Identity Policy-based Authorization
IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.
In addition to IAM, the Organizations service also provides service control policies (SCPs) to set access control policies.
SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.
To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?
This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.
- For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
- For details about how to use these elements to edit a custom SCP, see Creating an SCP.
Actions
Actions are specific operations that are allowed or denied in an identity policy.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DDM, see Resource Type.
- Condition Key contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DDM, see Conditions.
- Alias lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization.
The following table lists the actions that you can define in identity policy statements for DDM.
| Action | Description | Access Level | Resource Type (*: required) | Condition Key | Alias |
|---|---|---|---|---|---|
| ddm::createParamGroup | Grants permission to create a parameter template. | write | - | - | ddm:param:create |
| ddm::deleteParamGroup | Grants permission to delete a parameter template. | write | - | - | ddm:param:delete |
| ddm::updateParamGroup | Grants permission to update a parameter template. | write | - | - | ddm:param:update |
| ddm::applyParamGroup | Grants permission to apply a parameter template. | write | - | - | ddm:param:apply |
| ddm::listParamGroup | Grants permission to query parameter templates. | list | - | - | ddm:param:list |
| ddm::copyParamGroup | Grants permission to replicate a parameter template. | write | - | - | ddm:param:create |
| ddm::getParamGroup | Grants permission to query a parameter template. | read | - | - | ddm:param:list |
| ddm:instance:deleteBackup | Grants permission to delete a backup. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:backup:delete |
| ddm:instance:restore | Grants permission to restore data from a backup. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:backup:restore |
| ddm:instance:getBackup | Grants permission to obtain backup information. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:backup:get |
| ddm:instance:listBackup | Grants permission to query the backup list of an instance. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:backup:list |
| ddm::listBackup | Grants permission to query the backup list of a project. | list | - | - | ddm:backup:list |
| ddm:instance:createUser | Grants permission to create a DDM account. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:user:create |
| ddm:instance:updateUser | Grants permission to modify DDM account information. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:user:modify |
| ddm:instance:deleteUser | Grants permission to delete a DDM account. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:user:delete |
| ddm:instance:listUser | Grants permission to query the DDM account list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:user:list |
| ddm::validateWeakPassword | Grants permission to query DDM weak password verification. | read | - | - | ddm:user:list |
| ddm:database:configBlacklist | Grants permission to configure an SQL blacklist. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:blacklist:config |
| ddm:database:getBlacklist | Grants permission to query an SQL blacklist. | read | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:blacklist:get |
| ddm:instance:syncDataNode | Grants permission to synchronize data node information. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:rds:synchro |
| ddm:instance:updateDataNodeReadWritePolicy | Grants permission to update the read/write weight. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:rds:modifyReadPolicy |
| ddm:instance:listDataNode | Grants permission to query the data node list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:rds:list |
| ddm:instance:checkDataNodeConnection | Grants permission to check the connectivity of data nodes. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:list |
| ddm::listTask | Grants permission to query tasks. | list | - | - | ddm:task:list |
| ddm::getTask | Grants permission to query details about a task. | read | - | - | ddm:task:get |
| ddm::listTags | Grants permission to query all tags in a project. | list | - | - | ddm:tag:list |
| ddm::listTagsForResource | Grants permission to query the instance tag list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:tag:list |
| ddm::updateTagForResource | Grants permission to modify tags. | tagging | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:tag:modify |
| ddm::tagResource | Grants permission to add tags. | tagging | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys | ddm:tag:modify |
| ddm::untagResource | Grants permission to delete tags. | tagging | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:tag:modify |
| ddm:instance:listGroup | Grants permission to query the instance group list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:list |
| ddm:database:listTable | Grants permission to query logical tables. | list | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:table:list |
| ddm:database:getTable | Grants permission to query logical table details. | read | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:table:list |
| ddm:database:create | Grants permission to create a schema. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:delete | Grants permission to delete a schema. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:list | Grants permission to query schemas. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:get | Grants permission to query schema details. | read | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:migrate | Grants permission to configure shards of a schema. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:migrateRollback | Grants permission to roll back shard configuration of a schema. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:dumpMetadata | Grants permission to export schema metadata. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:database:get |
| ddm:database:loadMetadata | Grants permission to import schema metadata. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:database:create |
| ddm:instance:enlargeNode | Grants permission to add nodes. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:extendNode |
| ddm:instance:reduceNode | Grants permission to reduce nodes. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:extendNode |
| ddm:instance:getNode | Grants permission to query node details. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:get |
| ddm:instance:listNodes | Grants permission to query the node list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:list |
| ddm:instance:updateElbIp | Grants permission to change the load balancer IP address of an instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:create | Grants permission to create a DDM instance. | write | instance | g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId | - |
| ddm:instance:reboot | Grants permission to restart a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:delete | Grants permission to delete a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:resize | Grants permission to change the node class. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:updateName | Grants permission to change the name of a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:updateIpGroup | Grants permission to modify DDM access control. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:reload | Grants permission to reload DDM instance metadata. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:updateSecurityGroup | Grants permission to update the security group of a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:updatePort | Grants permission to update the port of a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm::listProduct | Grants permission to query the product list. | list | - | - | ddm:product:list |
| ddm:instance:updateRwStrategy | Grants permission to enable or disable read/write splitting. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:getRwStrategy | Grants permission to check whether read/write splitting is enabled. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:list |
| ddm:instance:listRwInfo | Grants permission to query reads and writes of a DDM instance in a specified time range. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:listSlowSqlInfo | Grants permission to view slow SQL monitoring information. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:list | Grants permission to query the DDM instance list. | list | - | g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId | - |
| ddm:instance:get | Grants permission to query details about a DDM instance. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:changeVersion | Grants permission to upgrade or downgrade a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:queryProcessList | Grants permission to query the session list. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:killProcessList | Grants permission to kill sessions. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:modifySsl | Grants permission to enable or disable SSL for the DDM kernel. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:getSslCertDownloadAddress | Grants permission to obtain the address for downloading the SSL certificate of a DDM instance. | read | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:list |
| ddm:instance:modifyPublicAccess | Grants permission to bind or unbind an EIP to or from a DDM instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:listGsi | Grants permission to query the GSI list. | list | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:createGsi | Grants permission to create a GSI. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:database:rebuildGsi | Grants permission to recreate a GSI. | write | database | g:EnterpriseProjectId g:ResourceTag/<tag-key> | - |
| ddm:instance:createSqlLimit | Grants permission to create auto throttling rules of an instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:deleteSqlLimit | Grants permission to delete auto throttling rules of an instance. | write | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:modify |
| ddm:instance:querySqlLimit | Grants permission to query auto throttling rules of an instance. | list | instance | g:EnterpriseProjectId g:ResourceTag/<tag-key> | ddm:instance:query |
Each API of DDM usually supports one or more actions. Table 2 lists the supported actions and dependencies.
| API | Action | Dependency |
|---|---|---|
| POST /v1/{project_id}/instances | ddm:instance:create | - |
| GET /v1/{project_id}/instances?offset={offset}&limit={limit} | ddm:instance:list | - |
| GET /v1/{project_id}/instances/{instance_id} | ddm:instance:get | - |
| PUT /v1/{project_id}/instances/{instance_id}/modify-name | ddm:instance:updateName | - |
| PUT /v1/{project_id}/instances/{instance_id}/modify-security-group | ddm:instance:updateSecurityGroup | - |
| DELETE /v1/{project_id}/instances/{instance_id}?delete_rds_data=true | ddm:instance:delete | - |
| POST /v1/{project_id}/instances/{instance_id}/action | ddm:instance:reboot | - |
| POST /v1/{project_id}/instances/{instance_id}/reload-config | ddm:instance:reload | - |
| POST /v2/{project_id}/instances/{instance_id}/action/enlarge | ddm:instance:enlargeNode | - |
| POST /v2/{project_id}/instances/{instance_id}/action/reduce | ddm:instance:reduceNode | - |
| PUT /v2/{project_id}/instances/{instance_id}/action/read-write-strategy | ddm:instance:updateDataNodeReadWritePolicy | - |
| POST /v1/{project_id}/instances/{instance_id}/rds/sync | ddm:instance:syncDataNode | - |
| GET /v1/{project_id}/instances/{instance_id}/nodes?offset={offset}&limit={limit} | ddm:instance:listNodes | - |
| GET /v1/{project_id}/instances/{instance_id}/nodes/{node_id} | ddm:instance:getNode | - |
| GET /v2/{project_id}/engines?offset={offset}&limit={limit} | ddm::listProduct | - |
| GET /v2/{project_id}/flavors?engine_id={engine_id}&offset={offset}&limit={limit} | ddm::listProduct | - |
| PUT /v3/{project_id}/instances/{instance_id}/flavor | ddm:instance:resize | - |
| GET /v3/{project_id}/instances/{instance_id}/groups?offset={offset}&limit={limit} | ddm:instance:listGroup | - |
| POST /v3/{project_id}/instances/{instance_id}/groups | ddm:instance:enlargeNode | - |
| DELETE /v3/{project_id}/instances/{instance_id}/groups/{group_id} | ddm:instance:reduceNode | - |
| GET /v3/{project_id}/engines?offset={offset}&limit={limit} | ddm::listProduct | - |
| GET /v3/{project_id}/flavors?engine_id={engine_id}&offset={offset}&limit={limit}&engine_version={engine_version}&available_zones={available_zones} | ddm::listProduct | - |
| GET /v3/{project_id}/instances/{instance_id}/configurations?offset={offset}&limit={limit} | ddm::getParamGroup | - |
| PUT /v3.1/{project_id}/instances/{instance_id}/configurations | ddm:param:update | - |
| POST /v3/{project_id}/instances/{instance_id}/nodes | ddm:instance:enlargeNode | - |
| DELETE /v3/{project_id}/instances/{instance_id} | ddm:instance:delete | - |
| POST /v3/{project_id}/instances/{instance_id}/switch-ssl | ddm:instance:modifySsl | - |
| PUT /v3/{project_id}/instances/{instance_id}/port | ddm:instance:updatePort | - |
| POST /v3/{project_id}/instances/{instance_id}/restart | ddm:instance:reboot | - |
| POST /v3/{project_id}/instances/{instance_id}/nodes/{node_id}/restart | ddm:instance:reboot | - |
| POST /v3/{project_id}/instances/{instance_id}/eip | ddm:instance:modifyPublicAccess | - |
| DELETE /v3/{project_id}/instances/{instance_id}/eip | ddm:instance:modifyPublicAccess | - |
| PUT /v3/{project_id}/instances/{instance_id}/elb/ip | ddm:instance:updateElbIp | - |
| DELETE /v3/{project_id}/instances/{instance_id}/nodes | ddm:instance:reduceNode | - |
| POST /v3/{project_id}/instances/{instance_id}/nodes/batch-delete | ddm:instance:reduceNode | - |
| GET /v3/{project_id}/instances/{instance_id}/nodes/{node_id} | ddm:instance:getNode | - |
| POST /v3/{project_id}/instances | ddm:instance:create | - |
| GET /v3/{project_id}/instances/{instance_id}/public-ips | ddm:instance:get | - |
| POST /v3/{project_id}/instances/{instance_id}/data-nodes/sync | ddm:instance:syncDataNode | - |
| PUT /v3/{project_id}/instances/{instance_id}/name | ddm:instance:updateName | - |
| PUT /v3/{project_id}/instances/{instance_id}/security-group | ddm:instance:updateSecurityGroup | - |
| POST /v3/{project_id}/instances/{instance_id}/reload-config | ddm:instance:reload | - |
| POST /v3/{project_id}/instances/{instance_id}/rds/connection | ddm:instance:checkDataNodeConnection | - |
| POST /v1/{project_id}/instances/{instance_id}/databases | ddm:database:create | - |
| GET /v1/{project_id}/instances/{instance_id}/databases?offset={offset}&limit={limit} | ddm:database:list | - |
| GET /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname} | ddm:database:get | - |
| DELETE /v1/{project_id}/instances/{instance_id}/databases/{ddm_dbname}?delete_rds_data=true | ddm:database:delete | - |
| GET /v1/{project_id}/instances/{instance_id}/rds?offset={offset}&limit={limit} | ddm:instance:listDataNode | - |
| POST /v3/{project_id}/instances/{instance_id}/databases | ddm:database:create | - |
| DELETE /v3/{project_id}/instances/{instance_id}/databases/{database_name} | ddm:database:delete | - |
| GET /v3/{project_id}/instances/{instance_id}/databases/{database_name} | ddm:database:get | - |
| GET /v3/{project_id}/instances/{instance_id}/schema-metadata | ddm:database:dumpMetadata | - |
| POST /v3/{project_id}/instances/{instance_id}/schema-metadata | ddm:database:loadMetadata | - |
| GET /v3/{project_id}/instances/{instance_id}/available-data-nodes | ddm:instance:listDataNode | - |
| GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/available-data-nodes | ddm:instance:listDataNode | - |
| POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck | ddm:database:migrate | - |
| GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/precheck/{job_id} | ddm:instance:list | - |
| POST /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration | ddm:database:migrate | - |
| GET /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id} | ddm::listTask | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/cancel | ddm:database:migrate | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/rollback | ddm:database:migrateRollback | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/clean | ddm:database:migrate | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/retry | ddm:database:migrate | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch-strategy | ddm:database:migrate | - |
| PUT /v3/{project_id}/instances/{instance_id}/databases/{db_name}/migration/jobs/{job_id}/route-switch | ddm:database:migrate | - |
| POST /v1/{project_id}/instances/{instance_id}/users | ddm:instance:createUser | - |
| GET /v1/{project_id}/instances/{instance_id}/users?offset={offset}&limit={limit} | ddm:instance:listUser | - |
| PUT /v1/{project_id}/instances/{instance_id}/users/{username} | ddm:instance:updateUser | - |
| DELETE /v1/{project_id}/instances/{instance_id}/users/{username} | ddm:instance:deleteUser | - |
| POST /v2/{project_id}/instances/{instance_id}/users/{username}/password | ddm:instance:updateUser | - |
| PUT /v3/{project_id}/instances/{instance_id}/admin-user | ddm:instance:updateUser | - |
| POST /v3/{project_id}/weak-password-verification | ddm::validateWeakPassword | - |
| POST /v3/{project_id}/instances/{instance_id}/users | ddm:instance:createUser | - |
| GET /v3/{project_id}/instances/{instance_id}/users | ddm:instance:listUser | - |
| PUT /v3/{project_id}/instances/{instance_id}/users/{username} | ddm:instance:updateUser | - |
| DELETE /v3/{project_id}/instances/{instance_id}/users/{username} | ddm:instance:deleteUser | - |
| POST /v3/{project_id}/instances/{instance_id}/users/{username}/password | ddm:instance:updateUser | - |
| GET /v3/{project_id}/jobs/{job_id} | ddm::getTask | - |
| GET /v3/{project_id}/jobs | ddm::listTask | - |
| GET /v2/{project_id}/instances/{instance_id}/slowlog?curPage={curPage}&perPage={perPage}&startDate={startDate}&endDate={endDate} | ddm:instance:listSlowSqlInfo | - |
| GET /v3/{project_id}/instances/{instance_id}/logical-processes?offset={offset}&limit={limit} | ddm:instance:queryProcessList | - |
| DELETE /v3/{project_id}/instances/{instance_id}/logical-processes | ddm:instance:killProcessList | - |
| GET /v3/{project_id}/instances/{instance_id}/physical-processes?offset={offset}&limit={limit} | ddm:instance:queryProcessList | - |
| DELETE /v3/{project_id}/instances/{instance_id}/physical-processes | ddm:instance:killProcessList | - |
| GET /v3/{project_id}/instances/{instance_id}/processes-audit-log?offset={offset}&limit={limit}&start_time={start_time}&end_time={end_time} | ddm:instance:queryProcessList | - |
| GET /v3/{project_id}/instances/{instance_id}/database-version/available-versions | ddm:instance:get | - |
| POST /v3/{project_id}/instances/{instance_id}/database-version/change-version | ddm:instance:changeVersion | - |
| POST /v3/{project_id}/instances/{instance_id}/database-version/rollback-version | ddm:instance:changeVersion | - |
| GET /v3/{project_id}/instances/{instance_id}/show-risk-info | ddm:instance:get | - |
| GET /v3/{project_id}/backups | ddm::listBackup | - |
| DELETE /v3/{project_id}/backups/{backup_id} | ddm:instance:deleteBackup | - |
| GET /v3/{project_id}/instances/{instance_id}/backups/{backup_id} | ddm:instance:getBackup | - |
| GET /v3/{project_id}/instances/{instance_id}/backups/related-dn | ddm:instance:getBackup | - |
| GET /v3/{project_id}/instances/{instance_id}/backups/restorable-time-interval | ddm:instance:getBackup | - |
| GET /v3/{project_id}/instances/{instance_id}/backups/restorable-data-node | ddm:instance:listDataNode | - |
| GET /v3/{project_id}/instances/{instance_id}/backups/restorable-instances | ddm:instance:list | - |
| POST /v3/{project_id}/instances/{instance_id}/backups/metadata-recovery | ddm:instance:restore | - |
| POST /v3/{project_id}/instances/{instance_id}/backups/recovery | ddm:instance:restore | - |
| GET /v3/{project_id}/configurations | ddm::listParamGroup | - |
| GET /v3/{project_id}/configurations/{config_id} | ddm::getParamGroup | - |
| POST /v3/{project_id}/configurations | ddm::createParamGroup | - |
| DELETE /v3/{project_id}/configurations/{config_id} | ddm::deleteParamGroup | - |
| GET /v3/{project_id}/configurations/{config_id}/apply-histories | ddm::listParamGroup | - |
| POST /v3/{project_id}/configurations/{config_id}/copy | ddm::copyParamGroup | - |
| PUT /v3/{project_id}/configurations/{config_id} | ddm::updateParamGroup | - |
| GET /v3/{project_id}/configurations/{config_id}/query-instances | ddm:instance:list | - |
| PUT /v3/{project_id}/configurations/diff | ddm::listParamGroup | - |
Resource Type
A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy is applied to all resources. You can also set condition keys in an identity policy to define resource types.
The following table lists the resource types that you can define in identity policy statements for DDM.
Conditions
A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.
- The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key–value pairs in a request, so g:TagKeys is a multivalued condition key.
- A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met.
What is your overall rating for this page?
Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
