Help Center/ Cloud Firewall/ API Reference/ Permissions and Supported Actions/ Actions Supported by Policy-based Authorization
Updated on 2025-11-10 GMT+08:00
View PDF
Share

Actions Supported by Policy-based Authorization

This section describes the actions supported policy-based authorization for CFW.

Supported Actions

HSS provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. The following are related concepts:

  • Permissions: statements in a policy that allow or deny certain operations
  • APIs: REST APIs that can be called by a user who has been granted specific permissions.
  • Actions: Specific operations that are allowed or denied in a custom policy.
  • Dependencies: Actions which a specific action depends on. When allowing an action for a user, you also need to allow its dependent actions for that user.
  • IAM or enterprise projects: Type of projects for which an action will take effect. For example, if you set the authorization scope of a custom policy to both IAM projects and enterprise projects, the policy takes effect for user groups in either IAM or enterprise projects. If an action supports only IAM projects, the custom policy that contains this action will take effect only for user groups in IAM. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

CFW supports the following actions that can be defined in custom policies:

Authorization List describes CFW actions, such as querying firewall instances, creating CFW instances, and querying ACL rules.

Authorization List

Permission

API

Action

Related Action

IAM Project

(Project)

Enterprise Project

(Enterprise Project)

Enable or disable EIP protection.

POST/v1/{project_id}/eip/protect

cfw:eip:operate

None

√

√

Query the EIP list.

GET/v1/{project_id}/eips/protect

cfw:eip:list

ecs:cloudServers:list

nat:natGateways:list

vpc:publicIps:list

√

√

Query EIP statistics.

GET/v1/{project_id}/eip-count/{object_id}

cfw:eipStatistics:get

None

√

√

Create an ACL rule.

POST/v1/{project_id}/acl-rule

cfw:acl:create

None

√

√

Modify an ACL rule.

PUT/v1/{project_id}/acl-rule/{acl_rule_id}

cfw:acl:put

None

√

√

Delete an ACL rule.

DELETE/v1/{project_id}/acl-rule/{acl_rule_id}

cfw:acl:delete

None

√

√

Query the ACL rule list.

GET/v1/{project_id}/acl-rules

cfw:acl:list

None

√

√

Configure ACL rule priority.

PUT/v1/{project_id}/acl-rule/order/{acl_rule_id}

cfw:acl:setPriority

None

√

√

Create a blacklist or whitelist.

POST/v1/{project_id}/black-white-list

cfw:blackWhite:create

None

√

√

Modify a blacklist or whitelist.

PUT/v1/{project_id}/black-white-list/{list_id}

cfw:blackWhite:put

None

√

√

Delete a blacklist or whitelist.

DELETE/v1/{project_id}/black-white-list/{list_id}

cfw:blackWhite:delete

None

√

√

Query a blacklist or whitelist.

GET/v1/{project_id}/black-white-lists

cfw:blackWhite:list

None

√

√

Create an IP address group.

POST/v1/{project_id}/address-set

cfw:ipGroup:create

None

√

√

Modify an IP address group.

PUT/v1/{project_id}/address-sets/{set_id}

cfw:ipGroup:put

None

√

√

Delete an IP address group.

DELETE/v1/{project_id}/address-sets/{set_id}

cfw:ipGroup:delete

None

√

√

Query the IP address group list.

GET/v1/{project_id}/address-sets

cfw:ipGroup:list

None

√

√

Query the details of an IP address group.

GET/v1/{project_id}/address-sets/{set_id}

cfw:ipGroup:get

None

√

√

Add a member to an IP address group.

POST/v1/{project_id}/address-items

cfw:ipMember:create

None

√

√

Delete a member from an IP address group.

DELETE/v1/{project_id}/address-items/{item_id}

cfw:ipMember:delete

None

√

√

Query IP address group members.

GET/v1/{project_id}/address-items

cfw:ipMember:list

None

√

√

Create a service group.

POST/v1/{project_id}/service-set

cfw:serviceGroup:create

None

√

√

Modify a service group.

PUT/v1/{project_id}/service-sets/{set_id}

cfw:serviceGroup:put

None

√

√

Delete a service group.

DELETE/v1/{project_id}/service-sets/{set_id}

cfw:serviceGroup:delete

None

√

√

Query the details about a service group.

GET/v1/{project_id}/service-sets/{set_id}

cfw:serviceGroup:get

None

√

√

Query the service group list.

GET/v1/{project_id}/service-sets

cfw:serviceGroup:list

None

√

√

Add a member to a service group.

POST/v1/{project_id}/service-items

cfw:serviceMember:create

None

√

√

Delete a member from a service group.

DELETE/v1/{project_id}/service-items/{item_id}

cfw:serviceMember:delete

None

√

√

Query service group members.

GET/v1/{project_id}/service-items

cfw:serviceMember:list

None

√

√

Query the ACL log list.

GET/v1/{project_id}/cfw/logs/access-control

cfw:accessControlLog:list

None

√

√

Query the traffic log list.

GET/v1/{project_id}/cfw/logs/flow

cfw:flowLog:list

None

√

√

Query the attack log list.

GET/v1/{project_id}/cfw/logs/attack

cfw:attackLog:list

None

√

√

Configure the IPS mode.

POST/v1/{project_id}/ips/protect

cfw:ipsMode:operate

None

√

√

Query the IPS mode.

GET/v1/{project_id}/ips/protect

cfw:ipsMode:get

None

√

√

Query firewalls.

GET /v1/{project_id}/firewall/exist

cfw:instance:list

None

√

√

Update the DNS server.

PUT /v1/{project_id}/dns/servers

cfw:acl:put

None

√

√

Query the DNS server.

GET /v1/{project_id}/dns/servers

cfw:domain:get

None

√

√

Check a domain name.

GET /v1/{project_id}/domain/parse/{domain_name}

cfw:domain:get

None

√

√

Change the east-west protection status.

POST /v1/{project_id}/firewall/east-west/protect

cfw:instance:create

None

√

√

Query east-west firewalls.

GET /v1/{project_id}/firewall/east-west

cfw:instance:list

None

√

√

Query VPC protection.

GET /v1/{project_id}/vpcs/protection

cfw:instance:list

None

√

√
Parent Topic: Permissions and Supported Actions