# 身份策略授权参考 云服务在IAM预置了常用授权项，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。 除IAM服务外，[Organizations](https://support.huaweicloud.com/productdesc-organizations/org_01_0011.html)服务中的[服务控制策略](https://support.huaweicloud.com/usermanual-organizations/org_03_0065.html)（Service Control Policy，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。 SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM身份策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。 IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：[IAM服务与Organizations服务权限访问控制的区别](https://support.huaweicloud.com/organizations_faq/org_06_0004.html)。 本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。 - 如何使用这些元素编辑IAM自定义身份策略，请参考[创建自定义身份策略](https://support.huaweicloud.com/usermanual-iam5/iam_01_0917.html)。 - 如何使用这些元素编辑SCP自定义策略，请参考[创建SCP](https://support.huaweicloud.com/usermanual-organizations/org_03_0035.html)。 #### 操作（Action） 操作（Action）即为SCP中支持的授权项。 - **"访问级别"**列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在SCP中相应操作对应的访问级别。 - **"资源类型"** 列指每个操作是否支持资源级权限。 - 资源类型支持通配符号\*表示所有。如果此列没有值（-），则必须在SCP语句的Resource元素中指定所有资源类型（"\*"）。 - 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。 - 资源类型列中必需资源在表中用星号（\*）标识，表示使用此操作必须指定该资源类型。 关于SecMaster定义的资源类型的详细信息请参见[资源类型（Resource）]。 - **"条件键"** 列包括了可以在SCP语句的Condition元素中支持指定的键值。 - 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。 - 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。 - 如果此列没有值（-），表示此操作不支持指定条件键。 关于SecMaster定义的条件键的详细信息请参见[条件（Condition）]。 - "**别名** "列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见[身份策略兼容性说明](https://support.huaweicloud.com/iam5_faq/iam_01_1103.html)。 您可以在身份策略语句的Action元素中指定以下SecMaster的相关操作。 表1SecMaster支持的授权项Part1 | 授权项 | 描述 | 访问级别 | 资源类型（\*为必要） | 条件键 | 别名 | |:---|:---|:---|:---|:---|:---| | secmaster:playbook:get | 授予权限获取剧本详情。 | read | playbook \* | - | - | | secmaster:playbook:create | 授予权限创建剧本。 | write | playbook \* | - | - | | secmaster:playbook:delete | 授予权限删除剧本。 | write | playbook \* | - | - | | secmaster:playbook:update | 授予权限更新剧本。 | write | playbook \* | - | - | | secmaster:playbook:list | 授予权限获取剧本列表。 | list | playbook \* | - | - | | secmaster:playbook:getStatistics | 授予权限获取剧本统计数据。 | read | playbook \* | - | - | | secmaster:playbook:getMonitor | 授予权限获取剧本运行监控数据。 | read | playbook \* | - | - | | secmaster:playbook:copyVersion | 授予权限克隆剧本。 | write | playbook \* | - | - | | secmaster:playbook:approve | 授予权限审核剧本。 | write | playbook \* | - | - | | secmaster:playbook:listApproves | 授予权限查询审核列表。 | list | playbook \* | - | - | | secmaster:playbook:listInstances | 授予权限查询实例列表。 | list | playbook \* | - | - | | secmaster:playbook:getInstanceAuditlog | 授予权限查询实例审计日志列表。 | list | playbook \* | - | - | | secmaster:playbook:createVersion | 授予权限创建剧本版本。 | write | playbook \* | - | - | | secmaster:playbook:getVersion | 授予权限获取剧本版本。 | read | playbook \* | - | - | | secmaster:playbook:deleteVersion | 授予权限删除剧本版本。 | write | playbook \* | - | - | | secmaster:playbook:updateVersion | 授予权限更新剧本版本。 | write | playbook \* | - | - | | secmaster:playbook:listVersions | 授予权限获取剧本版本列表。 | list | playbook \* | - | - | | secmaster:playbook:createVersionAction | 授予权限创建剧本版本Action | write | playbook \* | - | - | | secmaster:playbook:createVersionRule | 授予权限创建剧本版本规则 | write | playbook \* | - | - | | secmaster:playbook:deleteVersionAction | 授予权限删除剧本版本Action | write | playbook \* | - | - | | secmaster:playbook:deleteVersionRule | 授予权限删除剧本版本规则 | write | playbook \* | - | - | | secmaster:playbook:getVersionRule | 授予权限获取剧本版本规则详情 | read | playbook \* | - | - | | secmaster:playbook:listVersionActions | 授予权限查询剧本版本Action列表 | list | playbook \* | - | - | | secmaster:playbook:updateVersionAction | 授予权限更新剧本版本Action | write | playbook \* | - | - | | secmaster:playbook:updateVersionRule | 授予权限更新剧本版本规则 | write | playbook \* | - | - | | secmaster:playbook:getInstance | 授予权限查询实例详情。 | read | playbook \* | - | - | | secmaster:playbook:getInstanceTopology | 授予权限查询实例拓扑详情。 | read | playbook \* | - | - | | secmaster:playbook:operateInstance | 授予权限操作剧本实例。 | write | playbook \* | - | - | | secmaster:workflow:list | 授予权限查询流程列表。 | list | workflow \* | - | - | | secmaster:workflow:get | 授予权限获取流程的详情。 | read | workflow \* | - | - | | secmaster:workflow:delete | 授予权限删除流程。 | write | workflow \* | - | - | | secmaster:workflow:create | 授予权限创建流程。 | write | workflow \* | - | - | | secmaster:workflow:update | 授予权限更新流程。 | write | workflow \* | - | - | | secmaster:workflow:listVersions | 授予权限获取流程版本的列表。 | list | workflow \* | - | - | | secmaster:workflow:getVersion | 授予权限获取流程的版本详情。 | read | workflow \* | - | - | | secmaster:workflow:deleteVersion | 授予权限删除流程的版本。 | write | workflow \* | - | - | | secmaster:workflow:createVersion | 授予权限创建流程版本。 | write | workflow \* | - | - | | secmaster:workflow:updateVersion | 授予权限更新流程的版本。 | write | workflow \* | - | - | | secmaster:workflow:approveVersion | 授予权限审核流程版本。 | write | workflow \* | - | - | | secmaster:workflow:validate | 授予权限校验流程的版本。 | write | workflow \* | - | - | | secmaster:workflow:simulate | 授予权限更新流程版本调试结果。 | write | workflow \* | - | - | | secmaster:workflow:getInstance | 授予权限流程实例拓扑图。 | read | workflow \* | - | - | | secmaster:connection:list | 授予权限查询资产连接列表。 | list | connection \* | - | - | | secmaster:connection:create | 授予权限创建资产连接。 | write | connection \* | - | - | | secmaster:connection:get | 授予权限获取资产连接详情。 | read | connection \* | - | - | | secmaster:connection:delete | 授予权限删除资产连接。 | write | connection \* | - | - | | secmaster:connection:update | 授予权限更新资产连接。 | write | connection \* | - | - | | secmaster:workspace:listWorkspace | 授予权限查询工作空间列表。 | list | workspace \* | - | secmaster:workspace:list | | secmaster:workspace:createWorkspace | 授予权限创建工作空间。 | write | workspace \* | - | secmaster:workspace:create | | secmaster:workspace:updateWorkspace | 授予权限更新工作空间。 | write | workspace \* | - | secmaster:workspace:update | | secmaster:workspace:getWorkspace | 授予权限获取工作空间详情。 | read | workspace \* | - | secmaster:workspace:get | | secmaster:workspace:deleteWorkspace | 授予权限删除工作空间。 | write | workspace \* | - | secmaster:workspace:delete | | secmaster:workspace:listAgency | 授予权限查询空间托管列表。 | list | workspace \* | - | secmaster:workspace:list | | secmaster:workspace:createAgency | 授予权限创建空间托管。 | write | workspace \* | [secmaster:TargetRegion] | secmaster:workspace:create | | secmaster:workspace:updateAgency | 授予权限更新空间托管。 | write | workspace \* | - | secmaster:workspace:update | | secmaster:workspace:getAgency | 授予权限获取空间托管详情。 | read | workspace \* | - | secmaster:workspace:get | | secmaster:workspace:deleteAgency | 授予权限删除空间托管。 | write | workspace \* | - | secmaster:workspace:delete | | secmaster:task:list | 授予权限查询待办列表。 | list | task \* | - | - | | secmaster:task:create | 授予权限创建待办。 | write | task \* | - | - | | secmaster:task:update | 授予权限更新待办。 | write | task \* | - | - | | secmaster:task:get | 授予权限获取待办详情。 | read | task \* | - | - | | secmaster:indicator:get | 授予权限获取情报详情。 | read | indicator \* | - | - | | secmaster:indicator:create | 授予权限创建情报。 | write | indicator \* | - | - | | secmaster:indicator:update | 授予权限更新情报。 | write | indicator \* | - | - | | secmaster:indicator:delete | 授予权限删除情报。 | write | indicator \* | - | - | | secmaster:indicator:list | 授予权限查询情报列表。 | read | indicator \* | - | - | | secmaster:indicator:listTypes | 授予权限查询情报类型列表。 | list | indicator \* | - | - | | secmaster:indicator:bindLayout | 授予权限绑定情报类型与布局关联。 | write | indicator \* | - | - | | secmaster:alert:get | 授予权限获取告警详情。 | read | alert \* | - | - | | secmaster:alert:create | 授予权限创建告警。 | write | alert \* | - | - | | secmaster:alert:update | 授予权限更新告警。 | write | alert \* | - | - | | secmaster:alert:list | 授予权限搜索告警列表。 | list | alert \* | - | - | | secmaster:alert:delete | 授予权限删除告警。 | write | alert \* | - | - | | secmaster:alert:batchOrders | 授予权限告警转事件。 | write | alert \* | - | - | | secmaster:alert:listTypes | 授予权限查询告警类型列表。 | list | alert \* | - | - | | secmaster:alert:listCategories | 授予权限查询告警类别列表。 | list | alert \* | - | - | | secmaster:alert:createType | 授予权限创建告警类型。 | write | alert \* | - | - | | secmaster:alert:updateType | 授予权限修改告警类型。 | write | alert \* | - | - | | secmaster:alert:deleteType | 授予权限删除告警类型。 | write | alert \* | - | - | | secmaster:alert:enableType | 授予权限启用/禁用告警类型。 | write | alert \* | - | - | | secmaster:alert:bindLayout | 授予权限绑定告警类型与布局关联。 | write | alert \* | - | - | | secmaster:incident:get | 授予权限获取事件详情。 | read | incident \* | - | - | | secmaster:incident:create | 授予权限创建事件。 | write | incident \* | - | - | | secmaster:incident:update | 授予权限更新事件。 | write | incident \* | - | - | | secmaster:incident:list | 授予权限搜索事件列表。 | list | incident \* | - | - | | secmaster:incident:listTypes | 授予权限获取事件的类型列表。 | list | incident \* | - | - | | secmaster:incident:delete | 授予权限删除事件。 | write | incident \* | - | - | | secmaster:incident:listCategories | 授予权限查询事件类别列表。 | list | incident \* | - | - | | secmaster:incident:createType | 授予权限创建事件类型。 | write | incident \* | - | - | | secmaster:incident:updateType | 授予权限修改事件类型。 | write | incident \* | - | - | | secmaster:incident:deleteType | 授予权限删除事件类型。 | write | incident \* | - | - | | secmaster:incident:enableType | 授予权限启用/禁用事件类型。 | write | incident \* | - | - | | secmaster:incident:bindLayout | 授予权限绑定事件类型与布局的关联。 | write | incident \* | - | - | | secmaster:dataobject:createRelation | 授予权限创建对象关系。 | write | dataobject \* | - | - | | secmaster:dataobject:deleteRelation | 授予权限删除对象关系。 | write | dataobject \* | - | - | | secmaster:dataobject:listRelation | 授予权限搜索对象关系列表。 | list | dataobject \* | - | - | | secmaster:vulnerability:listGroup | 授予权限查询漏洞组列表。 | list | vulnerability \* | - | - | | secmaster:vulnerability:getGroup | 授予权限获取漏洞组详情。 | read | vulnerability \* | - | - | | secmaster:vulnerability:exportGroup | 授予权限导出漏洞组列表。 | list | vulnerability \* | - | - | | secmaster:vulnerability:listType | 授予权限查询漏洞类型列表。 | list | vulnerability \* | - | - | | secmaster:vulnerability:bindLayout | 授予权限绑定漏洞类型与布局关联。 | write | vulnerability \* | - | - | | secmaster:vulnerability:createType | 授予权限创建漏洞类型。 | write | vulnerability \* | - | - | | secmaster:vulnerability:updateType | 授予权限修改漏洞类型。 | write | vulnerability \* | - | - | | secmaster:vulnerability:deleteType | 授予权限删除漏洞类型。 | write | vulnerability \* | - | - | | secmaster:vulnerability:enableType | 授予权限启用/禁用漏洞类型。 | write | vulnerability \* | - | - | | secmaster:subscription:deletePostPaidOrder | 授予权限删除按需订单。 | write | - | - | - | | secmaster:subscription:createPostPaidOrder | 授予权限创建按需订单。 | write | - | - | - | | secmaster:subscription:createPrePaidOrder | 授予权限创建包周期订单。 | write | - | - | - | | secmaster:subscription:getVersion | 授予权限查看订购版本。 | read | - | - | - | | secmaster:metric:getResult | 授予权限查看指标结果。 | read | metric \* | - | - | | secmaster:metric:listResults | 授予权限列出指标结果。 | list | metric \* | - | - | | secmaster:metric:listHits | 授予权限列出指标Hits结果。 | list | metric \* | - | - | | secmaster:agency:get | 授予权限查看委托。 | read | - | - | - | | secmaster:agency:create | 授予权限创建委托。 | write | - | - | - | | secmaster:resource:getStatistics | 授予权限查看资源统计。 | read | resource \* | - | - | | secmaster:resource:list | 授予权限列出资源。 | list | resource \* | - | - | | secmaster:resource:import | 授予权限导入资源。 | write | resource \* | - | - | | secmaster:resource:getTemplate | 授予权限获取资源导入模板。 | read | resource \* | - | - | | secmaster:report:list | 授予权限列出报告。 | list | report \* | - | - | | secmaster:report:get | 授予权限查看报告。 | read | report \* | - | - | | secmaster:report:create | 授予权限创建报告。 | write | report \* | - | - | | secmaster:report:update | 授予权限更新报告。 | write | report \* | - | - | | secmaster:report:delete | 授予权限删除报告。 | write | report \* | - | - | | secmaster:emergencyVulnerability:updateReadStatus | 授予权限设置应急漏洞读取状态。 | write | emergencyVulnerability \* | - | - | | secmaster:emergencyVulnerability:list | 授予权限列出应急漏洞。 | list | emergencyVulnerability \* | - | - | | secmaster:emergencyVulnerability:export | 授予权限导出应急漏洞。 | read | emergencyVulnerability \* | - | - | | secmaster:dataspace:list | 授予权限查询数据空间列表。 | list | dataspace \* | - | - | | secmaster:dataspace:create | 授予权限创建数据空间。 | write | dataspace \* | - | - | | secmaster:dataspace:get | 授予权限查询数据空间详情。 | read | dataspace \* | - | - | | secmaster:dataspace:update | 授予权限更新数据空间。 | write | dataspace \* | - | - | | secmaster:dataspace:delete | 授予权限删除数据空间。 | write | dataspace \* | - | - | | secmaster:pipe:list | 授予权限查询数据管道列表。 | list | pipe \* | - | - | | secmaster:pipe:create | 授予权限创建数据管道。 | write | pipe \* | - | - | | secmaster:pipe:get | 授予权限查询数据管道详情。 | read | pipe \* | - | - | | secmaster:pipe:update | 授予权限更新数据管道。 | write | pipe \* | - | - | | secmaster:pipe:delete | 授予权限删除数据管道。 | write | pipe \* | - | - | | secmaster:pipe:getIndex | 授予权限查询数据管道索引。 | read | pipe \* | - | - | | secmaster:pipe:updateIndex | 授予权限更新数据管道索引。 | write | pipe \* | - | - | | secmaster:pipe:getConsumption | 授予权限查询数据管道消费。 | read | pipe \* | - | - | | secmaster:pipe:createConsumption | 授予权限创建数据管道消费。 | write | pipe \* | - | - | | secmaster:pipe:deleteConsumption | 授予权限删除数据管道消费。 | write | pipe \* | - | - | | secmaster:search:listLogs | 授予权限查询数据。 | list | workspace \* | - | - | | secmaster:search:listHistograms | 授予权限查询数据分布直方图。 | list | workspace \* | - | - | | secmaster:search:createAnalysis | 授予权限执行分析。 | write | workspace \* | - | - | | secmaster:searchCondition:list | 授予权限查询检索条件列表。 | list | searchCondition \* | - | - | | secmaster:searchCondition:create | 授予权限创建检索条件。 | write | searchCondition \* | - | - | | secmaster:searchCondition:get | 授予权限查询检索条件详情。 | read | searchCondition \* | - | - | | secmaster:searchCondition:update | 授予权限更新检索条件。 | write | searchCondition \* | - | - | | secmaster:searchCondition:delete | 授予权限删除检索条件。 | write | searchCondition \* | - | - | | secmaster:alertRule:list | 授予权限查询告警模型。 | list | alertRule \* | - | - | | secmaster:alertRule:create | 授予权限创建告警模型。 | write | alertRule \* | - | - | | secmaster:alertRule:get | 授予权限查询告警模型详情。 | read | alertRule \* | - | - | | secmaster:alertRule:update | 授予权限修改告警模型。 | write | alertRule \* | - | - | | secmaster:alertRule:delete | 授予权限删除告警模型。 | write | alertRule \* | - | - | | secmaster:alertRule:enable | 授予权限启用告警模型。 | write | alertRule \* | - | - | | secmaster:alertRule:disable | 授予权限停用告警模型。 | write | alertRule \* | - | - | | secmaster:alertRule:listMetrics | 授予权限查询告警模型总览。 | list | alertRule \* | - | - | | secmaster:alertRule:createSimulation | 授予权限模拟告警模型。 | write | alertRule \* | - | - | | secmaster:alertRuleTemplate:list | 授予权限查询告警模板。 | list | alertRuleTemplate \* | - | - | | secmaster:alertRuleTemplate:get | 授予权限查询告警模板详情。 | read | alertRuleTemplate \* | - | - | | secmaster:alertRuleTemplate:listMetrics | 授予权限查询告警模板总览。 | list | alertRuleTemplate \* | - | - | | secmaster:dataclass:create | 授予权限创建数据类。 | write | dataclass \* | - | - | | secmaster:dataclass:update | 授予权限更新数据类。 | write | dataclass \* | - | - | | secmaster:dataclass:delete | 授予权限删除数据类。 | write | dataclass \* | - | - | | secmaster:dataclass:get | 授予权限获取数据类详情。 | read | dataclass \* | - | - | | secmaster:dataclass:list | 授予权限查询数据类列表。 | list | dataclass \* | - | - | | secmaster:dataclass:createField | 授予权限创建字段。 | write | dataclass \* | - | - | | secmaster:dataclass:updateField | 授予权限更新字段。 | write | dataclass \* | - | - | | secmaster:dataclass:deleteField | 授予权限删除字段。 | write | dataclass \* | - | - | | secmaster:dataclass:getField | 授予权限获取字段详情。 | read | dataclass \* | - | - | | secmaster:dataclass:listFields | 授予权限查询字段列表。 | list | dataclass \* | - | - | | secmaster:dataclass:getType | 授予权限获取类型详情。 | read | dataclass \* | - | - | | secmaster:dataclass:listTypes | 授予权限查询类型列表。 | list | dataclass \* | - | - | | secmaster:mapping:update | 授予权限更新分类映射状态。 | write | mapping \* | - | - | | secmaster:mapping:list | 授予权限搜索分类映射列表。 | list | mapping \* | - | - | | secmaster:mapping:getDatasource | 授予权限获取分类映射数据源。 | read | mapping \* | - | - | | secmaster:mapping:listFunctions | 授予权限获取分类映射函数。 | list | mapping \* | - | - | | secmaster:mapping:delete | 授予权限删除分类映射。 | write | mapping \* | - | - | | secmaster:mapping:copy | 授予权限复制分类映射。 | write | mapping \* | - | - | | secmaster:mapping:createClassifier | 授予权限创建分类。 | write | mapping \* | - | - | | secmaster:mapping:updateClassifier | 授予权限更新分类。 | write | mapping \* | - | - | | secmaster:mapping:getClassifier | 授予权限获取分类信息。 | read | mapping \* | - | - | | secmaster:mapping:deleteClassifier | 授予权限删除分类。 | write | mapping \* | - | - | | secmaster:mapping:createMapper | 授予权限创建映射。 | write | mapping \* | - | - | | secmaster:mapping:updateMapper | 授予权限更新映射。 | write | mapping \* | - | - | | secmaster:mapping:listMappers | 授予权限查询映射列表。 | list | mapping \* | - | - | | secmaster:mapping:getMapper | 授予权限获取映射信息。 | read | mapping \* | - | - | | secmaster:mapping:deleteMapper | 授予权限删除映射。 | write | mapping \* | - | - | | secmaster:layout:listBusinessTypes | 授予权限获取布局类型列表。 | list | layout \* | - | - | | secmaster:layout:list | 授予权限查询布局列表。 | list | layout \* | - | - | | secmaster:layout:create | 授予权限创建布局。 | write | layout \* | - | - | | secmaster:layout:delete | 授予权限删除布局。 | write | layout \* | - | - | | secmaster:layout:update | 授予权限更新布局。 | write | layout \* | - | - | | secmaster:layout:get | 授予权限查询布局。 | read | layout \* | - | - | | secmaster:layout:createTemplate | 授予权限另存为模板。 | write | layout \* | - | - | | secmaster:layout:createField | 授予权限创建布局字段。 | write | layout \* | - | - | | secmaster:layout:listFields | 授予权限获取布局字段列表。 | list | layout \* | - | - | | secmaster:layout:getField | 授予权限获取布局字段详情。 | read | layout \* | - | - | | secmaster:layout:updateField | 授予权限更新布局字段。 | write | layout \* | - | - | | secmaster:layout:deleteField | 授予权限删除布局字段。 | write | layout \* | - | - | | secmaster:layout:listWizards | 授予权限获取页面。 | list | layout \* | - | - | | secmaster:layout:createWizard | 授予权限创建页面。 | write | layout \* | - | - | | secmaster:layout:getWizard | 授予权限获取页面详情。 | read | layout \* | - | - | | secmaster:layout:deleteWizard | 授予权限删除页面。 | write | layout \* | - | - | | secmaster:layout:updateWizard | 授予权限更新页面。 | write | layout \* | - | - | | secmaster:catalogue:list | 授予权限目录列表查询。 | list | catalogue \* | - | - | | secmaster:catalogue:update | 授予权限更新目录。 | write | catalogue \* | - | - | | secmaster:playbook:export | 授予权限导出剧本。 | read | playbook \* | - | - | | secmaster:playbook:import | 授予权限导入剧本。 | write | playbook \* | - | - | | secmaster:indicator:downloadTemplate | 授予权限下载指标模板。 | read | indicator \* | - | - | | secmaster:indicator:export | 授予权限导出指标。 | read | indicator \* | - | - | | secmaster:indicator:import | 授予权限导入指标。 | write | indicator \* | - | - | | secmaster:table:list | 授予权限查询表。 | list | table \* | - | - | | secmaster:table:create | 授予权限创建表。 | write | table \* | - | - | | secmaster:table:get | 授予权限查询表详情。 | read | table \* | - | - | | secmaster:table:update | 授予权限修改表。 | write | table \* | - | - | | secmaster:table:delete | 授予权限删除表。 | write | table \* | - | - | | secmaster:table:createLock | 授予权限锁止表。 | write | table \* | - | - | | secmaster:table:deleteLock | 授予权限解锁表。 | write | table \* | - | - | | secmaster:table:listMetrics | 授予权限查询表总览。 | list | table \* | - | - | | secmaster:table:updateSchema | 授予权限设计表。 | write | table \* | - | - | | secmaster:workspace:listTags | 授予权限查询资源标签。 | list | workspace \* | - | - | | secmaster:workspace:listResourcesByTag | 授予权限查询资源实例列表。 | list | workspace \* | - | - | | secmaster:workspace:listTagsForResource | 授予权限查询资源标签。 | list | workspace \* | - | - | | secmaster:workspace:createTags | 授予权限批量添加资源标签。 | write | workspace \* | - | - | | secmaster:workspace:deleteTags | 授予权限批量删除资源标签。 | write | workspace \* | - | - | | secmaster:workspace:updateTag | 授予权限更新标签值。 | write | workspace \* | - | - | | secmaster:workflow:export | 授予权限导出流程。 | read | workflow \* | - | - | | secmaster:workflow:import | 授予权限导入流程。 | write | workflow \* | - | - | | secmaster:alert:import | 授予权限导入告警。 | write | alert \* | - | - | | secmaster:alert:export | 授予权限导出告警。 | read | alert \* | - | - | | secmaster:alert:downloadTemplate | 授予权限下载告警模板。 | read | alert \* | - | - | | secmaster:incident:import | 授予权限导入事件。 | write | incident \* | - | - | | secmaster:incident:export | 授予权限导出事件。 | read | incident \* | - | - | | secmaster:incident:downloadTemplate | 授予权限下载事件模板。 | read | incident \* | - | - | | secmaster:dataclass:bindLayout | 授予权限绑定数据类类型与布局关联。 | write | dataclass \* | - | - | | secmaster:dataclass:createType | 授予权限创建自定义数据类型。 | write | dataclass \* | - | - | | secmaster:dataclass:updateType | 授予权限更新自定义数据类型。 | write | dataclass \* | - | - | | secmaster:dataclass:deleteType | 授予权限删除自定义数据类型。 | write | dataclass \* | - | - | | secmaster:dataclass:enableType | 授予权限启用数据类类型。 | write | dataclass \* | - | - | | secmaster:preference:create | 授予权限设置用户偏好。 | write | - | - | - | | secmaster:preference:get | 授予权限获取用户偏好。 | read | - | - | - | | secmaster:preference:delete | 授予权限删除用户偏好。 | write | - | - | - | | secmaster:preference:update | 授予权限更新用户偏好。 | write | - | - | - | | secmaster:preference:list | 授予权限搜索用户偏好。 | list | - | - | - | | secmaster:metric:list | 授予权限获取指标列表。 | list | metric \* | - | - | | secmaster:metric:create | 授予权限创建指标。 | write | metric \* | - | - | | secmaster:metric:get | 授予权限获取指标详情。 | read | metric \* | - | - | | secmaster:metric:delete | 授予权限删除指标。 | write | metric \* | - | - | | secmaster:metric:update | 授予权限更新指标。 | write | metric \* | - | - | | secmaster:module:list | 授予权限获取模块列表。 | list | - | - | - | | secmaster:module:create | 授予权限创建模块。 | write | - | - | - | | secmaster:module:get | 授予权限获取模块详情。 | read | - | - | - | | secmaster:module:delete | 授予权限删除模块。 | write | - | - | - | | secmaster:module:update | 授予权限更新模块。 | write | - | - | - | | secmaster:vulnerability:downloadTemplate | 授予权限下载漏洞模板。 | read | vulnerability \* | - | - | | secmaster:vulnerability:import | 授予权限导入漏洞数据。 | write | vulnerability \* | - | - | | secmaster:policy:list | 授予权限查询策略列表。 | list | policy \* | - | - | | secmaster:policy:create | 授予权限创建策略。 | write | policy \* | - | - | | secmaster:policy:get | 授予权限查询策略详情。 | read | policy \* | - | - | | secmaster:policy:update | 授予权限更新策略。 | write | policy \* | - | - | | secmaster:policy:delete | 授予权限删除策略。 | write | policy \* | - | - | | secmaster:policy:batchDelete | 授予权限批量删除策略。 | write | policy \* | - | - | | secmaster:note:list | 授予权限查询评论列表。 | list | - | - | - | | secmaster:note:create | 授予权限创建评论。 | write | - | - | - | | secmaster:note:delete | 授予权限删除评论。 | write | - | - | - | | secmaster:secureScore:update | 授予权限更新安全评分。 | write | - | - | - | | secmaster:baseline:list | 授予权限查看基线检查结果。 | list | baseline \* | - | - | | secmaster:baseline:export | 授予权限导出基线检查结果。 | read | baseline \* | - | - | | secmaster:baseline:import | 授予权限导入基线检查结果。 | write | baseline \* | - | - | | secmaster:baseline:downloadTemplate | 授予权限下载基线检查模板。 | read | baseline \* | - | - | | secmaster:resource:get | 授予权限获取资源详情。 | read | resource \* | - | - | | secmaster:resource:getRelations | 授予权限获取资源拓扑。 | read | resource \* | - | - | | secmaster:resource:update | 授予权限更新资源。 | write | resource \* | - | - | | secmaster:resource:batchUpdate | 授予权限批量更新资源。 | write | resource \* | - | - | | secmaster:resource:batchDelete | 授予权限批量删除资源。 | write | resource \* | - | - | | secmaster:resource:export | 授予权限导出资源。 | read | resource \* | - | - | | secmaster:resource:getSyncStatus | 授予权限查看资源同步状态。 | read | resource \* | - | - | | secmaster:resource:sync | 授予权限同步资源。 | write | resource \* | - | - | | secmaster:guide:get | 授予权限查询用户指引。 | read | - | - | - | | secmaster:guide:create | 授予权限创建用户指引。 | write | - | - | - | | secmaster:shipper:list | 授予权限获取投递信息列表。 | list | shipper \* | - | - | | secmaster:shipper:create | 授予权限创建数据投递。 | write | shipper \* | - | - | | secmaster:shipper:delete | 授予权限删除投递信息。 | write | shipper \* | - | - | | secmaster:shipper:createAuthorization | 授予权限投递授权。 | write | shipper \* | - | - | | secmaster:shipper:listAuthorizations | 授予权限获取投递授权信息列表。 | list | shipper \* | - | - | | secmaster:shipper:handleAuthorization | 授予权限授权处理。 | write | shipper \* | - | - | | secmaster:shipper:get | 授予权限获取投递规则详情。 | read | shipper \* | - | - | | secmaster:shipper:resume | 授予权限启动投递。 | write | shipper \* | - | - | | secmaster:shipper:pause | 授予权限投递挂起。 | write | shipper \* | - | - | | secmaster:shipper:getDelegateAuth | 授予权限获取委托权限。 | read | shipper \* | - | - | | secmaster:shipper:createDelegateAuth | 授予权限创建委托权限。 | write | shipper \* | - | - | | secmaster:shipper:retryAuthorization | 授予权限重新授权。 | write | shipper \* | - | - | | secmaster:shipper:retry | 授予权限重新投递。 | write | shipper \* | - | - | | secmaster:adHocQuery:create | 授予权限执行analysis语句。 | write | - | - | - | | secmaster:adHocQuery:get | 授予权限查询语句结果。 | read | - | - | - | | secmaster:adHocQuery:delete | 授予权限关闭查询操作。 | write | - | - | - | | secmaster:dataTransformation:list | 授予权限查询数据转移任务。 | list | - | - | - | | secmaster:dataTransformation:get | 授予权限查询数据转移任务详情。 | read | - | - | - | | secmaster:dataTransformation:enable | 授予权限启用数据转移任务。 | write | - | - | - | | secmaster:dataTransformation:create | 授予权限创建数据转移任务。 | write | - | - | - | | secmaster:dataTransformation:delete | 授予权限删除数据转移任务。 | write | - | - | - | | secmaster:dataTransformation:update | 授予权限更新数据转移任务。 | write | - | - | - | 表2SecMaster支持的授权项Part2 | 授权项 | 描述 | 访问级别 | 资源类型（\*为必要） | 条件键 | 别名 | |:---|:---|:---|:---|:---|:---| | secmaster:dataTransformation:listMetrics | 授予权限查询数据转移任务指标。 | read | - | - | - | | secmaster:dataTransformation:disable | 授予权限停用数据转移任务。 | write | - | - | - | | secmaster:analysisScript:list | 授予权限查询分析脚本。 | list | - | - | - | | secmaster:analysisScript:create | 授予权限创建分析脚本。 | write | - | - | - | | secmaster:analysisScript:get | 授予权限查询分析脚本详情。 | read | - | - | - | | secmaster:analysisScript:update | 授予权限更新分析脚本。 | write | - | - | - | | secmaster:analysisScript:delete | 授予权限删除分析脚本。 | write | - | - | - | | secmaster:codeSegment:list | 授予权限查询代码片段。 | list | - | - | - | | secmaster:codeSegment:create | 授予权限创建代码片段。 | write | - | - | - | | secmaster:codeSegment:get | 授予权限查询代码片段详情。 | read | - | - | - | | secmaster:codeSegment:update | 授予权限更新代码片段。 | write | - | - | - | | secmaster:codeSegment:delete | 授予权限删除代码片段。 | write | - | - | - | | secmaster:retrieveScript:list | 授予权限查询检索脚本。 | list | - | - | - | | secmaster:retrieveScript:create | 授予权限创建检索脚本。 | write | - | - | - | | secmaster:retrieveScript:get | 授予权限查询检索脚本详情。 | read | - | - | - | | secmaster:retrieveScript:update | 授予权限更新检索脚本。 | write | - | - | - | | secmaster:retrieveScript:delete | 授予权限删除检索脚本。 | write | - | - | - | | secmaster:pipe:updateSchema | 授予权限修改管道字段。 | write | pipe \* | - | - | | secmaster:node:create | 授予权限新建节点。 | write | - | - | - | | secmaster:node:monitor | 授予权限监控节点信息。 | write | - | - | - | | secmaster:node:updateTaskNodeStatus | 授予权限修改节点任务状态。 | write | - | - | - | | secmaster:node:taskQueueDetail | 授予权限查询节点任务详情。 | read | - | - | - | | secmaster:analysisScript:export | 授予权限导出分析脚本。 | read | analysisScript \* | - | - | | secmaster:analysisScript:import | 授予权限导入分析脚本。 | write | analysisScript \* | - | - | | secmaster:cloudLog:create | 授予权限保存云服务日志订阅配置。 | write | - | - | - | | secmaster:cloudLog:delete | 授予权限删除云服务日志订阅配置。 | write | - | - | - | | secmaster:cloudLog:list | 授予权限获取云服务日志订阅配置。 | list | - | - | - | | secmaster:cloudLog:listResourceConfig | 授予权限查询资产订阅配置。 | list | workspace \* | - | - | | secmaster:collector:createConfig | 授予权限保存云服务日志订阅配置。 | write | - | - | - | | secmaster:collector:listConfig | 授予权限获取云服务日志订阅配置。 | list | - | - | - | | secmaster:collectorChannel:create | 授予权限创建采集通道。 | write | collectorChannel \* | - | - | | secmaster:collectorChannel:createOperation | 授予权限控制采集通道。 | write | collectorChannel \* | - | - | | secmaster:collectorChannel:delete | 授予权限删除采集通道。 | write | collectorChannel \* | - | - | | secmaster:collectorChannel:get | 授予权限获取采集通道详情。 | read | collectorChannel \* | - | - | | secmaster:collectorChannel:list | 授予权限获取采集通道列表。 | list | collectorChannel \* | - | - | | secmaster:collectorChannel:listInstances | 授予权限获取采集通道实例列表。 | list | collectorChannel \* | - | - | | secmaster:collectorChannel:listNodes | 授予权限获取采集通道节点列表。 | list | collectorChannel \* | - | - | | secmaster:collectorChannel:update | 授予权限更新采集通道。 | write | collectorChannel \* | - | - | | secmaster:collectorChannelGroup:create | 授予权限创建采集通道分组。 | write | collectorChannelGroup \* | - | - | | secmaster:collectorChannelGroup:delete | 授予权限删除采集通道分组。 | write | collectorChannelGroup \* | - | - | | secmaster:collectorChannelGroup:list | 授予权限获取采集通道分组列表。 | list | collectorChannelGroup \* | - | - | | secmaster:collectorChannelGroup:update | 授予权限更新采集通道分组列表。 | write | collectorChannelGroup \* | - | - | | secmaster:collectorConnection:create | 授予权限创建采集器连接。 | write | collectorConnection \* | - | - | | secmaster:collectorConnection:delete | 授予权限删除采集器连接。 | write | collectorConnection \* | - | - | | secmaster:collectorConnection:get | 授予权限获取采集器连接详情。 | read | collectorConnection \* | - | - | | secmaster:collectorConnection:list | 授予权限获取采集器连接列表。 | list | collectorConnection \* | - | - | | secmaster:collectorConnection:update | 授予权限更新采集器连接。 | write | collectorConnection \* | - | - | | secmaster:collectorNode:list | 授予权限获取采集节点列表。 | list | workspace \* | - | - | | secmaster:collectorParser:create | 授予权限创建采集解析器。 | write | collectorParser \* | - | - | | secmaster:collectorParser:delete | 授予权限删除采集解析器。 | write | collectorParser \* | - | - | | secmaster:collectorParser:export | 授予权限导出采集解析器。 | read | collectorParser \* | - | - | | secmaster:collectorParser:get | 授予权限获取采集解析器详情。 | read | collectorParser \* | - | - | | secmaster:collectorParser:list | 授予权限获取采集解析器列表。 | list | collectorParser \* | - | - | | secmaster:collectorParser:listTemplates | 授予权限获取采集解析器模板列表。 | list | collectorParser \* | - | - | | secmaster:component:get | 授予权限获取组件详情。 | read | component \* | - | - | | secmaster:component:list | 授予权限获取组件列表。 | list | component \* | - | - | | secmaster:component:listConfigurationVersions | 授予权限获取组件历史版本的配置数据。 | list | component \* | - | - | | secmaster:component:listConfigurations | 授予权限获取组件配置列表。 | list | component \* | - | - | | secmaster:component:listRunningNodes | 授予权限获取组件运行节点列表。 | list | component \* | - | - | | secmaster:component:listTemplates | 授予权限获取组件模板列表。 | list | component \* | - | - | | secmaster:component:updateConfigurations | 授予权限更新组件配置。 | write | component \* | - | - | | secmaster:node:delete | 授予权限删除节点信息。 | write | node \* | - | - | | secmaster:node:list | 授予权限查询节点信息列表。 | list | node \* | - | - | | secmaster:node:update | 授予权限更新节点信息。 | write | node \* | - | - | | secmaster:table:createConsumption | 授予权限创建表数据消费。 | write | table \* | - | - | | secmaster:table:deleteConsumption | 授予权限删除表数据消费。 | write | table \* | - | - | | secmaster:table:getConsumption | 授予权限获取表数据消费信息。 | read | table \* | - | - | | secmaster:accountAgency:list | 授予权限查询账号纳管信息。 | read | accountAgency \* | - | - | | secmaster:accountAgency:create | 授予权限创建账号纳管。 | write | accountAgency \* | - | - | | secmaster:accountAgency:get | 授予权限获取账号纳管信息。 | read | accountAgency \* | - | - | | secmaster:accountAgency:update | 授予权限更新账号纳管。 | write | accountAgency \* | - | - | | secmaster:accountAgency:delete | 授予权限批量解除账号纳管。 | write | accountAgency \* | - | - | | secmaster:dataobject:update | 授予权限更新数据对象 | write | dataobject \* | - | - | | secmaster:dataobject:list | 授予权限搜索数据对象列表 | list | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:dataobject:import | 授予权限导入数据对象 | write | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:dataobject:export | 授予权限导出数据对象 | read | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:dataobject:get | 授予权限获取数据对象详情 | read | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:dataobject:delete | 授予权限删除数据对象 | write | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:dataobject:create | 授予权限创建数据对象 | write | dataobject \* | [secmaster:TargetDataobject] | - | | secmaster:workbench:update | 授予权限更新工作台 | write | workbench \* | [secmaster:TargetDataobject] | - | | secmaster:workbench:list | 授予权限搜索工作台列表 | list | workbench \* | - | - | | secmaster:workbench:get | 授予权限获取工作台详情 | read | workbench \* | - | - | | secmaster:workbench:delete | 授予权限删除工作台 | write | workbench \* | - | - | | secmaster:workbench:create | 授予权限创建工作台 | write | workbench \* | - | - | | secmaster:workflow:updateInstance | 授予权限更新流程实例 | write | workflow \* | - | - | | secmaster:workflow:listInstance | 授予权限查询流程实例列表 | list | workflow \* | - | - | | secmaster:workflow:getInstanceDetail | 授予权限查询流程实例详情 | read | workflow \* | - | - | | secmaster:workflow:createInstance | 授予权限创建流程实例 | write | workflow \* | - | - | | secmaster:validation:create | 授予验证SQL的权限 | write | validation \* | - | - | | secmaster:upgradation:read | 授予检查升级的权限 | read | upgradation \* | - | - | | secmaster:subscription:updateOrder | 授予权限更新订阅 | write | subscription \* | - | - | | secmaster:subscription:getProduct | 授予权限查询商品 | list | subscription \* | - | - | | secmaster:subscription:getOrder | 授予权限查询订阅 | list | subscription \* | - | - | | secmaster:subscription:get | 授予获取订阅资源的权限 | read | subscription \* | - | - | | secmaster:subscription:deleteOrder | 授予权限取消订阅 | write | subscription \* | - | - | | secmaster:subscription:createOrder | 授予权限创建订阅 | write | subscription \* | - | - | | secmaster:shipper:getParam | 授予获取参数的权限 | read | shipper \* | - | - | | secmaster:report:action | 授予权限发送安全报告邮件 | write | report \* | - | - | | secmaster:policyRecords:list | 授予权限通过策略ID查询策略记录列表 | list | policy \* | - | - | | secmaster:node:updateVpceps | 授予更新vpceps的权限 | write | node \* | - | - | | secmaster:node:listVpceps | 授予列出vpceps的权限 | list | node \* | - | - | | secmaster:node:listInstallationScripts | 授予列出安装脚本的权限 | list | node \* | - | - | | secmaster:monitor:listMetricStats | 授予列出指标统计的权限 | list | monitor \* | - | - | | secmaster:mapping:listFilterRules | 授予权限查询预处理规则列表 | list | mapping \* | - | - | | secmaster:mapping:createFilterRules | 授予权限创建预处理规则 | write | mapping \* | - | - | | secmaster:layout:operate | 授予权限导入/导出布局 | write | layout \* | - | - | | secmaster:directories:list | 授予列出目录的权限 | list | directories \* | - | - | | secmaster:configuration:updateConfigDictionary | 授予权限更新字典 | write | configuration \* | - | - | | secmaster:configuration:getConfigDictionary | 授予权限查询字典 | list | configuration \* | - | - | | secmaster:configuration:deleteConfigDictionary | 授予权限删除字典 | write | configuration \* | - | - | | secmaster:configuration:createConfigDictionary | 授予权限创建字典 | write | configuration \* | - | - | | secmaster:component:updateTemplate | 授予权限更新插件配置模板 | write | component \* | - | - | | secmaster:component:listActions | 授予权限获取插件执行函数列表 | list | component \* | - | - | | secmaster:component:getTemplate | 授予权限查询插件配置模板详情 | read | component \* | - | - | | secmaster:component:getDownloadUrl | 授予权限下载一个附件 | read | component \* | - | - | | secmaster:component:getAction | 授予权限获取组件列表 | read | component \* | - | - | | secmaster:component:deleteTemplate | 授予权限删除插件配置模板 | write | component \* | - | - | | secmaster:component:createTemplate | 授予权限创建插件配置模板 | write | component \* | - | - | | secmaster:component:createConfigurationApplication | 授予应用组件配置的权限 | write | component \* | - | - | | secmaster:component:create | 授予权限创建插件 | write | component \* | - | - | | secmaster:collectorModuleTemplate:listRestrictions | 授予列出模块模板限制的权限 | list | collectorModuleTemplate \* | - | - | | secmaster:collectorModuleTemplate:list | 授予列出模块模板的权限 | list | collectorModuleTemplate \* | - | - | | secmaster:collectorFile:create | 授予创建文件的权限 | write | collectorFile \* | - | - | | secmaster:cloudLog:listManagers | 授予列出管理者的权限 | list | cloudLog \* | - | - | | secmaster:cloudLog:getTenantWhitelist | 授予获取租户白名单的权限 | list | cloudLog \* | - | - | | secmaster:cloudLog:createResource | 授予创建云日志资源的权限 | write | cloudLog \* | - | - | | secmaster:catalogue:delete | 授予权限删除目录 | write | catalogue \* | - | - | | secmaster:catalogue:create | 授予权限创建目录 | write | catalogue \* | - | - | | secmaster:baseline:updatePackages | 授予权限更新遵从包 | write | baseline \* | - | - | | secmaster:baseline:updateCheckitem | 授予权限更新检查项 | write | baseline \* | - | - | | secmaster:baseline:listPackages | 授予权限查看遵从包列表 | list | baseline \* | - | - | | secmaster:baseline:listCheckitems | 授予权限查看检查项列表 | list | baseline \* | - | - | | secmaster:baseline:getPackageDetail | 授予权限查看遵从包详情 | read | baseline \* | - | - | | secmaster:baseline:getCheckitemDetail | 授予权限获取检查项详情 | read | baseline \* | - | - | | secmaster:baseline:deletePackages | 授予权限删除遵从包 | write | baseline \* | - | - | | secmaster:baseline:deleteCheckitem | 授予权限删除检查项 | write | baseline \* | - | - | | secmaster:baseline:createPackages | 授予权限创建遵从包 | write | baseline \* | - | - | | secmaster:baseline:createCheckitem | 授予权限创建检查项 | write | baseline \* | - | - | | secmaster:vendor:list | 授予权限查询厂商列表 | list | vendor \* | - | - | | secmaster:vendor:create | 授予权限创建厂商 | write | vendor \* | - | - | | secmaster:vendor:get | 授予权限查询厂商详情 | read | vendor \* | - | - | | secmaster:vendor:update | 授予权限更新厂商 | write | vendor \* | - | - | | secmaster:vendor:delete | 授予权限批量删除厂商 | write | vendor \* | - | - | | secmaster:provider:list | 授予权限查询产品列表 | list | provider \* | - | - | | secmaster:provider:create | 授予权限创建产品 | write | provider \* | - | - | | secmaster:provider:get | 授予权限查询产品详情 | read | provider \* | - | - | | secmaster:provider:update | 授予权限更新产品 | write | provider \* | - | - | | secmaster:provider:delete | 授予权限批量删除产品 | write | provider \* | - | - | | secmaster:credential:list | 授予权限查询凭据列表 | list | credential \* | - | - | | secmaster:credential:create | 授予权限创建凭据 | write | credential \* | - | - | | secmaster:credential:get | 授予权限查询凭据详情 | read | credential \* | - | - | | secmaster:credential:update | 授予权限更新凭据 | write | credential \* | - | - | | secmaster:credential:delete | 授予权限批量删除凭据 | write | credential \* | - | - | | secmaster:connector:list | 授予权限搜索连接器列表 | list | connector \* | - | - | | secmaster:connector:create | 授予权限创建连接器 | write | connector \* | - | - | | secmaster:connector:get | 授予权限获取连接器详情 | read | connector \* | - | - | | secmaster:connector:update | 授予权限修改连接器 | write | connector \* | - | - | | secmaster:connector:delete | 授予权限批量删除连接器 | write | connector \* | - | - | | secmaster:connectorDatalink:create | 授予权限创建连接器数据链路 | write | connectorDatalink \* | - | - | | secmaster:connectorDatalink:get | 授予权限获取连接器数据链路详情 | read | connectorDatalink \* | - | - | | secmaster:connectorDatalink:update | 授予权限更新连接器数据链路 | write | connectorDatalink \* | - | - | | secmaster:connectorDatalink:delete | 授予权限删除连接器数据链路 | write | connectorDatalink \* | - | - | | secmaster:connectorInstance:list | 授予权限搜索连接器实例列表 | list | connectorInstance \* | - | - | | secmaster:resource:batchCreateFingerprints | 授予权限批量创建资产指纹 | write | resource \* | - | - | | secmaster:resource:batchCreate | 授予权限批量创建资产 | write | resource \* | - | - | | secmaster:resource:batchCreateRelations | 授予权限批量创建资产关系 | write | resource \* | - | - | SecMaster的API通常对应着一个或多个授权项。[表3]展示了API与授权项的关系，以及该API需要依赖的授权项。 表3API与操作项的关系 | API | 对应的授权项 | 依赖的授权项 | |:---|:---|:---| | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/{playbook_id} | secmaster:playbook:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks | secmaster:playbook:create | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/{playbook_id} | secmaster:playbook:delete | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/{playbook_id} | secmaster:playbook:update | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks | secmaster:playbook:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/statistics | secmaster:playbook:getStatistics | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/{playbook_id}/monitor | secmaster:playbook:getMonitor | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{playbook_version_id}/clone | secmaster:playbook:copyVersion | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{playbook_version_id}/approve | secmaster:playbook:approve | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/approval | secmaster:playbook:listApproves | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/instances | secmaster:playbook:listInstances | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/instances/auditlogs | secmaster:playbook:getInstanceAuditlog | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions | secmaster:playbook:createVersion | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{playbook_version_id} | secmaster:playbook:getVersion | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{playbook_version_id} | secmaster:playbook:deleteVersion | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{playbook_version_id} | secmaster:playbook:updateVersion | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/{playbook_id}/versions | secmaster:playbook:listVersions | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/instances/{instance_id} | secmaster:playbook:getInstance | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/instances/{instance_id}/topology | secmaster:playbook:getInstanceTopology | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/instances/{instance_id}/operation | secmaster:playbook:operateInstance | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows | secmaster:workflow:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id} | secmaster:workflow:get | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id} | secmaster:workflow:delete | - | | GET /v1/{project_id}/workspacesPOST /v1/{project_id}/workspaces/{workspace_id}/soc/workflows | secmaster:workflow:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id} | secmaster:workflow:update | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions | secmaster:workflow:listVersions | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions/{version_id} | secmaster:workflow:getVersion | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions/{version_id} | secmaster:workflow:deleteVersion | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions | secmaster:workflow:createVersion | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions/{version_id} | secmaster:workflow:updateVersion | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions/{version_id}/approval | secmaster:workflow:approveVersion | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/validation | secmaster:workflow:validate | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/versions/{version_id}/debug/result | secmaster:workflow:simulate | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances/{instance_id}/topology | secmaster:workflow:getInstance | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/{workflow_id}/instances | secmaster:workflow:createInstance， secmaster:workflow:updateInstance | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/assetcredentials | secmaster:connection:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/assetcredentials | secmaster:connection:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/assetcredentials/{asset_id} | secmaster:connection:get | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/assetcredentials/{asset_id} | secmaster:connection:delete | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/assetcredentials/{asset_id} | secmaster:connection:update | - | | GET /v1/{project_id}/workspaces | secmaster:workspace:listWorkspace | - | | POST /v1/{project_id}/workspaces | secmaster:workspace:createWorkspace | - | | PUT /v1/{project_id}/workspaces/{workspace_id} | secmaster:workspace:updateWorkspace | - | | GET /v1/{project_id}/workspaces/v1/{project_id}/workspaces/{workspace_id} | secmaster:workspace:getWorkspace | - | | DELETE /v1/{project_id}/workspaces/{workspace_id} | secmaster:workspace:deleteWorkspace | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/tasks | secmaster:task:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/tasks | secmaster:task:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/tasks/{task_id} | secmaster:task:update | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/tasks/{task_id} | secmaster:task:get | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/{indicator_id} | secmaster:indicator:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators | secmaster:indicator:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/{indicator_id} | secmaster:indicator:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/{indicator_id} | secmaster:indicator:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/search | secmaster:indicator:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/types | secmaster:indicator:listTypes | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/types/layout | secmaster:indicator:bindLayout | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/{alert_id} | secmaster:alert:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts | secmaster:alert:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/{alert_id} | secmaster:alert:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/search | secmaster:alert:list | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/alerts | secmaster:alert:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/batch-order | secmaster:alert:batchOrders | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types | secmaster:alert:listTypes | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types/category | secmaster:alert:listCategories | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types | secmaster:alert:createType | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types/{dataclass_type_id} | secmaster:alert:updateType | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types | secmaster:alert:deleteType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types/enable | secmaster:alert:enableType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/types/layout | secmaster:alert:bindLayout | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/{incident_id} | secmaster:incident:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/incidents | secmaster:incident:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/{incident_id} | secmaster:incident:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/search | secmaster:incident:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types | secmaster:incident:listTypes | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/incidents | secmaster:incident:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types/category | secmaster:incident:listCategories | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types | secmaster:incident:createType | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types/{dataclass_type_id} | secmaster:incident:updateType | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types | secmaster:incident:deleteType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/alerts/incidents/enable | secmaster:incident:enableType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/incidents/types/layout | secmaster:incident:bindLayout | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/{dataclass_type}/{data_object_id}/{related_dataclass_type} | secmaster:dataobject:createRelation | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/{dataclass_type}/{data_object_id}/{related_dataclass_type} | secmaster:dataobject:deleteRelation | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/{dataclass_type}/{data_object_id}/{related_dataclass_type}/search | secmaster:dataobject:listRelation | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerability/search | secmaster:vulnerability:listGroup | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerability/{vul_id} | secmaster:vulnerability:getGroup | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerability/export | secmaster:vulnerability:exportGroup | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types | secmaster:vulnerability:listType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types/layout | secmaster:vulnerability:bindLayout | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types | secmaster:vulnerability:createType | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types/{dataclass_type_id} | secmaster:vulnerability:updateType | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types | secmaster:vulnerability:deleteType | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vulnerabilities/types/enable | secmaster:vulnerability:enableType | - | | DELETE /v1/{project_id}/subscriptions/orders | secmaster:subscription:deletePostPaidOrder | - | | POST /v1/{project_id}/subscriptions/orders | secmaster:subscription:createPostPaidOrder | - | | POST /v1/{project_id}/subscriptions/orders/{order_id} | secmaster:subscription:createPrePaidOrder | - | | GET /v1/{project_id}/subscriptions/version | secmaster:subscription:getVersion | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/metrics/{metric_id}/result | secmaster:metric:getResult | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/metrics/results | secmaster:metric:listResults | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/metrics/hits | secmaster:metric:listHits | - | | GET /v1/{project_id}/agency | secmaster:agency:get | - | | POST /v1/{project_id}/agency | secmaster:agency:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/resource-statistics | secmaster:resource:getStatistics | - | | GET /v1/{project_id}/workspaces/{workspace_id}/resources | secmaster:resource:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/resources/import | secmaster:resource:import | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/resource/template | secmaster:resource:getTemplate | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/reports | secmaster:report:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/reports/{report_id} | secmaster:report:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/reports | secmaster:report:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/sa/reports/{report_id} | secmaster:report:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/sa/reports/{report_id} | secmaster:report:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/vulnerability/read-status | secmaster:emergencyVulnerability:updateReadStatus | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/vulnerability/list | secmaster:emergencyVulnerability:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/sa/vulnerability/export | secmaster:emergencyVulnerability:export | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/dataspaces | secmaster:dataspace:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/dataspaces | secmaster:dataspace:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/dataspaces/{dataspace_id} | secmaster:dataspace:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/siem/dataspaces/{dataspace_id} | secmaster:dataspace:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/siem/dataspaces/{dataspace_id} | secmaster:dataspace:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/pipes | secmaster:pipe:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/pipes | secmaster:pipe:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id} | secmaster:pipe:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id} | secmaster:pipe:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id} | secmaster:pipe:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id}/index | secmaster:pipe:getIndex | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id}/index | secmaster:pipe:updateIndex | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id}/consumption | secmaster:pipe:getConsumption | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id}/consumption | secmaster:pipe:createConsumption | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/siem/pipes/{pipe_id}/consumption | secmaster:pipe:deleteConsumption | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/search/logs | secmaster:search:listLogs | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/search/histograms | secmaster:search:listHistograms | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/search/analysis | secmaster:search:createAnalysis | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/search/conditions | secmaster:searchCondition:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/search/conditions | secmaster:searchCondition:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/search/conditions/{condition_id} | secmaster:searchCondition:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/siem/search/conditions/{condition_id} | secmaster:searchCondition:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/siem/search/conditions/{condition_id} | secmaster:searchCondition:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules | secmaster:alertRule:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules | secmaster:alertRule:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/{rule_id} | secmaster:alertRule:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/{rule_id} | secmaster:alertRule:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules | secmaster:alertRule:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/enable | secmaster:alertRule:enable | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/disable | secmaster:alertRule:disable | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/metrics | secmaster:alertRule:listMetrics | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/simulation | secmaster:alertRule:createSimulation | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/templates | secmaster:alertRuleTemplate:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/templates/{template_id} | secmaster:alertRuleTemplate:get | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/alert-rules/templates/metrics | secmaster:alertRuleTemplate:listMetrics | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses | secmaster:dataclass:create | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id} | secmaster:dataclass:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id} | secmaster:dataclass:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id} | secmaster:dataclass:get | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses | secmaster:dataclass:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/fields | secmaster:dataclass:createField | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/fields/{field_id} | secmaster:dataclass:updateField | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/fields | secmaster:dataclass:deleteField | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/fields/{field_id} | secmaster:dataclass:getField | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/fields | secmaster:dataclass:listFields | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/types/{dataclass_type_id} | secmaster:dataclass:getType | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/dataclasses/{dataclass_id}/types | secmaster:dataclass:listTypes | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/{mapping_id}/status | secmaster:mapping:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/search | secmaster:mapping:list | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/data-source | secmaster:mapping:getDatasource | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/functions | secmaster:mapping:listFunctions | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/{mapping_id} | secmaster:mapping:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/{mapping_id}/clone | secmaster:mapping:copy | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/classifiers | secmaster:mapping:createClassifier | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/classifiers/{classifier_id} | secmaster:mapping:updateClassifier | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/classifiers/{classifier_id} | secmaster:mapping:getClassifier | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/classifiers/{classifier_id} | secmaster:mapping:deleteClassifier | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/mappers | secmaster:mapping:createMapper | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/mappers/{mapper_id} | secmaster:mapping:updateMapper | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/mappers/search | secmaster:mapping:listMappers | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/mappers/{mapper_id} | secmaster:mapping:getMapper | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/mappers/{mapper_id} | secmaster:mapping:deleteMapper | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/business-type | secmaster:layout:listBusinessTypes | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/search | secmaster:layout:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts | secmaster:layout:create | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/layouts | secmaster:layout:delete | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id} | secmaster:layout:update | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id} | secmaster:layout:get | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/template | secmaster:layout:createTemplate | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/fields | secmaster:layout:createField | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/fields | secmaster:layout:listFields | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/fields/{field_id} | secmaster:layout:getField | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/fields/{field_id} | secmaster:layout:updateField | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/fields | secmaster:layout:deleteField | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/wizards | secmaster:layout:listWizards | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/{layout_id}/wizards | secmaster:layout:createWizard | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/wizards/{wizard_id};/v1/{project_id}/workspaces/{workspace_id}/soc/layouts/wizards | secmaster:layout:getWizard | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/wizards/{wizard_id} | secmaster:layout:deleteWizard | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/wizards | secmaster:layout:updateWizard | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/catalogues/search;/v1/{project_id}/workspaces/{workspace_id}/soc/catalogues | secmaster:catalogue:list | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/catalogues/{catalogue_id} | secmaster:catalogue:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/export | secmaster:playbook:export | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/import | secmaster:playbook:import | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/template/download | secmaster:indicator:downloadTemplate | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/export | secmaster:indicator:export | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/indicators/import | secmaster:indicator:import | - | | GET /v2/{project_id}/workspaces/{workspace_id}/siem/tables | secmaster:table:list | - | | -POST /v2/{project_id}/workspaces/{workspace_id}/siem/tables | secmaster:table:create | - | | GET /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id} | secmaster:table:get | - | | PUT /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id} | secmaster:table:update | - | | DELETE /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id} | secmaster:table:delete | - | | POST /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id}/lock | secmaster:table:createLock | - | | DELETE /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id}/lock | secmaster:table:deleteLock | - | | GET /v2/{project_id}/workspaces/{workspace_id}/siem/tables/metrics | secmaster:table:listMetrics | - | | PUT /v2/{project_id}/workspaces/{workspace_id}/siem/tables/{table_id}/schema | secmaster:table:updateSchema | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/actions | secmaster:playbook:createVersionAction | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/rules | secmaster:playbook:createVersionRule | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/actions/{action_id} | secmaster:playbook:deleteVersionAction | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/rules/{rule_id} | secmaster:playbook:deleteVersionRule | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/rules/{rule_id} | secmaster:playbook:getVersionRule | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/actions | secmaster:playbook:listVersionActions | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/actions/{action_id} | secmaster:playbook:updateVersionAction | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/playbooks/versions/{version_id}/actions/{action_id} | secmaster:playbook:updateVersionRule | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances | secmaster:workflow:listInstance | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/workflows/instances/{instance_id} | secmaster:workflow:getInstanceDetail | - | | POST /v2/{project_id}/workspaces/{workspace_id}/siem/sql/validation | secmaster:validation:create | - | | GET /v2/{project_id}/siem/upgradation/{upgrade_type} | secmaster:upgradation:read | - | | PUT /v1/{project_id}/subscriptions/orders | secmaster:subscription:updateOrder | - | | GET /v1/{project_id}/subscriptions/products | secmaster:subscription:getProduct | - | | GET /v1/{project_id}/subscriptions/orders | secmaster:subscription:getOrder | - | | GET /v2/{project_id}/workspaces/{workspace_id}/siem/subscription/resource | secmaster:subscription:get | - | | DELETE /v1/{project_id}/subscriptions/orders | secmaster:subscription:deleteOrder | - | | POST /v1/{project_id}/subscriptions/orders | secmaster:subscription:createOrder | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/shippers/params/{param_type} | secmaster:shipper:getParam | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/reports/{report_id}/action | secmaster:report:action | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/policy-records/search | secmaster:policyRecords:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/nodes/vpc-endpoint-services | secmaster:node:updateVpceps | - | | GET /v1/{project_id}/workspaces/{workspace_id}/nodes/vpc-endpoint-services | secmaster:node:listVpceps | - | | GET /v1/{project_id}/workspaces/{workspace_id}/nodes/installation-scripts | secmaster:node:listInstallationScripts | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/moniter/metric/statistics | secmaster:monitor:listMetricStats | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/preprocess-rules/search | secmaster:mapping:listFilterRules | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/mappings/preprocess-rules | secmaster:mapping:createFilterRules | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/layouts/action | secmaster:layout:operate | - | | GET /v2/{project_id}/workspaces/{workspace_id}/siem/directories | secmaster:directories:list | - | | PUT /v1/{project_id}/configurations/dictionaries | secmaster:configuration:updateConfigDictionary | - | | GET /v1/{project_id}/configurations/dictionaries | secmaster:configuration:getConfigDictionary | - | | DELETE /v1/{project_id}/configurations/dictionaries | secmaster:configuration:deleteConfigDictionary | - | | POST /v1/{project_id}/configurations/dictionaries | secmaster:configuration:createConfigDictionary | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/components/template/{template_id} | secmaster:component:updateTemplate | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/components/{component_id}/action | secmaster:component:listActions | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/components/template/{template_id} | secmaster:component:getTemplate | - | | GET /v1/{project_id}/workspaces/{workspace_id}/components/{component_id}/templates | secmaster:component:getDownloadUrl | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/components/{component_id}/action/{action_id} | secmaster:component:getAction | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/components/template/{template_id} | secmaster:component:deleteTemplate | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/components/template | secmaster:component:createTemplate | - | | POST /v1/{project_id}/workspaces/{workspace_id}/components/{component_id}/configurations/application | secmaster:component:createConfigurationApplication | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/components/upload | secmaster:component:create | - | | POST /v1/{project_id}/workspaces/{workspace_id}/collector/module-templates/restriction | secmaster:collectorModuleTemplate:listRestrictions | - | | GET /v1/{project_id}/workspaces/{workspace_id}/collector/module-templates | secmaster:collectorModuleTemplate:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/collector/files | secmaster:collectorFile:create | - | | GET /v1/{project_id}/siem/cloud-logs/managers | secmaster:cloudLog:listManagers | - | | GET /v1/{project_id}/workspaces/{workspace_id}/siem/cloud-logs/tenant/whitelist | secmaster:cloudLog:getTenantWhitelist | - | | POST /v1/{project_id}/workspaces/{workspace_id}/siem/cloud-logs/resource | secmaster:cloudLog:createResource | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/catalogues | secmaster:catalogue:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/catalogues | secmaster:catalogue:create | - | | PUT /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/compliance-packages/{compliance_packages_id} | secmaster:baseline:updatePackages | - | | PUT /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/checkitems/{checkitem_id} | secmaster:baseline:updateCheckitem | - | | POST /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/compliance-packages/search | secmaster:baseline:listPackages | - | | POST /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/checkitems/search | secmaster:baseline:listCheckitems | - | | GET /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/compliance-packages/{compliance_packages_id} | secmaster:baseline:getPackageDetail | - | | GET /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/checkitems/{checkitem_id} | secmaster:baseline:getCheckitemDetail | - | | DELETE /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/compliance-packages | secmaster:baseline:deletePackages | - | | DELETE /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/checkitems | secmaster:baseline:deleteCheckitem | - | | POST /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/compliance-packages | secmaster:baseline:createPackages | - | | POST /v2/{project_id}/workspaces/{workspace_id}/sa/baseline/checkitems | secmaster:baseline:createCheckitem | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/vendors | secmaster:vendor:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vendors | secmaster:vendor:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/vendors/{vendor_id} | secmaster:vendor:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/vendors/{vendor_id} | secmaster:vendor:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/vendors/batch-delete | secmaster:vendor:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/providers | secmaster:provider:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/providers | secmaster:provider:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/providers/{provider_id} | secmaster:provider:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/providers/{provider_id} | secmaster:provider:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/providers/batch-delete | secmaster:provider:delete | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/credentials | secmaster:credential:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/credentials | secmaster:credential:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/credentials/{credential_id} | secmaster:credential:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/credentials/{credential_id} | secmaster:credential:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/credentials/batch-delete | secmaster:credential:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/search | secmaster:connector:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/connectors | secmaster:connector:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id} | secmaster:connector:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id} | secmaster:connector:update | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/batch-delete | secmaster:connector:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id}/datalinks | secmaster:connectorDatalink:create | - | | GET /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id}/datalinks/{datalink_id} | secmaster:connectorDatalink:get | - | | PUT /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id}/datalinks/{datalink_id} | secmaster:connectorDatalink:update | - | | DELETE /v1/{project_id}/workspaces/{workspace_id}/soc/connectors/{connector_id}/datalinks/{datalink_id} | secmaster:connectorDatalink:delete | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/connector-instances/{connector_id}/search | secmaster:connectorInstance:list | - | | POST /v1/{project_id}/workspaces/{workspace_id}/sa/resources/batch-create-resources-fingerprints | secmaster:resource:batchCreateFingerprints | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/datapanel/{dataclass}/data-objects/batch-create | secmaster:resource:batchCreate | - | | POST /v1/{project_id}/workspaces/{workspace_id}/soc/{dataclass_type}/{related_dataclass_type}/batch-create | secmaster:resource:batchCreateRelations | - | #### 资源类型（Resource） 资源类型（Resource）表示SCP所作用的资源。某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的SCP语句中指定该资源的URN，SCP仅作用于此资源；如未指定，Resource默认为"\*"，则SCP将应用到所有资源。您也可以在SCP中设置条件，从而指定资源类型。 SecMaster定义了以下可以在SCP的Resource元素中使用的资源类型。 表4SecMaster支持的资源类型 | 资源类型 | URN | |:---|:---| | workspace | secmaster:\:\:workspace:\ | | playbook | secmaster:\:\:playbook:\/\ | | workflow | secmaster:\:\:workflow:\/\ | | connection | secmaster:\:\:connection:\/\ | | task | secmaster:\:\:task:\/\ | | indicator | secmaster:\:\:indicator:\/\ | | alert | secmaster:\:\:alert:\/\ | | incident | secmaster:\:\:incident:\/\ | | dataobject | secmaster:\:\:dataobject:\/\ | | metric | secmaster:\:\:metric:\/\ | | resource | secmaster:\:\:resource:\/\ | | report | secmaster:\:\:report:\/\ | | emergencyVulnerability | secmaster:\:\:emergencyVulnerability:\/\ | | dataspace | secmaster:\:\:dataspace:\/\ | | pipe | secmaster:\:\:pipe:\/\ | | alertRule | secmaster:\:\:alertRule:\/\ | | vulnerability | secmaster:\:\:vulnerability:\/\ | | alertRuleTemplate | secmaster:\:\:alertRuleTemplate:\/\ | | searchCondition | secmaster:\:\:searchCondition:\/\ | | dataclass | secmaster:\:\:dataclass:\/\ | | mapping | secmaster:\:\:mapping:\/\ | | layout | secmaster:\:\:layout:\/\ | | catalogue | secmaster:\:\:catalogue:\/\ | | table | secmaster:\:\:table:\/\ | | policy | secmaster:\:\:policy:\/\ | | baseline | secmaster:\:\:baseline:\/\ | | shipper | secmaster:\:\:shipper:\/\ | | analysisScript | secmaster:\:\:analysisScript:\/\ | | collectorChannel | secmaster:\:\:collectorChannel:\/\ | | collectorChannelGroup | secmaster:\:\:collectorChannelGroup:\/\ | | collectorConnection | secmaster:\:\:collectorConnection:\/\ | | collectorParser | secmaster:\:\:collectorParser:\/\ | | component | secmaster:\:\:component:\/\ | | node | secmaster:\:\:node:\/\ | | accountAgency | secmaster:\:\:accountAgency:\ | | workbench | secmaster:\:\:workbench:\/\ | | validation | secmaster:\:\:validation:\/\ | | upgradation | secmaster:\:\:upgradation:\/\ | | subscription | secmaster:\:\:subscription:\/\ | | monitor | secmaster:\:\:monitor:\/\ | | directories | secmaster:\:\:directories:\/\ | | configuration | secmaster:\:\:configuration:\/\ | | collectorModuleTemplate | secmaster:\:\:collectorModuleTemplate:\/\ | | collectorFile | secmaster:\:\:collectorFile:\/\ | | cloudLog | secmaster:\:\:cloudLog:\/\ | | vendor | secmaster:\:\:vendor:\/\ | | provider | secmaster:\:\:provider:\/\ | | credential | secmaster:\:\:credential:\/\ | | connector | secmaster:\:\:connector:\/\ | | connectorDatalink | secmaster:\:\:connectorDatalink:\/\ | | connectorInstance | secmaster:\:\:connectorInstance:\/\ | #### 条件（Condition） **条件键概述** 条件（Condition）是身份策略生效的特定条件，包括[条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)和[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 - 条件键表示身份策略语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。 - 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：[全局条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)。 - 服务级条件键（前缀通常为服务缩写，如*secmaster* ）仅适用于对应服务的操作，详情请参见[表5]。 - 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。 - 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：[运算符](https://support.huaweicloud.com/usermanual-iam5/iam_01_1289.html#iam_01_1289__li13495143171719)。 **SecMaster支持的服务级条件键** SecMaster定义了以下可以在身份策略的Condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。 SecMaster服务不支持在SCP中的条件键中配置服务级的条件键。 表5SecMaster支持的服务级条件键 | 服务级条件键 | 类型 | 单值/多值 | 说明 | |:---|:---|:---|:---| | secmaster:TargetRegion | 字符串 | 多值 | 根据请求中的托管空间的region属性过滤条件键secmaster:TargetRegion指定的目标区域（Region）。 仅如下Action支持该服务级条件键： - secmaster:workspace:createAgency | | secmaster:TargetDataobject | 字符串 | 多值 | 根据指定的目标数据对象过滤访问。 仅如下Action支持该服务级条件键： - secmaster:dataobject:update - secmaster:dataobject:list - secmaster:dataobject:export - secmaster:dataobject:import - secmaster:dataobject:delete - secmaster:dataobject:create - secmaster:dataobject:get | **secmaster:TargetRegion条件键示例** - secmaster:TargetRegion 示例：表示不允许region id为1的region创建空间托管。 ``` { "Version": "5.0", "Statement": [ { "Effect": "Deny", "Action": [ "secmaster:workspace:createAgency" ], "Condition": { "ForAllValues:StringEquals": { "secmaster:TargetRegion": [ "region_id_1" ] } } } ] } ```