Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by SWR, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by SWR, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for SWR.

**Table 1** Actions supported by SWR
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
swr:repository:createImmutableRule	Grants permission to create immutableRule for edition instance.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteImmutableRule	Grants permission to delete immutableRule for edition instance.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listImmutableRules	Grants permission to list immutableRule for edition instance.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateImmutableRule	Grants permission to update immutableRule for edition instance.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listArtifacts	Grants permission to query the artifact list.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getArtifact	Grants permission to query the policy of resource instance.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteArtifact	Grants permission to delete a artifact.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listAccessories	Grants permission to query the accessory list.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getArtifactAddition	Grants permission to query the addition information of a artifact.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getConfigurations	Grants permission to query the configurations of resource instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateConfigurations	Grants permission to update the configurations of resource instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listResourceInstances	Grants permission to query the list of resource instance.	List	instance *	-	-
swr:instance:listResourceInstances	Grants permission to query the list of resource instance.	List	-	g:TagKeys g:RequestTag/<tag-key>	-
swr:instance:getResourceInstancesCount	Grants permission to query the count of resource instance.	Read	instance *	-	-
swr:instance:getResourceInstancesCount	Grants permission to query the count of resource instance.	Read	-	g:TagKeys g:RequestTag/<tag-key>	-
swr:instance:createResourceTags	Grants permission to create resource tags in batch.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createResourceTags	Grants permission to create resource tags in batch.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
swr:instance:deleteResourceTags	Grants permission to delete resource tags in batch.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteResourceTags	Grants permission to delete resource tags in batch.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
swr:instance:getProjectTags	Grants permission to query the resource tags of project.	Read	-	-	-
swr:instance:getResourceTags	Grants permission to query the resource tags of resource.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:create	Grants permission to create an enterprise edition instance.	Write	instance *	-	-
swr:instance:create	Grants permission to create an enterprise edition instance.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys swr:VpcId swr:SubnetId swr:EnableObsEncrypt	-
swr:instance:list	Grants permission to query the list of enterprise edition instances.	List	instance *	-	-
swr:instance:get	Grants permission to query an enterprise edition instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
swr:instance:delete	Grants permission to delete an enterprise edition instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
swr:instance:getAuditLogs	Grants permission to query the audit logs of an enterprise edition instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getStatistics	Grants permission to query the statistics of an enterprise edition instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listJobs	Grants permission to query the list of jobs.	List	instance *	-	-
swr:instance:getJobs	Grants permission to query a job.	Read	instance *	-	-
swr:instance:deleteJob	Grants permission to delete a job.	Write	instance *	-	-
swr:repository:createNamespace	Grants permission to create an namespace.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createNamespace	Grants permission to create an namespace.	Write	-	swr:EnablePublicNameSpace	-
swr:repository:listNamespaces	Grants permission to query the list of namespace.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getNamespace	Grants permission to query an namespace.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateNamespace	Grants permission to update an namespace.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateNamespace	Grants permission to update an namespace.	Write	-	swr:EnablePublicNameSpace	-
swr:repository:deleteNamespace	Grants permission to delete an namespace.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRepositories	Grants permission to query the list of artifact repositories.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getRepository	Grants permission to query an artifact repository.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateRepository	Grants permission to update an artifact repository.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteRepository	Grants permission to delete an artifact repository.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listTags	Grants permission to query the tag list.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getTag	Grants permission to query the details of a tag.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteTag	Grants permission to delete a tag.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getTagAddition	Grants permission to query the addition information of a tag.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createRetentionPolicy	Grants permission to create an image tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicies	Grants permission to query the list of image tag retention policies.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getRetentionPolicy	Grants permission to query the details of an image tag retention policy.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateRetentionPolicy	Grants permission to update an image tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteRetentionPolicy	Grants permission to delete an image tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:executeRetentionPolicy	Grants permission to apply an image tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecutions	Grants permission to query the history of image tag retention events.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecTasks	Grants permission to query the list of image tag retention tasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecSubTasks	Grants permission to query the list of image tag retention subtasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createWebhook	Grants permission to create a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listWebhooks	Grants permission to query the list of triggers.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getWebhook	Grants permission to query the details of a trigger.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateWebhook	Grants permission to edit a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteWebhook	Grants permission to delete a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listWebhookJobs	Grants permission to query the list of triggers.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createRegistry	Grants permission to create a destination registry.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listRegistries	Grants permission to query the list of destination registries.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getRegistry	Grants permission to query the details of of a destination registry.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateRegistry	Grants permission to edit a destination registry.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteRegistry	Grants permission to delete a destination registry.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createReplicationPolicy	Grants permission to create a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId swr:TargetRegion swr:SourceRegion swr:TargetUrls swr:SourceUrls	-
swr:instance:listReplicationPolicies	Grants permission to query the replication policy list.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getReplicationPolicy	Grants permission to query the details of a replication policy.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateReplicationPolicy	Grants permission to edit a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId swr:TargetRegion swr:SourceRegion swr:TargetUrls swr:SourceUrls	-
swr:instance:deleteReplicationPolicy	Grants permission to delete a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:executeReplicationPolicy	Grants permission to apply a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:stopReplicationPolicyExecution	Grants permission to stop the history of replication events.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecutions	Grants permission to query the history of replication events.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecTasks	Grants permission to query the list of replication tasks.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecSubTasks	Grants permission to query the list of a replication subtasks.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createSignPolicy	Grants permission to create a signing policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicies	Grants permission to query the signing policy list.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getSignPolicy	Grants permission to query the details of a signing policy.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateSignPolicy	Grants permission to edit a signing policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteSignPolicy	Grants permission to delete a signing policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:executeSignPolicy	Grants permission to apply a signing policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecutions	Grants permission to query the history of signing events.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecTasks	Grants permission to query the list of signing tasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecSubTasks	Grants permission to query the list of signing subtasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateEndpointPolicy	Grants permission to update the whitelist of public network access.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateEndpointPolicyStatus	Grants permission to update the whitelist of public network access status.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getEndpointPolicy	Grants permission to query the whitelist of public network access.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createInternalEndpoint	Grants permission to create an internal endpoint.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createInternalEndpoint	Grants permission to create an internal endpoint.	Write	-	swr:VpcId swr:SubnetId	-
swr:instance:getInternalEndpoint	Grants permission to get an internal endpoint.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteInternalEndpoint	Grants permission to delete an internal endpoint.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listInternalEndpoints	Grants permission to query the list of internal endpoints.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:uploadArtifact	Grants permission to upload an artifact.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:downloadArtifact	Grants permission to download an artifact.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId swr:RepositoryIsPublic	-
swr:instance:createTempCredential	Grants permission to create a temporary access credential.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createLTCredential	Grants permission to create an access credential with long-term validity.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateLTCredential	Grants permission to enable/disable an access credential with long-term validity.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listLTCredentials	Grants permission to query the list of long-term validity.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteLTCredential	Grants permission to delete an access credential with long-term validity.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:addDomainName	Grants permission to add a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteDomainName	Grants permission to delete a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateDomainName	Grants permission to update a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listDomainNames	Grants permission to query the list of domain name.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listCatalog	Grants permission to query the list of catalog.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listAllArtifacts	Grants permission to query the list of instance artifacts.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:startManualScanning	Grant permission for manual initiation of artifact scanning.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getArtifactVulnerabilities	Grant permission to query artifact vulnerabilities.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-

Each API of SWR usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by SWR APIs
API	Action	Dependencies
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts	swr:repository:listArtifacts	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}	swr:repository:getArtifact	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}	swr:repository:deleteArtifact	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/accessories	swr:repository:listAccessories	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/additions/{addition}	swr:repository:getArtifactAddition	-
GET /v2/{project_id}/instances/{instance_id}/configurations	swr:instance:getConfigurations	-
PUT /v2/{project_id}/instances/{instance_id}/configurations	swr:instance:updateConfigurations	-
POST /v2/{project_id}/{resource_type}/resource-instances/filter	swr:instance:listResourceInstances	-
POST /v2/{project_id}/{resource_type}/resource-instances/count	swr:instance:getResourceInstancesCount	-
POST /v2/{project_id}/{resource_type}/{resource_id}/tags/create	swr:instance:createResourceTags	-
DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/delete	swr:instance:deleteResourceTags	-
GET /v2/{project_id}/instances/tags	swr:instance:getProjectTags	-
GET /v2/{project_id}/{resource_type}/{resource_id}/tags	swr:instance:getResourceTags	-
POST /v2/{project_id}/instances	swr:instance:create	-
GET /v2/{project_id}/instances	swr:instance:list	-
GET /v2/{project_id}/instances/{instance_id}	swr:instance:get	-
DELETE /v2/{project_id}/instances/{instance_id}	swr:instance:delete	-
GET /v2/{project_id}/instances/{instance_id}/audit-logs	swr:instance:getAuditLogs	-
GET /v2/{project_id}/instances/{instance_id}/statistics	swr:instance:getStatistics	-
GET /v2/{project_id}/jobs	swr:instance:listJobs	-
-	swr:instance:getJobs	-
DELETE /v2/{project_id}/jobs/{job_id}	swr:instance:deleteJob	-
POST /v2/{project_id}/instances/{instance_id}/namespaces	swr:repository:createNamespace	-
GET /v2/{project_id}/instances/{instance_id}/namespaces	swr:repository:listNamespaces	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:getNamespace	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:updateNamespace	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:deleteNamespace	-
GET /v2/{project_id}/instances/{instance_id}/repositories	swr:repository:listRepositories	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:getRepository	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:updateRepository	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:deleteRepository	-
GET /v2/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/tags	swr:repository:listTags	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/additions/{addition}	swr:repository:getTagAddition	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies	swr:repository:createRetentionPolicy	-
GET /v2/{project_id}/instances/{instance_id}/retention/policies	swr:repository:listRetentionPolicies	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:getRetentionPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:updateRetentionPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:deleteRetentionPolicy	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions	swr:repository:executeRetentionPolicy	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions	swr:repository:listRetentionPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions/{execution_id}/tasks	swr:repository:listRetentionPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions/{execution_id}/tasks/{task_id}/subtasks	swr:repository:listRetentionPolicyExecSubTasks	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies	swr:repository:createWebhook	-
GET /v2/{project_id}/instances/{instance_id}/webhook/policies	swr:repository:listWebhooks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:getWebhook	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:updateWebhook	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:deleteWebhook	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}/jobs	swr:repository:listWebhookJobs	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules	swr:repository:createImmutableRule	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules/{immutable_rule_id}	swr:repository:deleteImmutableRule	-
GET /v2/{project_id}/instances/{instance_id}/immutabletagrules	swr:repository:listImmutableRules	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules/{immutable_rule_id}	swr:repository:updateImmutableRule	-
POST /v2/{project_id}/instances/{instance_id}/registries	swr:instance:createRegistry	-
GET /v2/{project_id}/instances/{instance_id}/registries	swr:instance:listRegistries	-
GET /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:getRegistry	-
PUT /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:updateRegistry	-
DELETE /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:deleteRegistry	-
POST /v2/{project_id}/instances/{instance_id}/replication/policies	swr:instance:createReplicationPolicy	-
GET /v2/{project_id}/instances/{instance_id}/replication/policies	swr:instance:listReplicationPolicies	-
GET /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:getReplicationPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:updateReplicationPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:deleteReplicationPolicy	-
POST /v2/{project_id}/instances/{instance_id}/replication/executions	swr:instance:executeReplicationPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}	swr:instance:stopReplicationPolicyExecution	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions	swr:instance:listReplicationPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}/tasks	swr:instance:listReplicationPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}/tasks/{task_id}/subtasks	swr:instance:listReplicationPolicyExecSubTasks	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies	swr:repository:createSignPolicy	-
GET /v2/{project_id}/instances/{instance_id}/signature/policies	swr:repository:listSignPolicies	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:getSignPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:updateSignPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:deleteSignPolicy	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions	swr:repository:executeSignPolicy	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions	swr:repository:listSignPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions/{execution_id}/tasks	swr:repository:listSignPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions/{execution_id}/tasks/{task_id}/subtasks	swr:repository:listSignPolicyExecSubTasks	-
PUT /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:updateEndpointPolicy	-
POST /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:updateEndpointPolicyStatus	-
GET /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:getEndpointPolicy	-
POST /v2/{project_id}/instances/{instance_id}/internal-endpoints	swr:instance:createInternalEndpoint	-
GET /v2/{project_id}/instances/{instance_id}/internal-endpoints/{internal_endpoints_id}	swr:instance:getInternalEndpoint	-
DELETE /v2/{project_id}/instances/{instance_id}/internal-endpoints/{internal_endpoints_id}	swr:instance:deleteInternalEndpoint	-
GET /v2/{project_id}/instances/{instance_id}/internal-endpoints	swr:instance:listInternalEndpoints	-
-	swr:repository:uploadArtifact	-
-	swr:repository:downloadArtifact	-
POST /v2/{project_id}/instances/{instance_id}/temp-credential	swr:instance:createTempCredential	-
POST /v2/{project_id}/instances/{instance_id}/long-term-credential	swr:instance:createLTCredential	-
PUT /v2/{project_id}/instances/{instance_id}/long-term-credentials/{credential_id}	swr:instance:updateLTCredential	-
GET /v2/{project_id}/instances/{instance_id}/long-term-credentials	swr:instance:listLTCredentials	-
DELETE /v2/{project_id}/instances/{instance_id}/long-term-credentials/{credential_id}	swr:instance:deleteLTCredential	-
POST /v2/{project_id}/instances/{instance_id}/domainname	swr:instance:addDomainName	scm:cert:export
DELETE /v2/{project_id}/instances/{instance_id}/domainname/{domainname_id}	swr:instance:deleteDomainName	-
PUT /v2/{project_id}/instances/{instance_id}/domainname/{domainname_id}	swr:instance:updateDomainName	-
GET /v2/{project_id}/instances/{instance_id}/domainname	swr:instance:listDomainNames	-
-	swr:repository:listCatalog	-
GET /v2/{project_id}/instances/{instance_id}/artifacts	swr:instance:listAllArtifacts	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/scan	swr:repository:startManualScanning	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/vulnerabilities	swr:repository:listArtifactVulnerabilities	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for SWR.

**Table 3** Resource types supported by SWR
Resource Type	URN
repository	swr:<region>:<account-id>:repository:<instance-name>/<repository-path>
instance	swr:<region>:<account-id>:instance:<instance-name>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, swr) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by SWR

The following table lists the condition keys that you can define in identity policies for SWR. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by SWR
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
swr:VpcId	string	Single-valued	Filters access by user's VPC ID.
swr:SubnetId	string	Single-valued	Filters access by user's Subnet ID.
swr:EnablePublicNameSpace	boolean	Single-valued	Filters access by enterprise instance's namespace public attribute.
swr:EnableObsEncrypt	boolean	Single-valued	Filters access by enterprise instance's obs bucket encrypted type.
swr:TargetRegion	string	Single-valued	Filters access by target region.
swr:SourceRegion	string	Single-valued	Filters access by source region.
swr:TargetUrls	string	Multivalued	Filters access by target url.
swr:SourceUrls	string	Multivalued	Filters access by source url.
swr:RepositoryIsPublic	boolean	Single-valued	Filters access by public repositories.