文档首页/ 应用管理与运维平台 ServiceStage/ API参考/ 权限和授权项/ 身份策略授权参考
更新时间：2025-11-20 GMT+08:00
查看PDF
分享

身份策略授权参考

云服务在IAM预置了常用授权项，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。

除IAM服务外，Organizations服务中的服务控制策略（Service Control Policies，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。

SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。

IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参考IAM服务与Organizations服务权限访问控制的区别。

本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。

操作（Action）

操作（Action）即为身份策略中支持的授权项。

  • “访问级别”列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在策略语句的Resource元素中指定所有资源类型（“*”）。
    • 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。
    • 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。

    关于ServiceStage定义的资源类型的详细信息请参见资源类型（Resource）。

  • “条件键”列包括了可以在身份策略语句的Condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
    • 如果此列条件键没有值（-），表示此操作不支持指定条件键。

    关于ServiceStage定义的条件键的详细信息请参见条件（Condition）。

  • “别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见身份策略兼容性说明。

您可以在身份策略语句的Action元素中指定以下ServiceStage的相关操作。

表1 ServiceStage支持的授权项

授权项

描述

访问级别

资源类型（*为必须）

条件键

别名

servicestage:app:getApplication

授予用户查看指定应用权限

read

app

servicestage:app:get

servicestage:app:createApplication

授予用户创建应用权限

write

app

servicestage:app:create

servicestage:app:modifyApplication

授予用户更新应用权限

write

app

servicestage:app:modify

servicestage:app:deleteApplication

授予用户删除应用权限

write

app

servicestage:app:delete

servicestage:app:listApplication

授予用户查看应用列表权限

list

-

-

servicestage:app:list

servicestage:app:getConfiguration

授予用户查看应用配置权限

read

app

servicestage:app:get

servicestage:app:deleteConfiguration

授予用户删除应用配置权限

write

app

servicestage:app:modify

servicestage:app:modifyConfiguration

授予用户更新应用配置权限

write

app

servicestage:app:modify

servicestage:app:getComponent

授予用户查看指定应用组件权限

read

app

servicestage:app:get

servicestage:app:createComponent

授予用户创建应用组件权限

write

app

servicestage:app:create

servicestage:app:modifyComponent

授予用户更新应用组件权限

write

app

servicestage:app:modify

servicestage:app:deleteComponent

授予用户删除应用组件权限

write

app

servicestage:app:delete

servicestage:app:listComponent

授予用户查看应用组件列表权限

list

-

-

servicestage:app:list

servicestage:environment:create

授予用户创建环境权限

write

environment

-

servicestage:environment:get

授予用户查看环境信息权限

read

environment

-

servicestage:environment:list

授予用户查看环境列表权限

list

-

-

servicestage:app:list

servicestage:environment:modify

授予用户更新环境权限

write

environment

-

servicestage:environment:delete

授予用户删除环境权限

write

environment

-

servicestage:environment:refresh

授予用户刷新环境权限

write

environment

-

servicestage:environment:tag

授予TMS用户创建环境标签权限

tagging

environment

servicestage:environment:modify

servicestage:app:tag

授予TMS用户创建应用标签权限

tagging

app

servicestage:app:modify

servicestage:environment:listResourcesByTag

授予TMS用户通过标签查询环境资源权限

read

environment

servicestage:environment:list

servicestage:app:listResourcesByTag

授予TMS用户通过标签查询应用资源权限

read

app

servicestage:app:list

servicestage:environment:unTagResource

授予TMS用户删除环境资源标签权限

tagging

environment

servicestage:environment:modify

servicestage:app:unTagResource

授予TMS用户删除应用资源标签权限

tagging

app

servicestage:app:modify

servicestage:environment:listTags

授予TMS用户查询环境资源标签列表权限

read

-

-

servicestage:environment:list

servicestage:app:listTags

授予TMS用户查询应用资源标签列表权限

read

-

-

servicestage:app:list

servicestage:environment:createAddon

授予用户创建插件权限

write

-

-

-

servicestage:environment:listAddon

授予用户查询插件列表权限

list

-

-

-

servicestage:environment:getAddon

授予用户查询插件详情权限

read

-

-

-

servicestage:environment:modifyAddon

授予用户修改插件权限

write

-

-

-

servicestage:environment:deleteAddon

授予用户删除插件权限

write

-

-

-

servicestage::createLaneGroup

授予用户创建泳道组权限

write

-

-

-

servicestage::getLaneGroup

授予用户查询泳道组权限

read

-

-

-

servicestage::listLaneGroup

授予用户获取所有泳道组权限

list

-

-

-

servicestage::modifyLaneGroup

授予用户根据泳道组ID修改泳道组权限

write

-

-

-

servicestage::deleteLaneGroup

授予用户根据泳道组ID删除泳道组权限

write

-

-

-

servicestage::createLane

授予用户泳道组下创建泳道权限

write

-

-

-

servicestage::getLane

授予用户根据泳道ID获取泳道信息权限

read

-

-

-

servicestage::listLane

授予用户获取泳道组下所有泳道权限

list

-

-

-

servicestage::modifyLane

授予用户根据泳道ID修改泳道信息权限

write

-

-

-

servicestage::deleteLane

授予用户根据泳道ID删除泳道权限

write

-

-

-

servicestage:config:createGroup

授予用户创建配置分组权限

write

configGroup

-

servicestage:config:getGroup

授予用户根据配置分组ID获取分组详情权限

read

configGroup

-

servicestage:config:listGroup

授予用户获取配置分组权限

list

-

-

-

servicestage:config:deleteGroup

授予用户根据配置分组ID删除分组权限

write

configGroup

-

servicestage:config:get

授予用户根据配置文件ID获取配置文件信息权限

read

config

g:EnterpriseProjectId

-

servicestage:config:list

授予用户获取配置文件信息权限

list

-

-

-

servicestage:config:create

授予用户创建配置文件权限

write

config

-

servicestage:config:modify

授予用户根据配置文件ID修改配置文件权限

write

config

g:EnterpriseProjectId

-

servicestage:config:delete

授予用户根据配置文件ID删除配置文件权限

write

config

g:EnterpriseProjectId

-

servicestage:config:import

授予用户导入配置文件权限

write

-

-

-

servicestage:config:listHistories

授予用户根据配置文件ID获取配置文件历史权限

list

config

g:EnterpriseProjectId

-

servicestage:config:getHistory

授予用户根据配置文件历史ID获取配置文件历史信息权限

read

config

g:EnterpriseProjectId

-

servicestage:config:deleteHistory

授予用户根据配置文件历史ID删除配置文件历史权限

write

config

g:EnterpriseProjectId

-

servicestage::getRuntimeStack

授予用户根据技术栈ID查询技术栈权限

read

-

-

-

servicestage::createRuntimeStack

授予用户创建技术栈权限

write

-

-

-

servicestage::modifyRuntimeStack

授予用户根据技术栈ID修改技术栈权限

write

-

-

-

servicestage::deleteRuntimeStack

授予用户根据技术栈ID删除技术栈权限

write

-

-

-

servicestage::switchRuntimeStackStatus

授予用户发布和取消发布技术栈权限

write

-

-

-

servicestage:vmappConfig:list

授予用户查询目录配置权限

list

-

-

-

servicestage:vmappConfig:get

授予用户根据目录配置ID查询目录配置权限

read

-

-

-

servicestage:vmappConfig:create

授予用户创建目录配置权限

write

-

-

-

servicestage:vmappConfig:modify

授予用户根据目录配置ID修改目录配置权限

write

-

-

-

servicestage:vmappConfig:delete

授予用户根据目录配置ID删除目录配置权限

write

-

-

-

servicestage::createReleasePlan

授予用户创建发布单权限

write

-

-

-

servicestage::getReleasePlan

授予用户根据发布单ID获取发布单信息权限

read

-

-

-

servicestage::listReleasePlan

授予用户获取发布单列表权限

list

-

-

-

servicestage::modifyReleasePlan

授予用户根据发布单ID编辑发布单权限

write

-

-

-

servicestage::deleteReleasePlan

授予用户根据发布单ID删除发布单权限

write

-

-

-

servicestage:pipeline:get

授予用户查看流水线权限

read

pipeline

g:EnterpriseProjectId

-

servicestage:pipeline:create

授予用户创建流水线权限

write

pipeline

g:EnterpriseProjectId

-

servicestage:pipeline:modify

授予用户更新流水线权限

write

pipeline

g:EnterpriseProjectId

-

servicestage:pipeline:delete

授予用户删除流水线权限

write

pipeline

g:EnterpriseProjectId

-

servicestage:pipeline:list

授予用户查看流水线列表权限

list

-

-

-

servicestage:assembling:runtimeList

授予用户查看技术栈列表权限

read

-

-

servicestage:assembling:get

servicestage:assembling:getInfo

授予用户查看构建信息权限

list

-

-

-

servicestage:assembling:create

授予用户创建构建任务权限

write

assembling

-

-

servicestage:assembling:modify

授予用户更新构建任务权限

write

assembling

-

-

servicestage:assembling:delete

授予用户删除构建任务权限

write

assembling

-

-

servicestage:assembling:list

授予用户查看构建任务列表权限

list

-

-

-

servicestage:repositoryAuth:list

授予用户获取仓库授权列表权限

list

-

-

-

servicestage:repositoryAuth:get

授予用户获取仓库授权权限

read

repositoryAuth

-

-

servicestage:repositoryAuth:create

授予用户创建仓库授权权限

write

repositoryAuth

-

-

servicestage:repositoryAuth:delete

授予用户删除仓库授权权限

write

repositoryAuth

-

-

servicestage:environment:listTagsForResource

授予eps用户查询环境资源标签列表权限

read

environment

servicestage:app:list

servicestage:app:listTagsForResource

授予eps用户查询应用资源标签列表权限

read

app

servicestage:app:list
表2 CSE支持的授权项

授权项

描述

访问级别

资源类型（*为必须）

条件键

别名

cse:config:upload

授予上传微服务配置权限

write

-

g:EnterpriseProjectId

cse:config:modify

cse:config:download

授予下载微服务配置权限

write

-

g:EnterpriseProjectId

cse:config:modify

cse:engine:get

授予查看引擎信息权限

read

engine

-

cse:engine:list

授予查询引擎信息列表权限

list

-

-

-

cse:engine:backupRecover

授予备份、恢复引擎数据和变更备份策略权限。

write

engine

-

cse:engine:associatePublicips

授予绑定和解绑引擎公网访问权限。

write

engine

-

cse:engine:update

授予修改引擎配置和系统管理权限。

write

engine

-

cse:engine:create

授予创建引擎权限

write

-

-

cse:engine:upgrade

授予升级引擎权限

write

engine

-

cse:engine:delete

授予删除引擎权限

write

engine

-

cse:namespace:get

授予查看命名空间资源权限

read

engine

cse:namespace:read

cse:namespace:update

授予修改命名空间资源权限

write

engine

cse:namespace:write

ServiceStage的API通常对应着一个或多个授权项。表3展示了API与授权项的关系，以及该API需要依赖的授权项。

表3 API与授权项的关系

API

对应的授权项

依赖的授权项

GET /v2/{project_id}/cas/metadata/runtimes

servicestage:app:listApplication

-

GET /v2/{project_id}/cas/metadata/flavors

servicestage:app:listApplication

-

POST /v2/{project_id}/cas/environments

servicestage:environment:create

-

GET /v2/{project_id}/cas/environments

servicestage:environment:list

-

PUT /v2/{project_id}/cas/environments/{environment_id}

servicestage:environment:modify

-

DELETE /v2/{project_id}/cas/environments/{environment_id}

servicestage:environment:delete

-

GET /v2/{project_id}/cas/environments/{environment_id}

servicestage:environment:get

-

PATCH /v2/{project_id}/cas/environments/{environment_id}/resources

servicestage:environment:modify

-

POST /v2/{project_id}/cas/applications

servicestage:app:createApplication

-

GET /v2/{project_id}/cas/applications

servicestage:app:listApplication

-

PUT /v2/{project_id}/cas/applications/{application_id}

servicestage:app:modifyApplication

-

DELETE /v2/{project_id}/cas/applications/{application_id}

servicestage:app:deleteApplication

-

GET /v2/{project_id}/cas/applications/{application_id}

servicestage:app:getApplication

-

PUT /v2/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:modifyConfiguration

-

DELETE /v2/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:deleteConfiguration

-

GET /v2/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:getConfiguration

-

POST /v2/{project_id}/cas/applications/{application_id}/components

servicestage:app:createComponent

servicestage:assembling:getInfo

servicestage:assembling:create

GET /v2/{project_id}/cas/applications/{application_id}/components

servicestage:app:listComponent

-

PUT /v2/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:modifyComponent

-

DELETE /v2/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:deleteComponent

-

GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:getComponent

-

POST /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances

servicestage:app:createComponent

servicestage:assembling:getInfo

servicestage:assembling:create

GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances

servicestage:app:listComponent

-

POST /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}/action

servicestage:app:modifyComponent

-

PUT /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}

servicestage:app:modifyComponent

-

DELETE /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}

servicestage:app:deleteComponent

-

GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}

servicestage:app:getComponent

-

GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}/snapshots

servicestage:app:getComponent

-

GET /v2/{project_id}/cas/jobs/{job_id}

servicestage:app:listApplication

-

POST /v3/{project_id}/cas/environments

servicestage:environment:create

-

GET /v3/{project_id}/cas/environments

servicestage:environment:list

-

PUT /v3/{project_id}/cas/environments/{environment_id}

servicestage:environment:modify

-

DELETE /v3/{project_id}/cas/environments/{environment_id}

servicestage:environment:delete

-

GET /v3/{project_id}/cas/environments/{environment_id}

servicestage:environment:get

-

PUT /v3/{project_id}/cas/environments/{environment_id}/resources

servicestage:environment:modify

-

GET /v3/{project_id}/cas/environments/{environment_id}/resources

servicestage:environment:list

-

GET /v3/{project_id}/cas/environments/resources

servicestage:environment:list

-

POST /v3/{project_id}/cas/environments/{environment_id}/refresh

servicestage:environment:refresh

-

POST /v3/{project_id}/cas/applications

servicestage:app:createApplication

-

GET /v3/{project_id}/cas/applications

servicestage:app:listApplication

-

PUT /v3/{project_id}/cas/applications/{application_id}

servicestage:app:modifyApplication

-

GET /v3/{project_id}/cas/applications/{application_id}

servicestage:app:getApplication

-

DELETE /v3/{project_id}/cas/applications/{application_id}

servicestage:app:deleteApplication

-

POST /v3/{project_id}/cas/applications/{application_id}/action

servicestage:app:modifyApplication

-

GET /v3/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:getConfiguration

-

PUT /v3/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:modifyConfiguration

-

DELETE /v3/{project_id}/cas/applications/{application_id}/configuration

servicestage:app:deleteConfiguration

-

POST /v3/{project_id}/cas/applications/{application_id}/components

servicestage:app:createComponent

servicestage:assembling:getInfo

servicestage:assembling:create

GET /v3/{project_id}/cas/applications/{application_id}/components

servicestage:app:listComponent

-

GET /v3/{project_id}/cas/components

servicestage:app:listComponent

-

PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:modifyComponent

-

DELETE /v3/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:deleteComponent

-

GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id}

servicestage:app:getComponent

-

POST /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/action

servicestage:app:modifyComponent

-

GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/records

servicestage:app:listComponent

-

PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/refresh

servicestage:app:modifyComponent

-

GET /v3/{project_id}/cas/components/filterOptions

servicestage:app:listComponent

-

POST /v3/{project_id}/cas/components/action

servicestage:app:modifyComponent

-

POST /v3/{project_id}/cas/components

servicestage:app:createComponent

servicestage:assembling:getInfo

servicestage:assembling:create

POST /v3/{project_id}/cas/components/parse-template-package

servicestage:app:getComponent

-

PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/redeployment

servicestage:app:modifyComponent

-

GET /v3/{project_id}/cas/jobs/{job_id}

servicestage:app:listApplication

-

POST /v3/{project_id}/cas/config-groups

servicestage:config:createGroup

-

GET /v3/{project_id}/cas/config-groups

servicestage:config:listGroup

-

POST /v3/{project_id}/cas/configs

servicestage:config:create

-

POST /v3/{project_id}/cas/configs/import

servicestage:config:import

-

GET /v3/{project_id}/cas/configs

servicestage:config:list

-

GET /v3/{project_id}/cas/configs/{config_id}

servicestage:config:get

-

DELETE /v3/{project_id}/cas/configs/{config_id}

servicestage:config:delete

-

PUT /v3/{project_id}/cas/configs/{config_id}

servicestage:config:modify

-

GET /v3/{project_id}/cas/configs/{config_id}/histories

servicestage:config:listHistories

-

GET /v3/{project_id}/cas//configs/{config_id}/histories/{config_history_id}

servicestage:config:getHistory

-

DELETE /v3/{project_id}/cas/configs/{config_id}/histories/{config_history_id}

servicestage:config:deleteHistory

-

GET /v3/{project_id}/cas/config-groups/{config_group_id}

servicestage:config:getGroup

-

DELETE /v3/{project_id}/cas/config-groups/{config_group_id}

servicestage:config:deleteGroup

-

POST /v3/{project_id}/cas/swimlane-group

servicestage::createLaneGroup

-

GET /v3/{project_id}/cas/swimlane-group

servicestage::listLaneGroup

-

GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}

servicestage::getLaneGroup

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}

servicestage::modifyLaneGroup

-

DELETE /v3/{project_id}/cas/swimlane-group/{lane_group_id}

servicestage::deleteLaneGroup

-

GET /v3/{project_id}/cas/swimlane-group/target-services

servicestage::listLaneGroup

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/route

servicestage::modifyLaneGroup

-

GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/view

servicestage::getLaneGroup

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/view

servicestage::modifyLaneGroup

-

POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlanes-action

servicestage::modifyLaneGroup

-

POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane

servicestage::createLane

-

GET /v3/{project_id}/cas/swimlane

servicestage::listLaneGroup

-

GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane

servicestage::listLane

-

GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}

servicestage::getLane

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}

servicestage::modifyLane

-

DELETE /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}

servicestage::deleteLane

-

POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/action

servicestage::modifyLane

-

POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/components-action

servicestage::modifyLane

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/component-instances

servicestage::modifyLane

-

GET /v3/{project_id}/cas/swim_lans/{swimlan_id}/records

servicestage::getLane

-

PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/instances

servicestage::modifyLane

-

POST /v3/{project_id}/cas/environments/{environment_id}/addons

servicestage:environment:createAddon

-

GET /v3/{project_id}/cas/environments/{environment_id}/addons

servicestage:environment:listAddon

-

GET /v3/{project_id}/cas/environments/{environment_id}/addons-metadata

servicestage:environment:listAddon

-

GET /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}

servicestage:environment:getAddon

-

POST /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}/action

servicestage:environment:modifyAddon

-

DELETE /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}

servicestage:environment:deleteAddon

-

GET /v3/{project_id}/assembling/base-images

servicestage:assembling:list

-

POST /v3/{project_id}/cas/release-plans

servicestage::createReleasePlan

-

PUT /v3/{project_id}/cas/release-plans/{release_plan_id}

servicestage::modifyReleasePlan

-

DELETE /v3/{project_id}/cas/release-plans/{release_plan_id}

servicestage::deleteReleasePlan

-

GET /v3/{project_id}/cas/release-plans

servicestage::listReleasePlan

-

GET /v3/{project_id}/cas/release-plans/{release_plan_id}

servicestage::getReleasePlan

-

GET /v3/{project_id}/cas/release-plans/{release_plan_id}/deploy-info

servicestage::getReleasePlan

-

POST /v3/{project_id}/cas/release-plans/{release_plan_id}/execute

servicestage::createReleasePlan

-

POST /v3/{project_id}/cas/release-plans/{release_plan_id}/rollback

servicestage::createReleasePlan

-

POST /v3/{project_id}/cas/release-plans/{release_plan_id}/abort

servicestage::createReleasePlan

-

POST /v3/{project_id}/pipeline/pipelines

servicestage:pipeline:create

-

GET /v3/{project_id}/pipeline/pipelines

servicestage:pipeline:list

-

PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id}

servicestage:pipeline:modify

-

POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/action

servicestage:pipeline:modify

-

GET /v3/{project_id}/pipeline/pipelines/{pipeline_id}

servicestage:pipeline:get

-

GET /v3/{project_id}/pipeline/pipelines/{id}/records

servicestage:pipeline:get

-

POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks

servicestage:pipeline:create

-

PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks

servicestage:pipeline:modify

-

GET /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks

servicestage:pipeline:list

-

POST /v3/{project_id}/pipeline/pipelines/parse-template-package

servicestage:pipeline:get

-

POST /v3/{project_id}/cas/runtimestacks

servicestage::createRuntimeStack

-

GET /v3/{project_id}/cas/runtimestacks

servicestage:app:listApplication

-

GET /v3/{project_id}/cas/runtimestacks/{runtimestack_id}

servicestage::getRuntimeStack

-

PUT /v3/{project_id}/cas/runtimestacks/{runtimestack_id}

servicestage::modifyRuntimeStack

-

DELETE /v3/{project_id}/cas/runtimestacks/{runtimestack_id}

servicestage::deleteRuntimeStack

-

POST /v3/{project_id}/cas/runtimestacks/action

servicestage::switchRuntimeStackStatus

-

GET /v3/{project_id}/cas/innerimages

servicestage:app:listApplication

-

POST /v3/{project_id}/cas/vmapp-configs

servicestage:vmappConfig:create

-

GET /v3/{project_id}/cas/vmapp-configs

servicestage:vmappConfig:list

-

GET /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}

servicestage:vmappConfig:get

-

PUT /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}

servicestage:vmappConfig:modify

-

DELETE /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}

servicestage:vmappConfig:delete

-

GET /v1/{project_id}/git/auths

servicestage:repositoryAuth:list

-

GET /v1/{project_id}/git/auths/{repo_type}/redirect

servicestage:repositoryAuth:get

-

POST /v1/{project_id}/git/auths/{repo_type}/oauth

servicestage:repositoryAuth:create

-

POST /v1/{project_id}/git/auths/{repo_type}/personal

servicestage:repositoryAuth:create

-

POST /v1/{project_id}/git/auths/{repo_type}/password

servicestage:repositoryAuth:create

-

DELETE /v1/{project_id}/git/auths/{name}

servicestage:repositoryAuth:delete

-

GET /v1/{project_id}/git/auths/{repo_type}/password/valid

servicestage:repositoryAuth:get

-

GET /v2/{project_id}/servicestage-environment/{environment_id}/tags

servicestage:environment:listTagsForResource

-

GET /v2/{project_id}/servicestage-application/{app_id}/tags

servicestage:app:listTagsForResource

-

POST /v1/{project_id}/kie/file

cse:config:upload

-

POST /v1/{project_id}/kie/download

cse:config:download

-

GET /v2/{project_id}/enginemgr/engines

cse:engine:list

-

POST /v2/{project_id}/enginemgr/engines

cse:engine:create

-

GET /v2/{project_id}/enginemgr/engines/{engine_id}

cse:engine:get

-

DELETE /v2/{project_id}/enginemgr/engines/{engine_id}

cse:engine:delete

-

GET /v2/{project_id}/enginemgr/engines/{engine_id}/jobs/{job_id}

cse:engine:get

-

POST /v1/{project_id}/kie/kv

cse:namespace:update

-

PUT /v1/{project_id}/kie/kv/{kv_id}

cse:namespace:update

-

GET /v1/{project_id}/kie/kv

cse:namespace:get

-

DELETE /v1/{project_id}/kie/kv/{kv_id}

cse:namespace:update

-

DELETE /v1/{project_id}/kie/kv

cse:namespace:update

-

资源类型（Resource）

资源类型（Resource）表示身份策略所作用的资源。如表4中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的身份策略语句中指定该资源的URN，策略仅作用于此资源；如未指定，Resource默认为“*”，则策略将应用到所有资源。您也可以在身份策略中设置条件，从而指定资源类型。

ServiceStage定义了以下可以在身份策略的Resource元素中使用的资源类型。

表4 ServiceStage支持的资源类型

资源类型

URN

app

servicestage:<region>:<account-id>:app:<app-id>

environment

servicestage:<region>:<account-id>:environment:<environment-id>

pipeline

servicestage:<region>:<account-id>:pipeline:<pipeline-id>

assembling

servicestage:<region>:<account-id>:assembling:<assembling-id>

repositoryAuth

servicestage:<region>:<account-id>:repositoryAuth:<repositoryAuth-id>

configGroup

servicestage:<region>:<account-id>:configGroup:<config-group-id>

config

servicestage:<region>:<account-id>:config:<config-group-id>/<config-id>

条件（Condition）

ServiceStage服务不支持在身份策略中的条件键中配置服务级的条件键。

ServiceStage可以使用适用于所有服务的全局条件键，请参考全局条件键。

父主题： 权限和授权项

相关文档