Cloud Services that Support Resource-Level Authorization Using IAM

If you want to grant permissions to an IAM user for specific resources, create a custom policy that contains permissions for the resources, and attach the policy to the user. The user then only has the permissions for the specified resources. For example, to grant permissions to an IAM user for buckets whose names start with TestBucket, create a custom policy, specify the resource path as OBS:*:*:bucket:TestBucket*, and attach the policy to the user.

The following table lists the cloud services that support resource-level authorization and the supported resource types.

**Table 1** Cloud services that support resource-level authorization and the supported resource types
Service	Resource Type	Resource Name
Data Lake Insight (DLI)	queue	DLI queue
	catalog
	database	DLI database
	table	DLI table
	column	DLI column
	datasourceauth	DLI security authentication information
	jobs	DLI job
	resource	Resource package
	elasticresourcepool	Elastic resource pool
	group	Resource package group
	variable	Global variable
Data Warehouse Service (DWS)	cluster	Cluster
Elastic Cloud Server (ECS)	instance	ECS
Elastic Volume Service (EVS)	volume	EVS disk
FunctionGraph	function	Function
FunctionGraph	trigger	Trigger
Graph Engine Service (GES)	graphName	GES graph name
	backupName	GES backup name
	metadataName	Metadata name
Data Encryption Workshop (DEW)	KeyId	Key ID
Object Storage Service (OBS)	bucket	Bucket
Object Storage Service (OBS)	object	Object
Software Repository for Container (SWR)	chart	Chart
	repository	Repository
	instance	Enterprise edition instance