资源粒度授权使用说明
资源类型 | URN |
|---|---|
workspace | secmaster:<region>:<account-id>:workspace:<workspace-id> |
playbook | secmaster:<region>:<account-id>:playbook:<workspace-id>/<playbook-id> |
workflow | secmaster:<region>:<account-id>:workflow:<workspace-id>/<workflow-id> |
connection | secmaster:<region>:<account-id>:connection:<workspace-id>/<connection-id> |
task | secmaster:<region>:<account-id>:task:<workspace-id>/<task-id> |
indicator | secmaster:<region>:<account-id>:indicator:<workspace-id>/<indicator-id> |
alert | secmaster:<region>:<account-id>:alert:<workspace-id>/<alert-id> |
incident | secmaster:<region>:<account-id>:incident:<workspace-id>/<incident-id> |
dataobject | secmaster:<region>:<account-id>:dataobject:<workspace-id>/<dataobject-id> |
metric | secmaster:<region>:<account-id>:metric:<workspace-id>/<metric-id> |
resource | secmaster:<region>:<account-id>:resource:<workspace-id>/<resource-id> |
report | secmaster:<region>:<account-id>:report:<workspace-id>/<report-id> |
emergencyVulnerability | secmaster:<region>:<account-id>:emergencyVulnerability:<workspace-id>/<emergency-vulnerability-id> |
dataspace | secmaster:<region>:<account-id>:dataspace:<workspace-id>/<dataspace-id> |
pipe | secmaster:<region>:<account-id>:pipe:<workspace-id>/<pipe-id> |
alertRule | secmaster:<region>:<account-id>:alertRule:<workspace-id>/<alertRule-id> |
vulnerability | secmaster:<region>:<account-id>:vulnerability:<workspace-id>/<vulnerability-id> |
alertRuleTemplate | secmaster:<region>:<account-id>:alertRuleTemplate:<workspace-id>/<alertRuleTemplate-id> |
searchCondition | secmaster:<region>:<account-id>:searchCondition:<workspace-id>/<searchCondition-id> |
dataclass | secmaster:<region>:<account-id>:dataclass:<workspace-id>/<dataclass-id> |
mapping | secmaster:<region>:<account-id>:mapping:<workspace-id>/<mapping-id> |
layout | secmaster:<region>:<account-id>:layout:<workspace-id>/<layout-id> |
catalogue | secmaster:<region>:<account-id>:catalogue:<workspace-id>/<catalogue-id> |
table | secmaster:<region>:<account-id>:table:<workspace-id>/<table-id> |
policy | secmaster:<region>:<account-id>:policy:<workspace-id>/<policy-id> |
baseline | secmaster:<region>:<account-id>:baseline:<workspace-id>/<baseline-id> |
shipper | secmaster:<region>:<account-id>:shipper:<workspace-id>/<shipper-id> |
analysisScript | secmaster:<region>:<account-id>:analysisScript:<workspace-id>/<analysisScript-id> |
collectorChannel | secmaster:<region>:<account-id>:collectorChannel:<workspace-id>/<collectorChannel-id> |
collectorChannelGroup | secmaster:<region>:<account-id>:collectorChannelGroup:<workspace-id>/<collectorChannelGroup-id> |
collectorConnection | secmaster:<region>:<account-id>:collectorConnection:<workspace-id>/<collectorConnection-id> |
collectorParser | secmaster:<region>:<account-id>:collectorParser:<workspace-id>/<collectorParser-id> |
component | secmaster:<region>:<account-id>:component:<workspace-id>/<component-id> |
node | secmaster:<region>:<account-id>:node:<workspace-id>/<node-id> |
accountAgency | secmaster:<region>:<account-id>:accountAgency:<accountAgency-id> |
设置资源唯一标识时，您需要将<region>、<account-id>、<workspace-id>等变量参数修改为实际的参数信息，或者直接使用*通配符。
资源粒度授权策略示例：
剧本的资源标识secmaster:<region>:<account-id>:playbook:<workspace-id>/<playbook-id>，将
- <region>、<account-id>替换为*通配符。
- <workspace-id>配置为“7430b8e4-be12-4bd4-80f7-1aa02123551c”。
- <playbook-id>替换为*通配符。
将如下策略授权给用户A，表示用户A具有工作空间id为“7430b8e4-be12-4bd4-80f7-1aa02123551c”下的所有剧本的审核权限。
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"secmaster:playbook:approve"
],
"Resource": [
"secmaster:*:*:playbook:7430b8e4-be12-4bd4-80f7-1aa02123551c/*"
]
}
]
} 
