文档首页/ 设备接入 IoTDA/ API参考/ 应用侧API参考/ API/ 设备策略管理/ 创建设备策略

更新时间：2024-10-23 GMT+08:00

在线调试

CLI示例

查看PDF

创建设备策略

功能介绍

应用服务器可调用此接口在物联网平台创建一个策略，该策略需要绑定到设备和产品下才能生效。

一个实例最多能创建50个设备策略。
仅标准版实例、企业版实例支持该接口调用，基础版不支持。

调用方法

请参见如何调用API。

URI

POST /v5/iot/{project_id}/device-policies

表1 路径参数
参数	是否必选	参数类型	描述
project_id	是	String	参数说明：项目ID。获取方法请参见获取项目ID 。

请求参数

表2 请求Header参数
参数	是否必选	参数类型	描述
X-Auth-Token	否	String	参数说明：用户Token。通过调用IAM服务获取IAM用户Token接口获取，接口返回的响应消息头中“X-Subject-Token”就是需要获取的用户Token。简要的获取方法样例请参见 Token认证。
Instance-Id	否	String	参数说明：实例ID。物理多租下各实例的唯一标识，建议携带该参数，在使用专业版时必须携带该参数。您可以在IoTDA管理控制台界面，选择左侧导航栏“总览”页签查看当前实例的ID，具体获取方式请参考查看实例详情。

表3 请求Body参数
参数	是否必选	参数类型	描述
policy_name	是	String	参数说明：策略名称。取值范围：长度不超过128，只允许字母、数字、下划线（_）、连接符（-）的组合。
app_id	否	String	参数说明：资源空间ID。此参数为非必选参数，存在多资源空间的用户需要使用该接口时，建议携带该参数指定创建的设备归属到哪个资源空间下，否则创建的设备将会归属到默认资源空间下。取值范围：长度不超过36，只允许字母、数字、下划线（_）、连接符（-）的组合。
statement	是	Array of Statement objects	参数说明：策略文档。

表4 Statement
参数	是否必选	参数类型	描述
effect	是	String	指定是允许还是拒绝该操作。既有允许（ALLOW）又有拒绝（DENY）的授权语句时，遵循拒绝（DENY）优先的原则。 ALLOW：允许。 DENY：拒绝。
actions	是	Array of strings	用于指定策略允许或拒绝的操作。格式为：服务名:资源:操作。当前支持的操作类型如下： iotda:devices:publish：设备使用MQTT协议发布消息。 iotda:devices:subscribe：设备使用MQTT协议订阅消息。
resources	是	Array of strings	用于指定允许或拒绝对其执行操作的资源。格式为：资源类型:资源名称。如设备订阅的资源为：topic:/v1/${devices.deviceId}/test/hello。取值范围：资源列表长度最小为1，最大为10，列表中的资源取值范围：仅支持字母，数字，以及/{}$=+#?*:._-组合。

响应参数

状态码： 201

表5 响应Body参数
参数	参数类型	描述
app_id	String	参数说明：资源空间ID。
policy_id	String	策略ID。
policy_name	String	策略名称。
statement	Array of Statement objects	策略文档。
create_time	String	在物联网平台创建策略的时间。格式：yyyyMMdd'T'HHmmss'Z'，如20151212T121212Z。
update_time	String	在物联网平台更新策略的时间。格式：yyyyMMdd'T'HHmmss'Z'，如20151212T121212Z。

表6 Statement
参数	参数类型	描述
effect	String	指定是允许还是拒绝该操作。既有允许（ALLOW）又有拒绝（DENY）的授权语句时，遵循拒绝（DENY）优先的原则。 ALLOW：允许。 DENY：拒绝。
actions	Array of strings	用于指定策略允许或拒绝的操作。格式为：服务名:资源:操作。当前支持的操作类型如下： iotda:devices:publish：设备使用MQTT协议发布消息。 iotda:devices:subscribe：设备使用MQTT协议订阅消息。
resources	Array of strings	用于指定允许或拒绝对其执行操作的资源。格式为：资源类型:资源名称。如设备订阅的资源为：topic:/v1/${devices.deviceId}/test/hello。取值范围：资源列表长度最小为1，最大为10，列表中的资源取值范围：仅支持字母，数字，以及/{}$=+#?*:._-组合。

请求示例

创建设备策略-允许设备订阅与发布指定topic

POST https://{endpoint}/v5/iot/{project_id}/device-policies

{
  "policy_name" : "myPolicyAllow",
  "app_id" : "jeQDJQZltU8iKgFFoW060F5SGZka",
  "statement" : [ {
    "effect" : "ALLOW",
    "actions" : [ "iotda:devices:publish\niotda:devices:subscribe" ],
    "resources" : [ "topic:/v1/${devices.deviceId}/test/allow" ]
  } ]
}

创建设备策略-不允许设备订阅与发布指定topic

POST https://{endpoint}/v5/iot/{project_id}/device-policies

{
  "policy_name" : "myPolicyDeny",
  "app_id" : "jeQDJQZltU8iKgFFoW060F5SGZka",
  "statement" : [ {
    "effect" : "DENY",
    "actions" : [ "iotda:devices:publish\niotda:devices:subscribe" ],
    "resources" : [ "topic:/v1/${devices.deviceId}/test/deny" ]
  } ]
}

响应示例

状态码： 201

Created

{
  "app_id" : "jeQDJQZltU8iKgFFoW060F5SGZka",
  "policy_id" : "5c90fa7d3c4e4405e8525079",
  "policy_name" : "testPolicy",
  "statement" : [ {
    "effect" : "ALLOW",
    "actions" : [ "iotda:devices:publish", "iotda:devices:subscribe" ],
    "resources" : [ "topic:/v1/${devices.deviceId}/test/hello", "topic:/v1/${devices.productId}/test/hello" ]
  } ],
  "create_time" : "20230810T070547Z",
  "update_time" : "20230810T070547Z"
}

SDK代码示例

SDK代码示例如下。

创建设备策略-允许设备订阅与发布指定topic

        
         
           
           
             package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.AbstractCredentials;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.core.region.Region;
import com.huaweicloud.sdk.iotda.v5.*;
import com.huaweicloud.sdk.iotda.v5.model.*;

import java.util.List;
import java.util.ArrayList;

public class CreateDevicePolicySolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        // ENDPOINT：请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址。
        String iotdaEndpoint = "<YOUR ENDPOINT>";
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                // 标准版/企业版需要使用衍生算法，基础版请删除配置"withDerivedPredicate";
                .withDerivedPredicate(AbstractCredentials.DEFAULT_DERIVED_PREDICATE) // Used in derivative ak/sk authentication scenarios
                .withAk(ak)
                .withSk(sk);

        IoTDAClient client = IoTDAClient.newBuilder()
                .withCredential(auth)
                // 标准版/企业版：需自行创建Region对象，基础版：请使用IoTDARegion的region对象，如"withRegion(IoTDARegion.CN_NORTH_4)"
                .withRegion(new Region("cn-north-4", iotdaEndpoint))
                .build();
        CreateDevicePolicyRequest request = new CreateDevicePolicyRequest();
        CreateDevicePolicy body = new CreateDevicePolicy();
        List<String> listStatementResources = new ArrayList<>();
        listStatementResources.add("topic:/v1/${devices.deviceId}/test/allow");
        List<String> listStatementActions = new ArrayList<>();
        listStatementActions.add("iotda:devices:publish
iotda:devices:subscribe");
        List<Statement> listbodyStatement = new ArrayList<>();
        listbodyStatement.add(
            new Statement()
                .withEffect("ALLOW")
                .withActions(listStatementActions)
                .withResources(listStatementResources)
        );
        body.withStatement(listbodyStatement);
        body.withAppId("jeQDJQZltU8iKgFFoW060F5SGZka");
        body.withPolicyName("myPolicyAllow");
        request.withBody(body);
        try {
            CreateDevicePolicyResponse response = client.createDevicePolicy(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

            

          

        
       

创建设备策略-不允许设备订阅与发布指定topic

        
         
           
           
             package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.AbstractCredentials;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.core.region.Region;
import com.huaweicloud.sdk.iotda.v5.*;
import com.huaweicloud.sdk.iotda.v5.model.*;

import java.util.List;
import java.util.ArrayList;

public class CreateDevicePolicySolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        // ENDPOINT：请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址。
        String iotdaEndpoint = "<YOUR ENDPOINT>";
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                // 标准版/企业版需要使用衍生算法，基础版请删除配置"withDerivedPredicate";
                .withDerivedPredicate(AbstractCredentials.DEFAULT_DERIVED_PREDICATE) // Used in derivative ak/sk authentication scenarios
                .withAk(ak)
                .withSk(sk);

        IoTDAClient client = IoTDAClient.newBuilder()
                .withCredential(auth)
                // 标准版/企业版：需自行创建Region对象，基础版：请使用IoTDARegion的region对象，如"withRegion(IoTDARegion.CN_NORTH_4)"
                .withRegion(new Region("cn-north-4", iotdaEndpoint))
                .build();
        CreateDevicePolicyRequest request = new CreateDevicePolicyRequest();
        CreateDevicePolicy body = new CreateDevicePolicy();
        List<String> listStatementResources = new ArrayList<>();
        listStatementResources.add("topic:/v1/${devices.deviceId}/test/deny");
        List<String> listStatementActions = new ArrayList<>();
        listStatementActions.add("iotda:devices:publish
iotda:devices:subscribe");
        List<Statement> listbodyStatement = new ArrayList<>();
        listbodyStatement.add(
            new Statement()
                .withEffect("DENY")
                .withActions(listStatementActions)
                .withResources(listStatementResources)
        );
        body.withStatement(listbodyStatement);
        body.withAppId("jeQDJQZltU8iKgFFoW060F5SGZka");
        body.withPolicyName("myPolicyDeny");
        request.withBody(body);
        try {
            CreateDevicePolicyResponse response = client.createDevicePolicy(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

            

          

        
       

创建设备策略-允许设备订阅与发布指定topic

        
         
           
           
             # coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcore.auth.credentials import DerivedCredentials
from huaweicloudsdkcore.region.region import Region as coreRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkiotda.v5 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    // ENDPOINT：请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址。
    iotdaEndpoint = "<YOUR ENDPOINT>";
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId).with_derived_predicate(DerivedCredentials.get_default_derived_predicate())

    client = IoTDAClient.new_builder() \
        .with_credentials(credentials) \
        # 标准版/企业版：需要使用自行创建的Region对象，基础版：请选择IoTDAClient中的Region对象 如： .with_region(IoTDARegion.CN_NORTH_4)
        .with_region(coreRegion(id="cn-north-4", endpoint=endpoint)) \
        .build()

    try:
        request = CreateDevicePolicyRequest()
        listResourcesStatement = [
            "topic:/v1/${devices.deviceId}/test/allow"
        ]
        listActionsStatement = [
            "iotda:devices:publish
        iotda:devices:subscribe"
        ]
        listStatementbody = [
            Statement(
                effect="ALLOW",
                actions=listActionsStatement,
                resources=listResourcesStatement
            )
        ]
        request.body = CreateDevicePolicy(
            statement=listStatementbody,
            app_id="jeQDJQZltU8iKgFFoW060F5SGZka",
            policy_name="myPolicyAllow"
        )
        response = client.create_device_policy(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

            

          

        
       

创建设备策略-不允许设备订阅与发布指定topic

        
         
           
           
             # coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcore.auth.credentials import DerivedCredentials
from huaweicloudsdkcore.region.region import Region as coreRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkiotda.v5 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    // ENDPOINT：请在控制台的"总览"界面的"平台接入地址"中查看“应用侧”的https接入地址。
    iotdaEndpoint = "<YOUR ENDPOINT>";
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId).with_derived_predicate(DerivedCredentials.get_default_derived_predicate())

    client = IoTDAClient.new_builder() \
        .with_credentials(credentials) \
        # 标准版/企业版：需要使用自行创建的Region对象，基础版：请选择IoTDAClient中的Region对象 如： .with_region(IoTDARegion.CN_NORTH_4)
        .with_region(coreRegion(id="cn-north-4", endpoint=endpoint)) \
        .build()

    try:
        request = CreateDevicePolicyRequest()
        listResourcesStatement = [
            "topic:/v1/${devices.deviceId}/test/deny"
        ]
        listActionsStatement = [
            "iotda:devices:publish
        iotda:devices:subscribe"
        ]
        listStatementbody = [
            Statement(
                effect="DENY",
                actions=listActionsStatement,
                resources=listResourcesStatement
            )
        ]
        request.body = CreateDevicePolicy(
            statement=listStatementbody,
            app_id="jeQDJQZltU8iKgFFoW060F5SGZka",
            policy_name="myPolicyDeny"
        )
        response = client.create_device_policy(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

            

          

        
       

创建设备策略-允许设备订阅与发布指定topic

        
         
           
           
             package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    iotda "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/region"
    core_auth "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    // endpoint：请在控制台的"总览"界面的"平台接入地址"中查看"应用侧"的https接入地址
    endpoint := "<YOUR ENDPOINT>"
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        // 企业版/标准版需要使用衍生算法，基础版请删除该配置"WithDerivedPredicate"
        WithDerivedPredicate(core_auth.GetDefaultDerivedPredicate()). // Used in derivative ak/sk authentication scenarios
        Build()

    client := iotda.NewIoTDAClient(
        iotda.IoTDAClientBuilder().
            // 标准版/企业版需要自行创建region，基础版使用IoTDARegion中的region对象
            WithRegion(region.NewRegion("cn-north-4", endpoint)).
            WithCredential(auth).
            Build())

    request := &model.CreateDevicePolicyRequest{}
	var listResourcesStatement = []string{
        "topic:/v1/${devices.deviceId}/test/allow",
    }
	var listActionsStatement = []string{
        "iotda:devices:publish
    iotda:devices:subscribe",
    }
	var listStatementbody = []model.Statement{
        {
            Effect: "ALLOW",
            Actions: listActionsStatement,
            Resources: listResourcesStatement,
        },
    }
	appIdCreateDevicePolicy:= "jeQDJQZltU8iKgFFoW060F5SGZka"
	request.Body = &model.CreateDevicePolicy{
		Statement: listStatementbody,
		AppId: &appIdCreateDevicePolicy,
		PolicyName: "myPolicyAllow",
	}
	response, err := client.CreateDevicePolicy(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

            

          

        
       

创建设备策略-不允许设备订阅与发布指定topic

        
         
           
           
             package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    iotda "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/iotda/v5/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/region"
    core_auth "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    // endpoint：请在控制台的"总览"界面的"平台接入地址"中查看"应用侧"的https接入地址
    endpoint := "<YOUR ENDPOINT>"
    projectId := "{project_id}"

    auth := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        // 企业版/标准版需要使用衍生算法，基础版请删除该配置"WithDerivedPredicate"
        WithDerivedPredicate(core_auth.GetDefaultDerivedPredicate()). // Used in derivative ak/sk authentication scenarios
        Build()

    client := iotda.NewIoTDAClient(
        iotda.IoTDAClientBuilder().
            // 标准版/企业版需要自行创建region，基础版使用IoTDARegion中的region对象
            WithRegion(region.NewRegion("cn-north-4", endpoint)).
            WithCredential(auth).
            Build())

    request := &model.CreateDevicePolicyRequest{}
	var listResourcesStatement = []string{
        "topic:/v1/${devices.deviceId}/test/deny",
    }
	var listActionsStatement = []string{
        "iotda:devices:publish
    iotda:devices:subscribe",
    }
	var listStatementbody = []model.Statement{
        {
            Effect: "DENY",
            Actions: listActionsStatement,
            Resources: listResourcesStatement,
        },
    }
	appIdCreateDevicePolicy:= "jeQDJQZltU8iKgFFoW060F5SGZka"
	request.Body = &model.CreateDevicePolicy{
		Statement: listStatementbody,
		AppId: &appIdCreateDevicePolicy,
		PolicyName: "myPolicyDeny",
	}
	response, err := client.CreateDevicePolicy(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

            

          

        
       

更多编程语言的SDK代码示例，请参见API Explorer的代码示例页签，可生成自动对应的SDK代码示例。

状态码

状态码	描述
201	Created
400	Bad Request
401	Unauthorized
403	Forbidden
500	Internal Server Error

错误码

请参见错误码。

父主题：设备策略管理

上一篇：设备策略管理

下一篇：查询设备策略列表

意见反馈

文档内容是否对您有帮助？

有帮助没帮助

提供反馈

提交成功！非常感谢您的反馈，我们会继续努力做到更好！您可在我的云声建议查看反馈及问题处理状态。

系统繁忙，请稍后重试

在使用文档中是否遇到以下问题

内容与产品页面不一致

内容不易理解

缺失示例代码

步骤不可操作

搜不到想要的内容

缺少最佳实践

意见反馈（选填）

0/500

请至少选择一项反馈信息并填写问题反馈

字符长度不能超过500

直接提交取消

如您有其它疑问，您也可以通过华为云社区问答频道来与我们联系探讨

智能客服提问云社区提问

创建设备策略

功能介绍

调用方法

URI

请求参数

响应参数

请求示例

响应示例

SDK代码示例

状态码

错误码

相关文档

意见反馈

文档内容是否对您有帮助？

7*24

备案

专业服务

退订

建议反馈

售前咨询热线