Help Center/ Identity and Access Management/ API Reference/ API/ Security Settings/ Modifying the Operation Protection Policy
Updated on 2024-11-18 GMT+08:00
View PDF
Share

Modifying the Operation Protection Policy

Function

This API is provided for the administrator to modify the operation protection policy.

The API can be called using both the global endpoint and region-specific endpoints. For IAM endpoints, see Regions and Endpoints.

Debugging

You can debug this API in API Explorer.

URI

PUT /v3.0/OS-SECURITYPOLICY/domains/{domain_id}/protect-policy

Table 1 URI parameters

Parameter

Mandatory

Type

Description

domain_id

Yes

String

Account ID. For details about how to obtain the account ID, see Obtaining Account, IAM User, Group, Project, Region, and Agency Information.

Request Parameters

Table 2 Parameters in the request header

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

Access token issued to a user to bear its identity and permissions.

For details about the permissions required by the token, see Actions.
Table 3 Parameter in the request body

Parameter

Mandatory

Type

Description

protect_policy

Yes

ProtectPolicyOption object

Specifies the operation protection policy.
Table 4 protect_policy

Parameter

Mandatory

Type

Description

operation_protection

Yes

boolean

Specifies whether operation protection has been enabled. The value can be true or false.

allow_user

No

AllowUserBody object

Specifies the attributes IAM users can modify.

mobile

No

String

Specifies the mobile number used for verification. This parameter is mandatory when admin_check is set to on and scene is set to mobile. Example:

admin_check

No

String

Specifies whether a person is designated for verification. If this parameter is set to on, you need to specify the scene parameter to designate a personnel for verification. If this parameter is set to off, the designated operator is responsible for verification.

email

No

String

Specifies the email address used for verification. This parameter is mandatory when admin_check is set to on and scene is set to email. An example value is example@email.com.

scene

No

String

Specifies the verification method. This parameter is mandatory when admin_check is set to on. The value options are mobile and email.
Table 5 protect_policy.allow_user

Parameter

Mandatory

Type

Description

manage_accesskey

No

boolean

Specifies whether IAM users are allowed to manage access keys by themselves. The value can be true or false.

manage_email

No

boolean

Specifies whether IAM users are allowed to change their email addresses. The value can be true or false.

manage_mobile

No

boolean

Specifies whether IAM users are allowed to change their mobile numbers. The value can be true or false.

manage_password

No

boolean

Specifies whether IAM users are allowed to change their passwords. The value can be true or false.

Response Parameters

Status code: 200

Table 6 Parameters in the response body

Parameter

Type

Description

protect_policy

protect_policy object

Specifies the operation protection policy.
Table 7 protect_policy

Parameter

Type

Description

allow_user

AllowUserBody object

Specifies the attributes IAM users can modify.

operation_protection

boolean

Specifies whether to enable operation protection. The value can be true or false.

admin_check

String

Specifies whether a person is designated for verification. The value on indicates that a specific person is designated for verification, and the value off indicates that the operator is designated for verification.

scene

String

Specifies the verification method.
Table 8 protect_policy.allow_user

Parameter

Type

Description

manage_accesskey

boolean

Specifies whether IAM users are allowed to manage access keys by themselves. The value can be true or false.

manage_email

boolean

Specifies whether IAM users are allowed to change their email addresses. The value can be true or false.

manage_mobile

boolean

Specifies whether IAM users are allowed to change their mobile numbers. The value can be true or false.

manage_password

boolean

Specifies whether IAM users are allowed to change their passwords. The value can be true or false.

Example Request

Request for enabling operation protection

PUT https://iam.myhuaweicloud.com/v3.0/OS-SECURITYPOLICY/domains/{domain_id}/protect-policy 
 
{ 
  "protect_policy" : { 
    "operation_protection" : true 
  } 
}

Example Response

Status code: 200

The request is successful.

{
 "protect_policy": {
  "allow_user": {
   "manage_mobile": true,
   "manage_accesskey": true,
   "manage_email": true,
   "manage_password": true
  },
  "operation_protection": true,
  "admin_check": "off",
  "scene": ""
 }
}

Status code: 400

The request body is abnormal.

  • Example 1
{ 
   "error_msg" : "'%(key)s' is a required property.", 
   "error_code" : "IAM.0072" 
 }
  • Example 2
{ 
   "error_msg" : "Invalid input for field '%(key)s'. The value is '%(value)s'.", 
   "error_code" : "IAM.0073" 
 }

Status code: 403

Access denied.

  • Example 1
{ 
   "error_msg" : "Policy doesn't allow %(actions)s to be performed.", 
   "error_code" : "IAM.0003" 
 }
  • Example 2
{ 
   "error_msg" : "You are not authorized to perform the requested action.", 
   "error_code" : "IAM.0002" 
 }

Status code: 500

The system is abnormal.

{ 
  "error_msg" : "An unexpected error prevented the server from fulfilling your request.", 
  "error_code" : "IAM.0006" 
}

Status Codes

Status Code

Description

200

The request is successful.

400

The request body is abnormal.

401

Authentication failed.

403

Access denied.

500

The system is abnormal.

Error Codes

For details, see Error Codes.

Parent topic: Security Settings