# 策略授权参考
本章节介绍DCS策略授权场景下支持的策略授权项。
#### 支持的授权项
策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：
- 权限：允许或拒绝对指定资源在特定条件下进行某项操作。
- 对应API接口：自定义策略实际调用的API接口。
- 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
- 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
- IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。
DCS的支持自定义策略授权项如下所示：
表1DCS策略授权项明细 
| 权限             | 对应API接口                                                                 | 授权项（Action）                      | IAM项目(Project) | 企业项目(Enterprise Project) |
|:---|:---|:---|:---|:---|
| 查询实例升级信息       | -                                                                       | dcs:instance:getUpgradeInfo         | √                | √                        |
| 查询实例后台任务         | GET /v2/{project_id}/instances/{instance_id}/tasks                      | dcs:instance:getBackgroundTask      | √                 | √                         |
| 查询迁移任务详情       | GET /v2/{project_id}/migration-task/{task_id}                            | dcs:migrationTask:get             | √                | X                          |
| 查看实例审计日志       | -                                                                      | dcs:auditlog:get                   | √               | √                         |
| 查询实例配置参数      | GET /v2/{project_id}/instances/{instance_id}/configs                    | dcs:instance:getConfiguration      | √               | √                          |
| 查询参数模板           | GET /v2/{project_id}/config-templates/{template_id}                     | dcs:template:get                     | √              | X                           |
| 查询参数模板列表        | GET /v2/{project_id}/config-templates                                   | dcs:template:list                    | √              | X                          |
| 查询实例数据恢复日志     | GET /v2/{project_id}/instances/{instance_id}/restores                   | dcs:instance:getDataRestoreLog    | √               | √                         |
| 查询缓存实例信息        | GET /v2/{project_id}/instances/{instance_id}                           | dcs:instance:get                   | √               | √                        |
| 查询实例数据备份日志    | GET /v2/{project_id}/instances/{instance_id}/backups                   | dcs:instance:getDataBackupLog      | √              | √                          |
| 创建缓存实例          | POST /v2/{project_id}/instances                                        | dcs:instance:create                  | √                | √                          |
| 诊断实例            | POST /v2/{project_id}/instances/{instance_id}/diagnosis                  | dcs:instance:diagnosis            | √              | √                          |
| 创建实例访问账号       | POST /v2/{project_id}/instances/{instance_id}/accounts                   | dcs:aclaccount:create               | √             | √                          |
| 删除实例数据备份文件        | DELETE /v2/{project_id}/instances/{instance_id}/backups/{backup_id}    | dcs:instance:deleteDataBackupFile     | √                 | √                           |
| 查询任务进度          | -                                                                      | dcs:job:get                       | √               | X                          |
| 缓存实例扩容         | POST /v2/{project_id}/instances/{instance_id}/resize                   | dcs:instance:scale                    | √                | √                         |
| 升级实例版本         | -                                                                      | dcs:instance:upgrade                  | √                | √                         |
| 查询Redis会话列表       | GET /v2/{project_id}/instances/{instance_id}/clients                    | dcs:clients:list                   | √             | √                            |
| 实例交换IP后回滚        | -                                                                       | dcs:migrationTask:rollbackIp        | √                | X                          |
| Kill Redis会话    | POST /v2/{project_id}/instances/{instance_id}/clients/kill              | dcs:clients:kill                    | √              | √                         |
| 备份实例数据         | POST /v2/{project_id}/instances/{instance_id}/backups                   | dcs:instance:backupData             | √               | √                          |
| 释放历史域名解析        | -                                                                     | dcs:histroydomainname:release       | √             | √                          |
| 开启或关闭公网域名解析     | -                                                                       | dcs:publicdomainname:update            | √                | √                          |
| 修改实例配置参数       | PUT /v2/{project_id}/instances/{instance_id}/configs                   | dcs:instance:modifyConfigureation | √            | √                        |
| 修改实例SSL信息       | -                                                                        | dcs:ssl:modify                     | √              | √                          |
| 删除实例访问账号        | DELETE /v2/{project_id}/instances/{instance_id}/accounts/{account_id}   | dcs:aclaccount:delete             | √               | √                          |
| 修改缓存实例         | PUT /v2/{project_id}/instances/{instance_id}                            | dcs:instance:modify                | √              | √                           |
| 删除缓存实例            | DELETE /v2/{project_id}/instances/{instance_id}                          | dcs:instance:delete                 | √              | √                          |
| 实例主备倒换         | POST /v2/{project_id}/instances/{instance_id}/swap                     | dcs:instance:swap                   | √               | √                          |
| 修改实例访问密码       | PUT /v2/{project_id}/instances/{instance_id}/password                    | dcs:instance:modifyAuthInfo      | √             | √                         |
| 修改迁移任务配置或停止迁移任务 | POST /v2/{project_id}/migration-task/{task_id}/stop                   | dcs:migrationTask:modify          | √              | X                         |
| 重建域名解析          | -                                                                       | dcs:domainname:rebuild             | √             | √                         |
| 创建迁移任务         | POST /v2/{project_id}/migration-task                                    | dcs:migrationTask:create            | √               | X                         |
| 修改实例访问账号信息       | PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}      | dcs:aclaccount:modify              | √               | √                          |
| 开启或关闭实例审计日志      | -                                                                      | dcs:auditlog:modify               | √              | √                          |
| Web CLI        | POST /v2/{project_id}/instances/{instance_id}/webcli/auth               | dcs:instance:webcli                 | √               | √                          |
| 删除迁移任务        | DELETE /v2/{project_id}/migration-tasks/delete                          | dcs:migrationTask:delete            | √              | X                        |
| 开启或关闭客户端ip透传  | PUT /v2/{project_id}/{instance_id}/client-ip-transparent-transmission | dcs:clientiptrans:modify            | √             | √                         |
| 删除参数模板          | DELETE /v2/{project_id}/config-templates/{template_id}                  | dcs:template:delete                | √            | X                        |
| 修改参数模板          | PUT /v2/{project_id}/config-templates/{template_id}                     | dcs:template:modify                | √               | X                           |
| 实例间交换IP地址      | POST /v2/{project_id}/migration-task/{task_id}/exchange-ip            | dcs:migrationTask:exchangeIp        | √              | X                           |
| 下载备份实例数据       | POST /v2/{project_id}/instances/{instance_id}/backups/{backup_id}/links | dcs:instance:downloadBackupData    | √             | √                        |
| 分析实例的大key或者热key  | GET /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}    | dcs:instance:analyze                 | √               | √                         |
| 恢复实例数据         | POST /v2/{project_id}/instances/{instance_id}/restores                 | dcs:instance:restoreData          | √               | √                         |
| 删除实例后台任务        | DELETE /v2/{project_id}/instances/{instance_id}/tasks/{task_id}         | dcs:instance:deleteBackgroundTask | √              | √                          |
| 重置实例访问密码       | POST /v2/{project_id}/instances/{instance_id}/password/reset           | dcs:instance:resetAuthInfo          | √               | √                          |
| 创建参数模板         | POST /v2/{project_id}/config-templates                                | dcs:template:create                  | √              | X                         |
| 修改实例运行状态（启停）   | PUT /v2/{project_id}/instances/status                                    | dcs:instance:modifyStatus         | √              | √                         |
| 修改实例白名单信息    | PUT /v2/{project_id}/instance/{instance_id}/whitelist                    | dcs:whitelist:modify               | √            | √                       |
| 获取实例白名单列表        | GET /v2/{project_id}/instance/{instance_id}/whitelist                   | dcs:whitelist:list                 | √               | √                         |
| 查询慢日志列表        | GET /v2/{project_id}/instances/{instance_id}/slowlog                    | dcs:slowlog:list                  | √                | √                           |
| 获取实例访问账号列表     | GET /v2/{project_id}/instances/{instance_id}/accounts                   | dcs:aclaccount:list                 | √            | √                        |
| 查询实例列表          | GET /v2/{project_id}/instances                                         | dcs:instance:list                  | √             | √                         |
| 查询迁移任务列表        | GET /v2/{project_id}/migration-tasks                                    | dcs:migrationTask:list              | √             | X                        |
| 查询实例标签        | GET /v2/{project_id}/instances/{instance_id}/tags                      | dcs:tag:get                       | √               | X                         |
| 修改实例标签        | POST /v2/{project_id}/dcs/{instance_id}/tags/action                    | dcs:tag:modify                     | √              | √                            |
| 查询实例SSL信息       | -                                                                      | dcs:ssl:get                        | √             | X                         |