Help Center> Identity and Access Management> API Reference> API> Permissions Management> Querying Permissions of a User Group for a Global Service Project
Updated on 2023-07-18 GMT+08:00

Querying Permissions of a User Group for a Global Service Project

Function

This API is provided for the administrator to query the permissions of a user group for a global service project.

The API can be called using both the global endpoint and region-specific endpoints. For IAM endpoints, see Regions and Endpoints.

URI

GET /v3/domains/{domain_id}/groups/{group_id}/roles

Table 1 URI parameters

Parameter

Mandatory

Type

Description

domain_id

Yes

String

Account ID. For details about how to obtain the account ID, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

group_id

Yes

String

User group ID. For details about how to obtain a user group ID, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

Request Parameters

Table 2 Parameters in the request header

Parameter

Mandatory

Type

Description

Content-Type

Yes

String

Fill application/json;charset=utf8 in this field.

X-Auth-Token

Yes

String

Access token issued to a user to bear its identity and permissions.

For details about the permissions required by the token, see Actions.

Response Parameters

Table 3 Parameters in the response body

Parameter

Type

Description

links

Object

Resource link information.

roles

Array of objects

Permission information.

Table 5 roles

Parameter

Type

Description

domain_id

String

ID of the account to which the permission belongs.

flag

String

If this parameter is set to fine_grained, the permission is a system-defined policy.

description_cn

String

Description of the permission in Chinese.

catalog

String

Service catalog of the permission.

name

String

Permission name for internal use. For example, ccs_user is the internal name of the CCS User role for CCS.

This parameter is carried in the token of a user, allowing the system to determine whether the user has permissions to access a specific cloud service.

description

String

Description of the permission.

links

Object

Permission resource link.

id

String

Permission ID.

display_name

String

Permission name.

type

String

Display mode of the permission.

NOTE:
  • AX: Account level.
  • XA: Project level.
  • AA: Both the account level and project level.
  • XX: Neither the account level nor project level.
  • The display mode of a custom policy can only be AX or XA. A custom policy must be displayed at either of the two levels.

policy

Object

Content of the permission.

updated_time

String

Time when the permission was last updated.

NOTE:

The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.

created_time

String

Time when the permission was created.

NOTE:

The value is a UTC time in the YYYY-MM-DDTHH:mm:ss.ssssssZ format, for example, 2023-06-28T08:56:33.710000Z. For details about the date and timestamp formats, see ISO-8601.

Table 7 roles.policy

Parameter

Type

Description

Depends

Array of objects

Dependent permissions.

Statement

Array of objects

Statement of the permission.

Version

String

Policy version.

NOTE:
  • 1.0: System-defined role. Only a limited number of service-level roles are provided for authorization.
  • 1.1: Policy. A policy defines the permissions required to perform operations on a specific cloud resource under certain conditions.
Table 8 roles.policy.Depends

Parameter

Type

Description

catalog

String

Service catalog of the permission.

display_name

String

Display name of the permission.

Table 9 roles.policy.Statement

Parameter

Type

Description

Action

Array of strings

Specific operation permissions on a resource. For details about supported actions, see "Permissions and Supported Actions" in the API Reference of cloud services.

NOTE:
  • The value format is Service name:Resource type:Operation, for example, vpc:ports:create.
  • Service name: indicates the product name, such as ecs, evs, or vpc. Only lowercase letters are allowed. Resource types and operations are not case-sensitive. You can use an asterisk (*) to represent all operations.
  • In the case of a custom policy for agencies, this parameter should be set to "Action": ["iam:agencies:assume"].

Effect

String

Effect of the permission. The value can be Allow or Deny. If both Allow and Deny statements are found in a policy, the authentication starts from the Deny statements.

Options:

  • Allow
  • Deny

Condition

Object

Conditions for the permission to take effect. For details, see Creating a Custom Policy.

NOTE:

Take the condition in the sample request as an example, the values of the condition key (obs:prefix) and string (public) must be equal (StringEquals).

 "Condition": {
              "StringEquals": {
                "obs:prefix": [
                  "public"
                ]
              }
            }

Resource

Array of strings

Cloud resource.

NOTE:
  • Format: ::::. For example, obs:::bucket:*. Asterisks are allowed.
  • The region segment can be * or a region accessible to the user. The specified resource must belong to the corresponding service that actually exists.
  • In the case of a custom policy for agencies, the type of this parameter is Object, and the value should be set to "Resource": {"uri": ["/iam/agencies/07805acaba800fdd4fbdc00b8f888c7c"]}.

Example Request

Request for querying the permissions of a user group for a global service project

GET https://iam.myhuaweicloud.com/v3/domains/{domain_id}/groups/{group_id}/roles

Example Response

Status code: 200

The request is successful.

{
    "roles": [
        {
            "domain_id": null,
            "flag": "fine_grained",
            "description_cn": "Description of the permission in Chinese",
            "catalog": "CDN",
            "name": "system_all_11",
            "description": "Allow Query Domains",
            "links": {
                "next": null,
                "previous": null,
                "self": "https://iam.myhuaweicloud.com/v3/roles/db4259cce0ce47c9903dfdc195eb453b"
            },
            "id": "db4259cce0ce47c9903dfdc195eb453b",
            "display_name": "CDN Domain Viewer",
            "type": "AX",
            "policy": {
                "Version": "1.1",
                "Statement": [
                    {
                        "Action": [
                            "cdn:configuration:queryDomains",
                            "cdn:configuration:queryOriginServerInfo",
                            "cdn:configuration:queryOriginConfInfo",
                            "cdn:configuration:queryHttpsConf",
                            "cdn:configuration:queryCacheRule",
                            "cdn:configuration:queryReferConf",
                            "cdn:configuration:queryChargeMode",
                            "cdn:configuration:queryCacheHistoryTask",
                            "cdn:configuration:queryIpAcl",
                            "cdn:configuration:queryResponseHeaderList"
                        ],
                        "Effect": "Allow"
                    }
                ]
            }
        }
    ],
    "links": {
        "next": null,
        "previous": null,
        "self": "https://iam.myhuaweicloud.com/v3/domains/d78cbac186b744899480f25bd022f468/groups/077d71374b8025173f61c003ea0a11ac/roles"
    }
}

Status Codes

Status Code

Description

200

The request is successful.

400

Invalid parameters.

401

Authentication failed.

403

Access denied.

404

The requested resource cannot be found.

Error Codes

None