Help Center/ EventGrid/ API Reference/ Permissions Policies and Supported Actions
Updated on 2023-05-24 GMT+08:00
View PDF

Permissions Policies and Supported Actions

This chapter describes fine-grained permissions management for your EG. If your account does not require individual IAM users, you can skip this chapter.

New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. After authorization, the user can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles are a type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies define API-based permissions for operations on specific resources under certain conditions, allowing for more fine-grained, secure access control of cloud resources.

Policy-based authorization is useful if you want to allow or deny the access to an API.

Each account has all the permissions required to call all APIs, but IAM users must be granted the required permissions. The permissions required for calling an API are determined by the actions supported by the API. Only users who have been granted permissions can call the API successfully. For example, if an IAM user creates event sources using an API, the user must have been granted permissions that allow the eg:sources:create action.

Supported Actions

EG provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

  • Permissions: statements in a policy that allow or deny certain operations
  • APIs: APIs that will be called for performing certain operations
  • Actions: specific operations that are allowed or denied
  • IAM projects or enterprise projects: A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in Enterprise Management.

EG supports the following actions that can be defined in custom policies. Permissions must be obtained before calling APIs. For details on how to obtain permissions, visit the Identity and Access Management help center.

Table 1 EG permissions

Permission

API

Action

IAM Project

Enterprise Project

Create event channels

POST /v1/{project_id}/channels

eg:channels:create

√

x

View the event channel list

GET /v1/{project_id}/channels

eg:channels:list

√

x

Update event channels

PUT /v1/{project_id}/channels/{channel_id}

eg:channels:update

√

x

Delete event channels

DELETE /v1/{project_id}/channels/{channel_id}

eg:channels:delete

√

x

View event channel details

GET /v1/{project_id}/channels/{channel_id}

eg:channels:get

√

x

Publish events to event channels

POST /v1/{project_id}/channels/{channel_id}/events

eg:channels:putEvents

√

x

Create event sources

POST /v1/{project_id}/sources

eg:sources:create

√

x

View the event source list

GET /v1/{project_id}/sources

eg:sources:list

√

x

Update event sources

PUT /v1/{project_id}/sources/{source_id}

eg:sources:update

√

x

Delete event sources

DELETE /v1/{project_id}/sources/{source_id}

eg:sources:delete

√

x

View event source details

GET /v1/{project_id}/sources/{source_id}

eg:sources:get

√

x

View the event target catalog list

GET /v1/{project_id}/target-catalogs

eg:targetCatalogs:list

√

x

Create event subscriptions

POST /v1/{project_id}/subscriptions

eg:subscriptions:create

√

x

View the event subscription list

GET /v1/{project_id}/subscriptions

eg:subscriptions:list

√

x

Update event subscriptions

PUT /v1/{project_id}/subscriptions/{subscription_id}

eg:subscriptions:update

√

x

Delete event subscriptions

DELETE /v1/{project_id}/subscriptions/{subscription_id}

eg:subscriptions:delete

√

x

View event subscription details

GET /v1/{project_id}/subscriptions/{subscription_id}

eg:subscriptions:get

√

x

Enable or disable event subscriptions

POST /v1/{project_id}/subscriptions/operation

eg:subscriptions:update

√

x

Create schemas

POST /v1/{project_id}/schemas

eg:schemas:create

√

x

View the schema list

GET /v1/{project_id}/schemas

eg:schemas:list

√

x

Update schemas

PUT /v1/{project_id}/schemas/{schema_id}

eg:schemas:update

√

x

Delete schemas

DELETE /v1/{project_id}/schemas/{schema_id}

eg:schemas:delete

√

x

View schema details

GET /v1/{project_id}/schemas/{schema_id}

eg:schemas:get

√

x

View the schema version list

GET /v1/{project_id}/schemas/{schema_id}/versions

eg:schemas:listVersions

√

x

View schema version details

GET /v1/{project_id}/schemas/{schema_id}/versions/{version}

eg:schemas:getVersion

√

x

Delete schema versions

DELETE /v1/{project_id}/schemas/{schema_id}/versions/{version}

eg:schemas:deleteVersion

√

x

Discover schemas

POST /v1/{project_id}/schema-discover

eg:schemas:getDiscovered

√

x

Query quotas

GET /v1/{project_id}/quotas

eg:quotas:list

√

x