Help Center/ Data Encryption Workshop/ API Reference/ Permissions Policies and Supported Actions/ Actions Supported by Policy-based Authorization
Updated on 2026-09-20 GMT+08:00
View PDF
Share

Actions Supported by Policy-based Authorization

This section describes the actions supported by policy-based authorization in DEW.

Supported Actions

DEW provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. Concepts related to policies:

  • Permissions: statements in a policy that allow or deny certain operations
  • APIs: REST APIs that can be called by a user who has been granted specific permissions.
  • Actions: Specific operations that are allowed or denied in a custom policy.
  • Dependent actions: Some actions depend on other actions. When assigning an action to users, you also need to assign dependent permissions for that action to take effect.
  • IAM project or enterprise project: Authorization scope of a custom policy, including IAM projects and enterprise projects. For example, if you set the authorization scope of a custom policy to both IAM projects and enterprise projects, the policy takes effect for user groups in either IAM or the enterprise management service. If an action supports only IAM projects, the custom policy that contains this action will take effect only for user groups in IAM. If such a policy is assigned to user groups in Enterprise Management, it will not take effect. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise management, see What Are the Differences Between IAM and Enterprise Management?

The following tables describe the custom policy actions supported by KMS, KPS, and CSMS.

Table 1 Policy actions supported by KMS

Permission

API

Action

IAM Project

Enterprise Project

Resource-Level Fine-grained

Canceling the scheduled deletion of a key

/v1.0/{project_id}/kms/cancel-key-deletion

kms:cmk:update

√

√

√

Creating a key

/v1.0/{project_id}/kms/create-key

kms:cmk:create

√

√

×

Scheduling the deletion of a key

/v1.0/{project_id}/kms/schedule-key-deletion

kms:cmk:update

√

√

√

Disabling a key

/v1.0/{project_id}/kms/disable-key

kms:cmk:disable

√

√

√

Enabling a key

/v1.0/{project_id}/kms/enable-key

kms:cmk:enable

√

√

√

Modifying the key alias

/v1.0/{project_id}/kms/update-key-alias

kms:cmk:update

√

√

√

Modifying the key description

/v1.0/{project_id}/kms/update-key-description

kms:cmk:update

√

√

√

Creating a DEK

/v1.0/{project_id}/kms/create-datakey

kms:dek:create

√

√

√

Creating a plaintext-free DEK

/v1.0/{project_id}/kms/create-datakey-without-plaintext

kms:dek:create

√

√

√

Creating an EC data key pair

/v1.0/{project_id}/kms/create-ec-datakey-pair

kms:cmk:createDataKeyPair

√

√

√

Creating a PIN

/v1.0/{project_id}/kms/create-pin

N/A

N/A

N/A

N/A

Generating a random number

/v1.0/{project_id}/kms/gen-random

kms:cmk:generate

√

√

×

Creating an RSA data key pair

/v1.0/{project_id}/kms/create-rsa-datakey-pair

kms:cmk:createDataKeyPair

√

√

√

Decrypting a DEK

/v1.0/{project_id}/kms/decrypt-datakey
  • kms:dek:crypto
  • kms:dek:decrypt

√

√

√

Encrypting a DEK

/v1.0/{project_id}/kms/encrypt-datakey
  • kms:dek:crypto
  • kms:dek:encrypt

√

√

√

Obtaining parameters for importing a key

/v1.0/{project_id}/kms/get-parameters-for-import

kms:cmk:getMaterial

√

√

√

Deleting key materials

/v1.0/{project_id}/kms/delete-imported-key-material

kms:cmk:deleteMaterial

√

√

√

Importing key materials

/v1.0/{project_id}/kms/import-key-material

kms:cmk:importMaterial

√

√

√

Revoking a grant

/v1.0/{project_id}/kms/revoke-grant

kms:grant:revoke

√

√

√

Retiring a grant

/v1.0/{project_id}/kms/retire-grant

kms:grant:retire

√

√

√

Creating a grant

/v1.0/{project_id}/kms/create-grant

kms:grant:create

√

√

√

Querying the grant list

/v1.0/{project_id}/kms/list-grants

kms:grant:list

√

√

√

Querying retirable grants

/v1.0/{project_id}/kms/list-retirable-grants

kms:grant:list

√

√

×

Decrypting data

/v1.0/{project_id}/kms/decrypt-data
  • kms:cmk:crypto
  • kms:cmk:decrypt

√

√

√

Encrypting data

/v1.0/{project_id}/kms/encrypt-data
  • kms:cmk:crypto
  • kms:cmk:encrypt

√

√

√

Signature data

/v1.0/{project_id}/kms/sign

kms:cmk:sign

√

√

√

Verifying a signature

/v1.0/{project_id}/kms/verify

kms:cmk:verify

√

√

√

Disabling key rotation

/v1.0/{project_id}/kms/disable-key-rotation

kms:cmk:disableRotation

√

√

√

Enabling key rotation

/v1.0/{project_id}/kms/enable-key-rotation

kms:cmk:enableRotation

√

√

√

Querying the key rotation status

/v1.0/{project_id}/kms/get-key-rotation-status

kms:cmk:getRotation

√

√

√

Modifying the rotation interval

/v1.0/{project_id}/kms/update-key-rotation-interval

kms:cmk:updateRotation

√

√

√

Adding or deleting key tags in batches

/v1.0/{project_id}/kms/{key_id}/tags/action

kms:cmkTag:batch

√

√

√

Adding tags to a key

/v1.0/{project_id}/kms/{key_id}/tags

kms:cmkTag:create

√

√

√

Deleting a key tag

/v1.0/{project_id}/kms/{key_id}/tags/{key}

kms:cmkTag:delete

√

√

√

Querying key instances

/v1.0/{project_id}/kms/{resource_instances}/action

kms:cmkTag:listInstance

√

√

×

Querying project tags

/v1.0/{project_id}/kms/tags

kms::listAllTags

√

√

×

Querying key tags

/v1.0/{project_id}/kms/{key_id}/tags

kms:cmkTag:list

√

√

×

Querying key information

/v1.0/{project_id}/kms/describe-key

kms:cmk:get

√

√

√

Querying the key list

/v1.0/{project_id}/kms/list-keys

kms:cmk:list

√

√

×

Querying a public key

/v1.0/{project_id}/kms/get-publickey

kms:cmk:getPublicKey

√

√

√

Querying the number of instances

/v1.0/{project_id}/kms/user-instances

kms:cmk:getInstance

√

×

×

Querying quota

/v1.0/{project_id}/kms/user-quotas

kms:cmk:getQuota

√

×

×

Querying a specified version

/{version_id}

N/A

N/A

N/A

N/A

Querying all versions

/

N/A

N/A

N/A

N/A

Creating a dedicated keystore

/v1.0/{project_id}/keystores

kms:keystore:create

√

×

√

Deleting a dedicated keystore

/v1.0/{project_id}/keystores/{keystore_id}

kms:keystore:delete

√

×

√

Disabling a dedicated keystore

/v1.0/{project_id}/keystores/{keystore_id}/disable

kms:keystore:disable

√

×

√

Enabling a dedicated keystore

/v1.0/{project_id}/keystores/{keystore_id}/enable

kms:keystore:enable

√

×

√

Querying the dedicated keystore list

/v1.0/{project_id}/keystores

kms:keystore:list

√

×

×

Obtaining a dedicated keystore

/v1.0/{project_id}/keystores/{keystore_id}

kms:keystore:get

√

×

√

Querying the regions supported by a cross-region key

/v2/{project_id}/kms/regions

N/A

N/A

N/A

N/A

Copying a key to a specified region

/v2/{project_id}/kms/keys/{key_id}/replicate

kms:cmk:replicate

√

√

√

Changing the primary region to which the key belongs

/v2/{project_id}/kms/keys/{key_id}/update-primary-region

kms:cmk:updatePrimaryRegion

√

√

√

Generating a MAC

/v1.0/{project_id}/kms/generate-mac

kms:cmk:generateMac

√

√

√

Verifying a MAC

/v1.0/{project_id}/kms/verify-mac

kms:cmk:verifyMac

√

√

√

Associating an alias with a key

/v1.0/{project_id}/kms/alias/associate

kms:alias:associate

√

×

√

Creating a key alias

/v1.0/{project_id}/kms/aliases

kms:alias:create

√

×

√

Deleting a key alias

/v1.0/{project_id}/kms/aliases

kms:alias:delete

√

×

√

Querying the alias associated with a key

/v1.0/{project_id}/kms/aliases

kms:alias:list

√

×

√
Table 2 Policy actions supported by KPS

Permission

API

Action

IAM Project

Enterprise Project

Resource-Level Fine-grained

Exporting private keys of key pairs in batches

/v3/{project_id}/keypairs/private-key/batch-export

kps:domainKeypairs:exportpk

√

×

×

Importing SSH key pairs in batches

/v3/{project_id}/keypairs/batch-import

kps:domainKeypairs:create

√

×

×

Clearing a private key

/v3/{project_id}/keypairs/{keypair_name}/private-key

kps:domainKeypairs:clearpk

√

×

×

Creating and importing an SSH key pair

/v3/{project_id}/keypairs

kps:domainKeypairs:create

√

×

×

Deleting an SSH key pair

/v3/{project_id}/keypairs/{keypair_name}

kps:domainKeypairs:delete

√

×

×

Exporting a private key

/v3/{project_id}/keypairs/private-key/export

kps:domainKeypairs:exportpk

√

×

×

Importing a private key

/v3/{project_id}/keypairs/private-key/import

kps:domainKeypairs:importpk

√

×

×

Obtaining details about an SSH key pair

/v3/{project_id}/keypairs/{keypair_name}

kps:domainKeypairs:get

√

×

×

Querying the SSH key pair list

/v3/{project_id}/keypairs

kps:domainKeypairs:list

√

×

×

Updating the description about an SSH key pair

/v3/{project_id}/keypairs/{keypair_name}

kps:domainKeypairs:update

√

×

×

Binding an SSH key pair

/v3/{project_id}/keypairs/associate

kps:domainKeypairs:bind

√

×

×

Importing SSH key pairs in batches

/v3/{project_id}/keypairs/batch-import

kps:domainKeypairs:create

√

×

×

Deleting all failed tasks

/v3/{project_id}/failed-tasks

kps:domainKeypairs:deletefailtasks

√

×

×

Deleting failed tasks

/v3/{project_id}/failed-tasks/{task_id}

kps:domainKeypairs:deletefailtask

√

×

×

Unbinding an SSH key pair

/v3/{project_id}/keypairs/disassociate

kps:domainKeypairs:unbind

√

×

×

Querying failed tasks

/v3/{project_id}/failed-tasks

kps:domainKeypairs:getfailtask

√

×

×

Obtaining task information

/v3/{project_id}/tasks/{task_id}

kps:domainKeypairs:gettask

√

×

×

Querying the information about a task that is being processed

/v3/{project_id}/running-tasks

kps:domainKeypairs:getrunningtask

√

×

×
Table 3 Policy actions supported by CSMS

Permission

API

Action

IAM Project

Enterprise Project

Resource-Level Fine-grained

Deleting secrets in batches

/v1/{project_id}/secrets/batch-delete

csms:secret:delete

√

×

×

Creating a secret

/v1/{project_id}/secrets

csms:secret:create

√

√

√

Deleting a secret immediately

/v1/{project_id}/secrets/{secret_name}

csms:secret:delete

√

√

√

Creating a scheduled secret deletion task

/v1/{project_id}/secrets/{secret_name}/scheduled-deleted-tasks/create

csms:secret:deleteScheduled

√

√

√

Downloading a secret backup

/v1/{project_id}/secrets/{secret_name}/backup

csms:secret:get

√

√

√

Obtaining the secret list

/v1/{project_id}/secrets

csms:secret:list

√

√

×

Canceling a scheduled secret deletion task

/v1/{project_id}/secrets/{secret_name}/scheduled-deleted-tasks/cancel

csms:secret:deleteCancelled

√

√

√

Secret rotation

/v1/{project_id}/secrets/{secret_name}/rotate

csms:secret:rotate

√

√

√

Querying a secret

/v1/{project_id}/secrets/{secret_name}

csms:secret:get

√

√

√

Updating a secret

/v1/{project_id}/secrets/{secret_name}

csms:secret:update

√

√

√

Restoring a secret

/v1/{project_id}/secrets/restore

csms:secret:create

√

×

×

Creating a secret version

/v1/{project_id}/secrets/{secret_name}/versions

csms:secretVersion:create

√

√

√

Obtaining the secret version list

/v1/{project_id}/secrets/{secret_name}/versions

csms:secretVersion:list

√

√

√

Querying the secret version and value

/v1/{project_id}/secrets/{secret_name}/versions/{version_id}

csms:secretVersion:get

√

√

√

Updating a secret version

/v1/{project_id}/secrets/{secret_name}/versions/{version_id}

csms:secretVersion:update

√

√

√

Creating a secret version status

/v1/{project_id}/secrets/{secret_name}/stages

csms:secretStage:create

√

√

√

Querying the version status of a secret

/v1/{project_id}/secrets/{secret_name}/stages/{stage_name}

csms:secretStage:get

√

√

√

Deleting the version status of a secret

/v1/{project_id}/secrets/{secret_name}/stages/{stage_name}

csms:secretStage:delete

√

√

√

Updating the version status of a secret

/v1/{project_id}/secrets/{secret_name}/stages/{stage_name}

csms:secretStage:update

√

√

√

Adding or deleting secret tags in batches

/v1/{project_id}/csms/{secret_id}/tags/action

csms:tag:batch

√

√

√

Adding a secret tag

/v1/{project_id}/csms/{secret_id}/tags

csms:tag:create

√

√

√

Deleting a secret tag

/v1/{project_id}/csms/{secret_id}/tags/{key}

csms:tag:delete

√

√

√

Querying project tags

/v1/{project_id}/csms/tags

csms:tag:getAll

√

×

×

Querying a secret instance

/v1/{project_id}/csms/{resource_instances}/action

csms:tag:getSecretByTag

√

×

×

Querying secret tags

/v1/{project_id}/csms/{secret_id}/tags

csms:tag:getBySecret

√

√

√

Creating an event

/v1/{project_id}/csms/events

csms:event:create

√

×

×

Deleting an event immediately

/v1/{project_id}/csms/events/{event_name}

csms:event:delete

√

×

×

Querying the record of triggered event notifications

/v1/{project_id}/csms/notification-records

csms:event:listNotificationRecords

√

×

×

Obtaining the event list

/v1/{project_id}/csms/events

csms:event:list

√

×

×

Querying an event

/v1/{project_id}/csms/events/{event_name}

csms:event:get

√

×

×

Updating an event

/v1/{project_id}/csms/events/{event_name}

csms:event:update

√

×

×

Creating a service agency

/v1/csms/agencies

N/A

√

×

×

Obtaining the secret rotation function template

/v1/csms/function-templates

N/A

√

×

×

Checking whether a service agency exists

/v1/csms/agencies

N/A

√

×

×

Querying the task list

/v1/{project_id}/csms/tasks

csms:task:list

√

×

×
Parent Topic: Permissions Policies and Supported Actions