https://support.huaweicloud.com/usermanual-organizations/org_03_0035.html)。 #### 操作（Action） 操作（Action）即为身份策略中支持的授权项。 - "访问级别"列描述如何对操作进行分类（List、Read和Write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。 - "资源类型"列指每个操作是否支持资源级权限。 - 资源类型支持通配符号\*表示所有。如果此列没有值（-），则必须在身份策略语句的Resource元素中指定所有资源类型（"\*"）。 - 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。 - 资源类型列中必需资源在表中用星号（\*）标识，表示使用此操作必须指定该资源类型。 关于CSS定义的资源类型的详细信息请参见[资源类型（Resource）]。 - "条件键"列包括了可以在身份策略语句的Condition元素中支持指定的键值。 - 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。 - 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。 - 如果此列条件键没有值（-），表示此操作不支持指定条件键。 关于CSS定义的条件键的详细信息请参见[条件（Condition）]。 - "别名"列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见[身份策略兼容性说明](https://support.huaweicloud.com/iam5_faq/iam_01_1103.html)。 您可以在身份策略语句的Action元素中指定以下CSS的相关操作。 表1CSS支持的授权项 | 授权项 | 描述 | 访问级别 | 资源类型（\*为必须） | 条件键 | 别名 | |:---|:---|:---|:---|:---|:---| | css:VPCEndpoint:updateWhitelist | 授予权限更新已存在的终端节点白名单。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:updateBackupPolicy | 授予权限日志备份修改或删除。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:setSnapshotPolicy | 授予权限操作备份策略。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:getSnapshotPolicy | 授予权限查询备份策略。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:restore | 授予权限恢复快照。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:create | 授予权限创建快照。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicIPAddress:associates | 授予权限开启或关闭公网访问。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicIPAddress:setAccessControl | 授予权限对白名单列表进行操作。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:get | 授予权限查询资源标签。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicIPAddress:modifyBandwidth | 授予权限修改带宽大小。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:VPCEndpoint:enableOrDisable | 授予权限创建或删除VPCEP。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:getBasicConfigurations | 授予权限日志基础配置查询。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:list | 授予权限查看快照列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:list | 授予权限查看日志。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:setSnapshotContiguration | 授予权限设置快照基础配置。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listFlavors | 授予权限查询规格ID列表。 | List | - | - | - css:cluster:showFlavor | | css:cluster:listDiskType | 授予权限列举可用磁盘类型。 | List | - | - | - | | css:tag:list | 授予权限查询项目标签。 | List | cluster \* | - | - | | css:VPCEndpoint:manageConnection | 授予权限操作终端节点的连接。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:listJob | 授予权限查询作业列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:downloadCert | 授予权限获取证书内容。 | Read | - | - | - | | css:cluster:get | 授予权限查询集群详情。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - css:cluster:getInstance | | css:snapshot:enableAtomaticSnapsot | 授予权限设置快照自动备份的基础配置。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:delete | 授予权限删除指定快照。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:IKThesaurus:get | 授予权限查看自定义词库配置。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:restart | 授予权限重启ElasticSearch集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:modifySecurityGroup | 授予权限修改集群安全组。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:configurations:list | 授予权限查询获取参数配置的任务操作列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:delete | 授予权限删除集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:modifySpecifications | 授予权限修改集群规格。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:list | 授予权限列举集群信息。 | List | cluster \* | - | - css:cluster:getInstances | | css:cluster:scaleOut | 授予权限扩容集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:IKThesaurus:load | 授予权限加载自定义词库。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:configurations:modify | 授予权限更新参数配置。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:configurations:get | 授予权限列举参数配置列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:IKThesaurus:delete | 授予权限删除词库。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:expand | 授予权限扩容实例的数量和存储容量。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:snapshot:disableSnapshotFuction | 授予权限关闭集群快照功能。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:upgradeCluster | 授予权限升级集群或节点替换。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:VPCEndpoint:listConnection | 授予权限查询VPCEP的连接。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:scaleIn | 授予权限对集群缩容。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:setBasicConfigurations | 授予权限日志基础配置设置。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:addOrDelete | 授予权限批量添加删除资源标签。 | Tagging | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:addOrDelete | 授予权限批量添加删除资源标签。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicKibana:close | 授予权限关闭公网访问。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:edit | 授予权限修改集群标签。 | Tagging | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:edit | 授予权限修改集群标签。 | Tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:create | 授予权限创建集群。 | Write | cluster \* | - | - | | css:cluster:create | 授予权限创建集群。 | Write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:toPeriod | 授予权限对集群转包周期。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:modifyName | 授予权限修改集群名称。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:log:backup | 授予权限对日志备份。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:closeLogSetting | 授予权限关闭日志功能。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - css:log:enableOrDisableLogFunction | | css:cluster:connectivityTest | 授予权限连通性测试。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:openLogSetting | 授予权限开启日志功能。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - css:log:enableOrDisableLogFunction | | css:cluster:modifyPassword | 授予权限修改集群密码。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicIPAddress:disassociates | 授予权限解绑公网。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:publicKibana:open | 授予权限绑定公网。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:delete | 授予权限删除标签。 | Tagging | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:tag:delete | 授予权限删除标签。 | Tagging | - | [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:shrinkNodes | 授予权限指定节点缩容。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:changeMode | 授予权限修改安全模式。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:addIndependenceNodes | 授予权限添加独立master,client。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:rollingReboot | 授予权限滚动重启ElasticSearch集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - css:cluster:rollingRestart | | css:logstash:listActions | 授予权限查询操作记录。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:uploadCerts | 授予权限上传证书。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:deleteCerts | 授予权限删除证书。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listCerts | 授予权限查询证书列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - css:cluster:getCertsList | | css:cluster:getCertsDetail | 授予权限查询证书详情。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:deleteConfTemplate | 授予权限删除自定义模板。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:listConfigTemplate | 授予权限查询模板列表。 | List | - | - | - css:logstash:configListTemplate | | css:logstash:confStop | 授予权限停止或热停止pipeline迁移数据。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:checkConnection | 授予权限连通性测试。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:confDelete | 授予权限删除配置文件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:confStart | 授予权限启动或热启动pipeline迁移数据。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:getConfDetail | 授予权限用于查询配置文件内容。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:azmigrate | 授予权限进行可用区切换。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:confUpdate | 授予权限更新配置文件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:listPipelines | 授予权限查询pipeline列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:retryAction | 授予权限重试该任务或终止该任务的影响。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:listConfs | 授予权限查询配置文件列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:configFavorites | 授予权限添加到自定义模板。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listUpgradeCluster | 授予权限获取升级镜像ID及升级详情。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:submitConf | 授予权限创建配置文件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:list | 授予权限查询集群插件列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:getOperationRecords | 授予权限查询插件的操作记录。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:delete | 授予权限删除插件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:installOrUninstall | 授予权限安装或卸载插件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:upload | 授予权限上传插件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:plugin:getDefault | 授予权限查询默认插件。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getAgencies | 授予权限获取代理。 | Read | - | - | - | | css:cluster:modifyRoute | 授予权限修改集群路由。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getRoutes | 授予权限获取集群路由。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:actionList | 授予权限查询集群任务列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:createUserInfo | 授予权限查询创建用户信息。 | Write | cluster \* | - | - | | css:VPCEndpoint:modifyConnections | 授予权限修改连接大小。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:queryNeedDeleteInstances | 授予权限查询需要删除的节点。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:queryKey | 授予权限获得密钥。 | Read | - | - | - | | css:cluster:queryKeys | 授予权限获得密钥列表。 | List | - | - | - | | css:cluster:getPubliczonePice | 授予权限获取带宽价格。 | Read | cluster \* | - | - | | css:datastore:get | 授予权限获取数据引擎。 | Read | cluster \* | - | - | | css:datastore:list | 授予权限获取数据引擎列表。 | List | cluster \* | - | - | | css:publicIPAddress:enableOrDisableIPv6Function | 授予权限开启或关闭ipv6。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getDiskUsage | 授予权限获取集群存储容量状态。 | Read | cluster \* | - | - | | css:snapshot:showDetail | 授予权限获得快照详情。 | Read | cluster \* | - | - | | css:cluster:getAvailableBuckets | 授予权限获取可用OBS桶。 | List | - | - | - | | css:cluster:checkCssName | 授予权限检查集群名称。 | Write | cluster \* | - | - | | css:snapshot:deleteAllFailedTask | 授予权限删除所有的失败任务。 | Write | - | - | - | | css:snapshot:deleteSingleFailedTask | 授予权限删除指定失败任务。 | Write | - | - | - | | css:snapshot:getAllFailedTask | 授予权限查看备份失败任务。 | List | - | - | - | | css::createServiceAgency | 授予权限创建委托。 | Write | - | - | css:cluster:createServiceAgency | | css:cluster:createAiOps | 授予权限创建检测任务。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listAiOps | 授予权限获取检测任务列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:deleteAiOps | 授予权限删除检测任务。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listSmnTopics | 授予权限获取SMN主题列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listElbs | 授予权限获取当前集群可用的负载均衡器列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:elbSwitch | 授予权限打开或关闭负载均衡功能。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:createElbListener | 授予权限为当前集群创建监听器。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:updateElbListener | 授予权限修改当前集群的监听器。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getElbDetail | 授予权限查询当前集群使用的负载均衡器信息。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:listElbCerts | 授予权限获取负载均衡器证书列表。 | List | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:changeSubnet | 授予权限修改当前集群的子网。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getAccessPolicy | 授予权限获取当前集群的访问控制策略。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:updateAccessPolicy | 授予权限修改当前集群的访问控制策略。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:updateAiOpsSetting | 授予权限更新智能运维定时检测设置。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:closeAiOpsSetting | 授予权限关闭智能运维定时检测。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:showAiOpsSetting | 授予权限查看智能运维定时检测设置。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:showAiOpsDetector | 授予权限查看智能运维检测项。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:create | 授予权限创建集群。 | Write | cluster \* | - | - | | css:cluster:restart | 授予权限重启ElasticSearch集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:rollingReboot | 授予权限滚动重启ElasticSearch集群。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | css:cluster:rollingRestart | | css:snapshot:setSnapshotPolicy | 授予权限操作备份策略。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:confDelete | 授予权限删除配置文件。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:logstash:deleteConfTemplate | 授予权限删除自定义模板。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:getAccessPolicy | 授予权限获取当前集群的访问控制策略。 | Read | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | css:cluster:updateAccessPolicy | 授予权限修改当前集群的访问控制策略。 | Write | cluster \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | CSS的API通常对应着一个或多个授权项。[表2]展示了API与授权项的关系，以及该API需要依赖的授权项。 表2API与授权项的关系 | API | 对应的授权项 | 依赖的授权项 | |:---|:---|:---| | [POST /v1.0/{project_id}/clusters](https://support.huaweicloud.com/api-css/CreateCluster.html) | css:cluster:create | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:securityGroups:list - vpc:securityGroups:get - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get - sfsturbo:shares:getAllShares - kms:cmk:listGrants - kms:cmk:createGrant - kms:cmk:list - kms:cmk:get - css:cluster:getAgencies - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v2.0/{project_id}/clusters](https://support.huaweicloud.com/api-css/CreateClusterMultiRole.html) | css:cluster:create | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:securityGroups:list - vpc:securityGroups:get - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get - kms:cmk:listGrants - kms:cmk:createGrant - kms:cmk:list - kms:cmk:get - css:cluster:getAgencies - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/sg/change](https://support.huaweicloud.com/api-css/ChangeSecurityGroup.html) | css:cluster:modifySecurityGroup | - vpc:securityGroups:list - vpc:ports:update | | [GET /v1.0/{project_id}/clusters](https://support.huaweicloud.com/api-css/ListClustersDetails.html) | css:cluster:list | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}](https://support.huaweicloud.com/api-css/ShowClusterDetail.html) | css:cluster:get | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}](https://support.huaweicloud.com/api-css/DeleteCluster.html) | css:cluster:delete | - | | [POST /v1.0/{project_id}/cluster/{cluster_id}/period](https://support.huaweicloud.com/api-css/UpdateOndemandClusterToPeriod.html) | css:cluster:toPeriod | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/changename](https://support.huaweicloud.com/api-css/UpdateClusterName.html) | css:cluster:modifyName | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/password/reset](https://support.huaweicloud.com/api-css/ResetPassword.html) | css:cluster:modifyPassword | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/restart](https://support.huaweicloud.com/api-css/RestartCluster.html) | css:cluster:restart | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/restart](https://support.huaweicloud.com/api-css/RestartClusterMultiRole.html) | css:cluster:restart | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/reboot](https://support.huaweicloud.com/api-css/RebootCluster.html) | css:cluster:restart | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/extend](https://support.huaweicloud.com/api-css/UpdateExtendCluster.html) | css:cluster:scaleOut | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get - kms:cmk:get | | [POST /v1.0/{project_id}/clusters/{cluster_id}/role_extend](https://support.huaweicloud.com/api-css/UpdateExtendInstanceStorage.html) | css:cluster:expand | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get - kms:cmk:get | | [POST /v1.0/{project_id}/clusters/{cluster_id}/flavor](https://support.huaweicloud.com/api-css/UpdateFlavor.html) | css:cluster:modifySpecifications | - ecs:cloudServerFlavors:get - kms:cmk:get | | [GET /v1.0/{project_id}/es-flavors](https://support.huaweicloud.com/api-css/ListFlavors.html) | css:cluster:listFlavors | ecs:cloudServerFlavors:get | | [GET /v1.0/{project_id}/{resource_type}/tags](https://support.huaweicloud.com/api-css/ListClustersTags.html) | css:tag:list | - | | [GET /v1.0/{project_id}/{resource_type}/{cluster_id}/tags](https://support.huaweicloud.com/api-css/ShowClusterTag.html) | css:tag:get | - | | [POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags](https://support.huaweicloud.com/api-css/CreateClustersTags.html) | css:tag:edit | - | | [DELETE /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/{key}](https://support.huaweicloud.com/api-css/DeleteClustersTags.html) | css:tag:delete | - | | [POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/action](https://support.huaweicloud.com/api-css/UpdateBatchClustersTags.html) | css:tag:addOrDelete | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/{types}/flavor](https://support.huaweicloud.com/api-css/UpdateFlavorByType.html) | css:cluster:modifySpecifications | - ecs:cloudServerFlavors:get - kms:cmk:get | | [POST /v1.0/extend/{project_id}/clusters/{cluster_id}/role/shrink](https://support.huaweicloud.com/api-css/UpdateShrinkCluster.html) | css:cluster:scaleIn | - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject | | [GET /v1.0/{project_id}/cer/download](https://support.huaweicloud.com/api-css/DownloadCert.html) | css:cluster:downloadCert | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/instance/{instance_id}/replace](https://support.huaweicloud.com/api-css/UpdateInstance.html) | css:cluster:upgradeCluster | - ecs:cloudServerFlavors:get - evs:types:get - kms:cmk:get - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/node/offline](https://support.huaweicloud.com/api-css/UpdateShrinkNodes.html) | css:cluster:shrinkNodes | - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/mode/change](https://support.huaweicloud.com/api-css/ChangeMode.html) | css:cluster:changeMode | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/type/{type}/independent](https://support.huaweicloud.com/api-css/AddIndependentNode.html) | css:cluster:addIndependenceNodes | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get | | [POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/image/upgrade](https://support.huaweicloud.com/api-css/UpgradeCore.html) | css:cluster:upgradeCluster | - ecs:cloudServerFlavors:get - evs:types:get - kms:cmk:get - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/azmigrate](https://support.huaweicloud.com/api-css/UpdateAzByInstanceType.html) | css:cluster:azmigrate | - ecs:cloudServerFlavors:get - evs:types:get - kms:cmk:get - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [GET /v1.0/{project_id}/clusters/{cluster_id}/upgrade/detail](https://support.huaweicloud.com/api-css/UpgradeDetail.html) | css:cluster:listUpgradeCluster | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/target/{upgrade_type}/images](https://support.huaweicloud.com/api-css/ListImages.html) | css:cluster:listUpgradeCluster | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/upgrade/{action_id}/retry](https://support.huaweicloud.com/api-css/RetryUpgradeTask.html) | css:cluster:retryAction | - ecs:cloudServerFlavors:get - evs:types:get | | [GET /v1.0/{project_id}/disktypes](https://support.huaweicloud.com/api-css/ListDiskType.html) | css:cluster:listDiskType | evs:types:get | | [POST /v1.0/{project_id}/clusters/{cluster_id}/thesaurus](https://support.huaweicloud.com/api-css/CreateLoadIkThesaurus.html) | css:IKThesaurus:load | - obs:bucket:listAllMyBuckets - obs:bucket:getBucketLocation - obs:bucket:getBucketStoragePolicy - obs:object:getObject | | [GET /v1.0/{project_id}/clusters/{cluster_id}/thesaurus](https://support.huaweicloud.com/api-css/ShowIkThesaurus.html) | css:IKThesaurus:get | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/thesaurus](https://support.huaweicloud.com/api-css/DeleteIkThesaurus.html) | css:IKThesaurus:delete | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/open](https://support.huaweicloud.com/api-css/StartKibanaPublic.html) | css:publicKibana:open | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/close](https://support.huaweicloud.com/api-css/UpdateCloseKibana.html) | css:publicKibana:close | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/bandwidth](https://support.huaweicloud.com/api-css/UpdateAlterKibana.html) | css:publicIPAddress:modifyBandwidth | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/update](https://support.huaweicloud.com/api-css/UpdatePublicKibanaWhitelist.html) | css:publicIPAddress:setAccessControl | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/close](https://support.huaweicloud.com/api-css/StopPublicKibanaWhitelist.html) | css:publicIPAddress:setAccessControl | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/open](https://support.huaweicloud.com/api-css/StartLogs.html) | css:cluster:openLogSetting | - iam:agencies:pass - obs:bucket:listAllMyBuckets - obs:bucket:getBucketLocation - obs:bucket:getBucketStoragePolicy - iam:agencies:listAgencies | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/close](https://support.huaweicloud.com/api-css/StopLogs.html) | css:cluster:closeLogSetting | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/logs/records](https://support.huaweicloud.com/api-css/ListLogsJob.html) | css:log:listJob | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/logs/settings](https://support.huaweicloud.com/api-css/ShowGetLogSetting.html) | css:log:getBasicConfigurations | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/settings](https://support.huaweicloud.com/api-css/UpdateLogSetting.html) | css:log:setBasicConfigurations | - obs:bucket:listAllMyBuckets - obs:bucket:getBucketLocation - obs:bucket:getBucketStoragePolicy - iam:agencies:listAgencies - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/update](https://support.huaweicloud.com/api-css/StartLogAutoBackupPolicy.html) | css:log:updateBackupPolicy | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/close](https://support.huaweicloud.com/api-css/StopLogAutoBackupPolicy.html) | css:log:updateBackupPolicy | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/collect](https://support.huaweicloud.com/api-css/CreateLogBackup.html) | css:log:backup | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/search](https://support.huaweicloud.com/api-css/ShowLogBackup.html) | css:log:list | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/logs/connectivity](https://support.huaweicloud.com/api-css/StartTargetClusterConnectivityTest.html) | css:cluster:connectivityTest | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/public/open](https://support.huaweicloud.com/api-css/CreateBindPublic.html) | css:publicIPAddress:associates | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/public/close](https://support.huaweicloud.com/api-css/UpdateUnbindPublic.html) | css:publicIPAddress:disassociates | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/public/bandwidth](https://support.huaweicloud.com/api-css/UpdatePublicBandWidth.html) | css:publicIPAddress:modifyBandwidth | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/update](https://support.huaweicloud.com/api-css/StartPublicWhitelist.html) | css:publicIPAddress:setAccessControl | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/close](https://support.huaweicloud.com/api-css/StopPublicWhitelist.html) | css:publicIPAddress:setAccessControl | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/auto_setting](https://support.huaweicloud.com/api-css/StartAutoSetting.html) | css:snapshot:enableAtomaticSnapsot | - obs:bucket:createBucket - obs:bucket:headBucket - iam:agencies:listAgencies - iam:agencies:createAgency - iam:permissions:grantRoleToAgency | | [POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/setting](https://support.huaweicloud.com/api-css/UpdateSnapshotSetting.html) | css:snapshot:setSnapshotContiguration | - obs:bucket:listAllMyBuckets - obs:bucket:getBucketLocation - obs:bucket:getBucketStoragePolicy - iam:agencies:listAgencies - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot](https://support.huaweicloud.com/api-css/CreateSnapshot.html) | css:snapshot:create | iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}/restore](https://support.huaweicloud.com/api-css/RestoreSnapshot.html) | css:snapshot:restore | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}](https://support.huaweicloud.com/api-css/DeleteSnapshot.html) | css:snapshot:delete | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy](https://support.huaweicloud.com/api-css/CreateAutoCreatePolicy.html) | css:snapshot:setSnapshotPolicy | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy](https://support.huaweicloud.com/api-css/ShowAutoCreatePolicy.html) | css:snapshot:getSnapshotPolicy | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots](https://support.huaweicloud.com/api-css/ListSnapshots.html) | css:snapshot:list | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots](https://support.huaweicloud.com/api-css/StopSnapshot.html) | css:snapshot:disableSnapshotFuction | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/open](https://support.huaweicloud.com/api-css/StartVpcep.html) | css:VPCEndpoint:enableOrDisable | - vpcep:endpoints:create - vpcep:endpoints:list - vpcep:endpoints:get - vpcep:endpoints:delete - vpcep:endpoints:update | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/close](https://support.huaweicloud.com/api-css/StopVpcep.html) | css:VPCEndpoint:enableOrDisable | - vpcep::listQuotas - vpcep:endpoints:create - vpcep:endpoints:list - vpcep:endpoints:get - vpcep:endpoints:delete - vpcep:endpoints:update | | [GET /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections](https://support.huaweicloud.com/api-css/ShowVpcepConnection.html) | css:VPCEndpoint:listConnection | vpcep:endpoints:get | | [POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections](https://support.huaweicloud.com/api-css/UpdateVpcepConnection.html) | css:VPCEndpoint:manageConnection | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/permissions](https://support.huaweicloud.com/api-css/UpdateVpcepWhitelist.html) | css:VPCEndpoint:updateWhitelist | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/ymls/update](https://support.huaweicloud.com/api-css/UpdateYmls.html) | css:configurations:modify | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/joblists](https://support.huaweicloud.com/api-css/ListYmlsJob.html) | css:configurations:list | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/template](https://support.huaweicloud.com/api-css/ListYmls.html) | css:configurations:get | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/open](https://support.huaweicloud.com/api-css/StartAutoCreateSnapshots.html) | css:snapshot:setSnapshotPolicy | - | | [PUT /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/close](https://support.huaweicloud.com/api-css/StopAutoCreateSnapshots.html) | css:snapshot:setSnapshotPolicy | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/rolling_restart](https://support.huaweicloud.com/api-css/RollingRestart.html) | css:cluster:rollingReboot | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listactions](https://support.huaweicloud.com/api-css/ListActions.html) | css:logstash:listActions | - | | [DELETE /v1.0/{project_id}/lgsconf/deletetemplate](https://support.huaweicloud.com/api-css/DeleteTemplate.html) | css:logstash:deleteConfTemplate | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/stop](https://support.huaweicloud.com/api-css/StopPipeline.html) | css:logstash:confStop | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-stop](https://support.huaweicloud.com/api-css/StopHotPipeline.html) | css:logstash:confStop | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/checkconnection](https://support.huaweicloud.com/api-css/StartConnectivityTest.html) | css:logstash:checkConnection | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/delete](https://support.huaweicloud.com/api-css/DeleteConf.html) | css:logstash:confDelete | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/start](https://support.huaweicloud.com/api-css/StartPipeline.html) | css:logstash:confStart | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-start](https://support.huaweicloud.com/api-css/StartHotPipeline.html) | css:logstash:confStart | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/confdetail](https://support.huaweicloud.com/api-css/ShowGetConfDetail.html) | css:logstash:getConfDetail | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/update](https://support.huaweicloud.com/api-css/UpdateConf.html) | css:logstash:confUpdate | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listpipelines](https://support.huaweicloud.com/api-css/ListPipelines.html) | css:logstash:listPipelines | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/submit](https://support.huaweicloud.com/api-css/CreateConf.html) | css:logstash:submitConf | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/favorite](https://support.huaweicloud.com/api-css/AddFavorite.html) | css:logstash:configFavorites | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listconfs](https://support.huaweicloud.com/api-css/ListConfs.html) | css:logstash:listConfs | - | | [GET /v1.0/{project_id}/lgsconf/template](https://support.huaweicloud.com/api-css/ListTemplates.html) | css:logstash:listConfigTemplate | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/certs/upload](https://support.huaweicloud.com/api-css/UploadCerts.html) | css:cluster:uploadCerts | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}/delete](https://support.huaweicloud.com/api-css/DeleteCerts.html) | css:cluster:deleteCerts | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/certs](https://support.huaweicloud.com/api-css/ListCerts.html) | css:cluster:listCerts | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}](https://support.huaweicloud.com/api-css/ShowCertsDetail.html) | css:cluster:getCertsDetail | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/route](https://support.huaweicloud.com/api-css/UpdateRoute.html) | css:cluster:modifyRoute | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/route](https://support.huaweicloud.com/api-css/GetRoutes.html) | css:cluster:getRoutes | - | | [POST /v1.0/{project_id}/agency/create](https://support.huaweicloud.com/api-css/CreateAgency.html) | css::createServiceAgency | - iam:agencies:listAgencies - iam:agencies:createAgency - iam:agencies:getAgency - iam:roles:listRoles - iam:roles:createRole - iam:permissions:grantRoleToAgency - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:permissions:revokeRoleFromAgency - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/ai-ops](https://support.huaweicloud.com/api-css/CreateAiOps.html) | css:cluster:createAiOps | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops](https://support.huaweicloud.com/api-css/ListAiOps.html) | css:cluster:listAiOps | - | | [DELETE /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/{aiops_id}](https://support.huaweicloud.com/api-css/DeleteAiOps.html) | css:cluster:deleteAiOps | - | | [GET /v1.0/{project_id}/domains/{domain_id}/ai-ops/smn-topics](https://support.huaweicloud.com/api-css/ListSmnTopics.html) | css:cluster:listSmnTopics | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers](https://support.huaweicloud.com/api-css/ListElbs.html) | css:cluster:listElbs | elb:loadbalancers:list | | [POST /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers/es-switch](https://support.huaweicloud.com/api-css/EnableOrDisableElb.html) | css:cluster:elbSwitch | - elb:loadbalancers:list - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v1.0/{project_id}/clusters/{cluster_id}/es-listeners](https://support.huaweicloud.com/api-css/CreateElbListener.html) | css:cluster:createElbListener | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/es-listeners](https://support.huaweicloud.com/api-css/ShowElbDetail.html) | css:cluster:getElbDetail | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/elb/certificates](https://support.huaweicloud.com/api-css/ListElbCerts.html) | css:cluster:listElbCerts | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/subnet/change](https://support.huaweicloud.com/api-css/ChangeClusterSubnet.html) | css:cluster:changeSubnet | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/volume](https://support.huaweicloud.com/api-css/ShowClusterVolumeUsage.html) | css:cluster:getDiskUsage | - | | [GET /v1.0/{project_id}/resize-flavors](https://support.huaweicloud.com/api-css/ShowResizeFlavors.html) | css:cluster:listFlavors | - | | [GET /v1.0/{project_id}/flavors/{flavor_id}](https://support.huaweicloud.com/api-css/ShowFlavorDetail.html) | css:cluster:listFlavors | - | | [GET /v1.0/{project_id}/datastore/{datastore_id}/flavors](https://support.huaweicloud.com/api-css/ShowDataStoreFlavorDetail.html) | css:cluster:listFlavors | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/detector](https://support.huaweicloud.com/api-css/ShowAiOpsDetector.html) | css:cluster:showAiOpsDetector | - | | [GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/setting](https://support.huaweicloud.com/api-css/ShowAiOpsSetting.html) | css:cluster:showAiOpsSetting | - | | [POST /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/setting](https://support.huaweicloud.com/api-css/UpdateAiOpsSetting.html) | css:cluster:updateAiOpsSetting | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/close](https://support.huaweicloud.com/api-css/CloseAiOpsSetting.html) | css:cluster:closeAiOpsSetting | - | | [POST /v2.0/{project_id}/clusters](https://support.huaweicloud.com/api-css/CreateClusterMultiRole.html) | css:cluster:create | - ecs:cloudServerFlavors:get - evs:types:get - vpc:vpcs:list - vpc:securityGroups:list - vpc:securityGroups:get - vpc:subnets:list - vpc:subnets:get - vpc:ports:create - vpc:ports:update - vpc:ports:delete - vpc:ports:get - kms:cmk:listGrants - kms:cmk:createGrant - kms:cmk:list - kms:cmk:get - css:cluster:getAgencies - iam:agencies:listAgencies - iam:permissions:listRolesForAgency - iam:permissions:listRolesForAgencyOnProject - iam:agencies:pass | | [POST /v2.0/{project_id}/clusters/{cluster_id}/restart](https://support.huaweicloud.com/api-css/RestartClusterMultiRole.html) | css:cluster:restart | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/rolling-restart](https://support.huaweicloud.com/api-css/RollingRestartV2.html) | css:cluster:rollingReboot | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/rolling_restart](https://support.huaweicloud.com/api-css/RollingRestart.html) | css:cluster:rollingReboot | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/open](https://support.huaweicloud.com/api-css/StartAutoCreateSnapshots.html) | css:snapshot:setSnapshotPolicy | - | | [PUT /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/close](https://support.huaweicloud.com/api-css/StopAutoCreateSnapshots.html) | css:snapshot:setSnapshotPolicy | - | | [POST /v2.0/{project_id}/clusters/{cluster_id}/lgsconf/delete](https://support.huaweicloud.com/api-css/DeleteLogstashConf.html) | css:logstash:confDelete | - | | [POST /v2.0/{project_id}/lgsconf/deletetemplate](https://support.huaweicloud.com/api-css/DeleteLogstashTemplate.html) | css:logstash:deleteConfTemplate | - | | [PUT /v1.0/{project_id}/clusters/{cluster_id}/es-listeners/{listener_id}](https://support.huaweicloud.com/api-css/UpdateESListener.html) | css:cluster:updateElbListener | - | #### 资源类型（Resource） 资源类型（Resource）用于定义身份策略生效的资源范围。如[表3]中某项操作已指定了对应的资源类型，则在包含该操作的身份策略语句中选择填写对应资源的URN时，身份策略仅对该指定资源生效；未填写对应资源的URN时，身份策略将对指定资源类型下所有资源生效；如未指定资源类型，Resource默认取值为"\*"，身份策略将作用于所有资源。此外，您也可在身份策略中设置条件，进一步精细化限定资源类型。 CSS定义了以下可以在自定义身份策略的Resource元素中使用的资源类型。 表3CSS支持的资源类型 | 资源类型 | URN | |:---|:---| | cluster | css:\:\:cluster:\ | #### 条件（Condition） **条件键概述** 条件（Condition）是身份策略生效的特定条件，包括[条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)和[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 - 条件键表示身份策略语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。 - 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：[全局条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)。 - 服务级条件键（前缀通常为服务缩写，如css:）仅适用于对应服务的操作，详情请参见[表4]。 - 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。 - 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 **CSS支持的服务级条件键** CSS定义了以下可以在自定义身份策略的Condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。 表4CSS支持的服务级条件键 | 服务级条件键 | 类型 | 单值/多值 | 说明 | |:---|:---|:---|:---| | [css:AssociatePublicIp] | boolean | 单值 | 根据实例是否开启公网访问筛选访问权限。 | **条件键示例** - css:AssociatePublicIp 示例：禁止创建带EIP的CSS集群 ``` { "Version": "5.0", "Statement": [ { "Effect": "Deny", "Action": [ "css:cluster:create" ], "Condition": { "Bool": { "css:AssociatePublicIp": [ "true" ] } } } ] } ``` 示例：禁止给CSS集群绑定EIP ``` { "Version": "5.0", "Statement": [ { "Effect": "Deny", "Action": [ "css:publicIPAddress:associates", "css:publicKibana:open" ] } ] } ```