# 策略授权参考 本章节介绍Organizations云服务策略授权场景下支持的策略授权项。 #### 支持的授权项 策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下： - 权限：允许或拒绝对指定资源在特定条件下进行某项操作。 - 对应API接口：自定义策略实际调用的API接口。 - 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。 - 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。 - IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。管理员可以在授权项列表中查看授权项是否支持IAM项目或企业项目，"√"表示支持，"×"表示暂不支持。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。 #### 组织管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [创建组织](https://support.huaweicloud.com/api-organizations/CreateOrganization.html) | POST /v1/organizations | - organizations:organizations:create - iam:agencies:createServiceLinkedAgencyV5 | × | × | | [查询所属组织信息](https://support.huaweicloud.com/api-organizations/ShowOrganization.html) | GET /v1/organizations | organizations:organizations:get | × | × | | [删除组织](https://support.huaweicloud.com/api-organizations/DeleteOrganization.html) | DELETE /v1/organizations | organizations:organizations:delete | × | × | | [离开当前组织](https://support.huaweicloud.com/api-organizations/LeaveOrganization.html) | POST /v1/organizations/leave | organizations:organizations:leave | × | × | | [列出组织的根](https://support.huaweicloud.com/api-organizations/ListRoots.html) | GET /v1/organizations/roots | organizations:roots:list | × | × | #### 组织单元管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [创建组织单元](https://support.huaweicloud.com/api-organizations/CreateOrganizationalUnit.html) | POST /v1/organizations/organizational-units | - organizations:ous:create - organizations:resources:tag（如果请求带标签） | × | × | | [列出组织单元](https://support.huaweicloud.com/api-organizations/ListOrganizationalUnits.html) | GET /v1/organizations/organizational-units | organizations:ous:list | × | × | | [查询有关组织单元的信息](https://support.huaweicloud.com/api-organizations/ShowOrganizationalUnit.html) | GET /v1/organizations/organizational-units/{organizational_unit_id} | organizations:ous:get | × | × | | [更改组织单元名称](https://support.huaweicloud.com/api-organizations/UpdateOrganizationalUnit.html) | PATCH /v1/organizations/organizational-units/{organizational_unit_id} | organizations:ous:update | × | × | | [删除组织单元](https://support.huaweicloud.com/api-organizations/DeleteOrganizationalUnit.html) | DELETE /v1/organizations/organizational-units/{organizational_unit_id} | organizations:ous:delete | × | × | #### 账号管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [创建账号](https://support.huaweicloud.com/api-organizations/CreateAccount.html) | POST /v1/organizations/accounts | - organizations:accounts:create - organizations:resources:tag（如果请求带标签） | × | × | | [关闭账号](https://support.huaweicloud.com/api-organizations/CloseAccount.html) | POST /v1/organizations/accounts/{account_id}/close | organizations:accounts:close | × | × | | [修改账号](https://support.huaweicloud.com/api-organizations/UpdateAccount.html) | PATCH /v1/organizations/accounts/{account_id} | organizations:accounts:update | × | × | | [列出关闭账号的状态](https://support.huaweicloud.com/api-organizations/ListCloseAccountStatuses.html) | GET /v1/organizations/close-account-status | organizations:closeAccountStatuses:list | × | × | | [列出组织中的账号](https://support.huaweicloud.com/api-organizations/ListAccounts.html) | GET /v1/organizations/accounts | organizations:accounts:list | × | × | | [查询账号信息](https://support.huaweicloud.com/api-organizations/ShowAccount.html) | GET /v1/organizations/accounts/{account_id} | organizations:accounts:get | × | × | | [移除指定的账号](https://support.huaweicloud.com/api-organizations/RemoveAccount.html) | POST /v1/organizations/accounts/{account_id}/remove | organizations:accounts:remove | × | × | | [移动账号](https://support.huaweicloud.com/api-organizations/MoveAccount.html) | POST /v1/organizations/accounts/{account_id}/move | organizations:accounts:move | × | × | | [邀请账号加入组织](https://support.huaweicloud.com/api-organizations/InviteAccount.html) | POST /v1/organizations/invite-account | - organizations:accounts:invite - organizations:resources:tag（如果请求带标签） | × | × | | [列出创建账号的状态](https://support.huaweicloud.com/api-organizations/ListCreateAccountStatuses.html) | GET /v1/organizations/create-account-statuses | organizations:createAccountStatuses:list | × | × | | [查询有关创建账号状态的信息](https://support.huaweicloud.com/api-organizations/ShowCreateAccountStatus.html) | GET /v1/organizations/create-account-statuses/{create_account_status_id} | organizations:createAccountStatuses:get | × | × | #### 邀请管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [查询邀请相关信息](https://support.huaweicloud.com/api-organizations/ShowHandshake.html) | GET /v1/organizations/handshakes/{handshake_id} | organizations:handshakes:get | × | × | | [接受邀请](https://support.huaweicloud.com/api-organizations/AcceptHandshake.html) | POST/v1/received-handshakes/{handshake_id}/accept | - organizations:handshakes:accept - iam:agencies:createServiceLinkedAgencyV5 | × | × | | [拒绝邀请](https://support.huaweicloud.com/api-organizations/DeclineHandshake.html) | POST /v1/received-handshakes/{handshake_id}/decline | organizations:handshakes:decline | × | × | | [取消邀请](https://support.huaweicloud.com/api-organizations/CancelHandshake.html) | POST /v1/organizations/handshakes/{handshake_id}/cancel | organizations:handshakes:cancel | × | × | | [列出收到的邀请](https://support.huaweicloud.com/api-organizations/ListReceivedHandshakes.html) | GET /v1/received-handshakes | organizations:receivedHandshakes:list | × | × | | [列出发送的邀请](https://support.huaweicloud.com/api-organizations/ListHandshakes.html) | GET /v1/organizations/handshakes | organizations:handshakes:list | × | × | #### 可信服务管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [启用可信服务](https://support.huaweicloud.com/api-organizations/EnableTrustedService.html) | POST /v1/organizations/enable-trusted-service | organizations:trustedServices:enable | × | × | | [禁用受信任服务](https://support.huaweicloud.com/api-organizations/DisableTrustedService.html) | POST /v1/organizations/disable-trusted-service | organizations:trustedServices:disable | × | × | | [列出组织的可信服务列表](https://support.huaweicloud.com/api-organizations/ListTrustedServices.html) | GET /v1/organizations/trusted-services | organizations:trustedServices:list | × | × | #### 委托管理员管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [注册作为服务委托管理员](https://support.huaweicloud.com/api-organizations/RegisterDelegatedAdministrator.html) | POST /v1/organizations/delegated-administrators/register | organizations:delegatedAdministrators:register | × | × | | [注销服务的委托管理员](https://support.huaweicloud.com/api-organizations/DeregisterDelegatedAdministrator.html) | POST /v1/organizations/delegated-administrators/deregister | organizations:delegatedAdministrators:deregister | × | × | | [列出指定账号是其委托管理员的服务](https://support.huaweicloud.com/api-organizations/ListDelegatedServices.html) | GET /v1/organizations/accounts/{account_id}/delegated-services | organizations:delegatedServices:list | × | × | | [列出此组织中指定为委托管理员的账号](https://support.huaweicloud.com/api-organizations/ListDelegatedAdministrators.html) | GET /v1/organizations/delegated-administrators | organizations:delegatedAdministrators:list | × | × | #### 策略管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [创建策略](https://support.huaweicloud.com/api-organizations/CreatePolicy.html) | POST /v1/organizations/policies | - organizations:policies:create - organizations:resources:tag（如果请求带标签） | × | × | | [列出策略](https://support.huaweicloud.com/api-organizations/ListPolicies.html) | GET /v1/organizations/policies | organizations:policies:list | × | × | | [查询策略相关信息](https://support.huaweicloud.com/api-organizations/ShowPolicy.html) | GET /v1/organizations/policies/{policy_id} | organizations:policies:get | × | × | | [更新策略](https://support.huaweicloud.com/api-organizations/UpdatePolicy.html) | PATCH /v1/organizations/policies/{policy_id} | organizations:policies:update | × | × | | [删除策略](https://support.huaweicloud.com/api-organizations/DeletePolicy.html) | DELETE /v1/organizations/policies/{policy_id} | organizations:policies:delete | × | × | | [在根中启用策略类型](https://support.huaweicloud.com/api-organizations/EnablePolicyType.html) | POST /v1/organizations/policies/enable | organizations:policies:enable | × | × | | [禁用根中的策略类型](https://support.huaweicloud.com/api-organizations/DisablePolicyType.html) | POST /v1/organizations/policies/disable | organizations:policies:disable | × | × | | [将策略跟实体绑定](https://support.huaweicloud.com/api-organizations/AttachPolicy.html) | POST /v1/organizations/policies/{policy_id}/attach | organizations:policies:attach | × | × | | [将策略跟实体解绑](https://support.huaweicloud.com/api-organizations/DetachPolicy.html) | POST /v1/organizations/policies/{policy_id}/detach | organizations:policies:detach | × | × | | [列出跟指定策略绑定的所有实体](https://support.huaweicloud.com/api-organizations/ListEntitiesForPolicy.html) | GET /v1/organizations/policies/{policy_id}/attached-entities | organizations:attachedEntities:list | × | × | #### 标签管理 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [列出绑定到指定资源的标签](https://support.huaweicloud.com/api-organizations/ListTagsForResource.html) | GET /v1/organizations/resources/{resource_id}/tags | organizations:tags:list | × | × | | [为指定的资源添加标签](https://support.huaweicloud.com/api-organizations/TagResource.html) | POST /v1/organizations/resources/{resource_id}/tag | organizations:resources:tag | × | × | | [从指定资源中删除指定主键标签](https://support.huaweicloud.com/api-organizations/UntagResource.html) | POST /v1/organizations/resources/{resource_id}/untag | organizations:resources:untag | × | × | | [列出绑定到指定资源的标签](https://support.huaweicloud.com/api-organizations/ListTagResources.html) | GET /v1/organizations/{resource_type}/{resource_id}/tags | organizations:tags:list | × | × | | [为指定资源添加标签](https://support.huaweicloud.com/api-organizations/CreateTagResource.html) | POST /v1/organizations/{resource_type}/{resource_id}/tags/create | organizations:resources:tag | × | × | | [从指定资源中删除指定主键标签](https://support.huaweicloud.com/api-organizations/DeleteTagResource.html) | POST /v1/organizations/{resource_type}/{resource_id}/tags/delete | organizations:resources:untag | × | × | | [根据资源类型及标签信息查询实例列表](https://support.huaweicloud.com/api-organizations/ListResourceInstances.html) | POST /v1/organizations/{resource_type}/resource-instances/filter | organizations:resources:listByTag | × | × | | [根据资源类型及标签信息查询实例数量](https://support.huaweicloud.com/api-organizations/ShowResourceInstancesCount.html) | POST /v1/organizations/{resource_type}/resource-instances/count | organizations:resources:countByTag | × | × | | [查询资源标签](https://support.huaweicloud.com/api-organizations/ListResourceTags.html) | GET /v1/organizations/{resource_type}/tags | organizations:resources:list | × | × | #### 其他 | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目(Enterprise Project) | |:---|:---|:---|:---|:---| | [查询有效的策略](https://support.huaweicloud.com/api-organizations/ShowEffectivePolicies.html) | GET /v1/organizations/entities/effective-policies | organizations:effectivePolicies:get | × | × | | [列出组织中的根、组织单元和账号](https://support.huaweicloud.com/api-organizations/ListEntities.html) | GET /v1/organizations/entities | organizations:entities:list | × | × | | [列出所有可以与组织服务集成的云服务](https://support.huaweicloud.com/api-organizations/ListServices.html) | GET /v1/organizations/services | organizations:services:list | × | × | | [列出被添加到标签策略强制执行的资源类型](https://support.huaweicloud.com/api-organizations/ListTagPolicyServices.html) | GET /v1/organizations/tag-policy-services | organizations:tagPolicyServices:list | × | × | | [列出租户的组织配额](https://support.huaweicloud.com/api-organizations/ListQuotas.html) | GET /v1/organizations/quotas | organizations:quotas:list | × | × |