Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by SWR, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by SWR, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for SWR.

**Table 1** Actions supported by SWR
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
swr:repository:createImmutableRule	Grants permission to create an immutability rule.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteImmutableRule	Grants permission to delete an immutability rule.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listImmutableRules	Grants permission to list immutability rules.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateImmutableRule	Grants permission to modify an immutability rule.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listArtifacts	Grants permission to list artifacts.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getArtifact	Grants permission to query details about an artifact.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteArtifact	Grants permission to delete an artifact.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listAccessories	Grants permission to list artifact attachments.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getArtifactAddition	Grants permission to query additional information about an artifact.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getConfigurations	Grants permission to query specifications of an instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateConfigurations	Grants permission to update the specifications of an instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listResourceInstances	Grants permission to list resource instances.	List	instance *	-	-
swr:instance:listResourceInstances	Grants permission to list resource instances.	List	-	g:TagKeys g:RequestTag/<tag-key>	-
swr:instance:getResourceInstancesCount	Grants permission to query the number of instances.	Read	instance *	-	-
swr:instance:getResourceInstancesCount	Grants permission to query the number of instances.	Read	-	g:TagKeys g:RequestTag/<tag-key>	-
swr:instance:createResourceTags	Grants permission to batch create a resource tag.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createResourceTags	Grants permission to batch create a resource tag.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
swr:instance:deleteResourceTags	Grants permission to batch delete a resource tag.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteResourceTags	Grants permission to batch delete a resource tag.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
swr:instance:getProjectTags	Grants permission to query project tags.	Read	-	-	-
swr:instance:getResourceTags	Grants permission to query resource tags.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:create	Grants permission to create an instance.	Write	instance *	-	-
swr:instance:create	Grants permission to create an instance.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys swr:VpcId swr:SubnetId swr:EnableObsEncrypt	-
swr:instance:list	Grants permission to list instances.	List	instance *	-	-
swr:instance:get	Grants permission to query details about an instance.	Read	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
swr:instance:delete	Grants permission to delete an instance.	Write	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
swr:instance:getAuditLogs	Grants permission to query audit logs of an instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getStatistics	Grants permission to query statistics on an instance.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listJobs	Grants permission to list tasks.	List	instance *	-	-
swr:instance:getJobs	Grants permission to query details about a task.	Read	instance *	-	-
swr:instance:deleteJob	Grants permission to delete a task.	Write	instance *	-	-
swr:repository:createNamespace	Grants permission to create a namespace (an organization).	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createNamespace	Grants permission to create a namespace (an organization).	Write	-	swr:EnablePublicNameSpace	-
swr:repository:listNamespaces	Grants permission to list namespaces (organizations).	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getNamespace	Grants permission to query details about a namespace (an organization).	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateNamespace	Grants permission to modify a namespace (an organization).	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateNamespace	Grants permission to modify a namespace (an organization).	Write	-	swr:EnablePublicNameSpace	-
swr:repository:deleteNamespace	Grants permission to delete a namespace (an organization).	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRepositories	Grants permission to list artifact repositories.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getRepository	Grants permission to query details about an artifact repository.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateRepository	Grants permission to modify an artifact repository.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteRepository	Grants permission to delete an artifact repository.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listTags	Grants permission to list artifact tags.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getTag	Grants permission to query details about an artifact tag.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteTag	Grants permission to delete an artifact tag.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getTagAddition	Grants permission to query additional information about an artifact tag.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createRetentionPolicy	Grants permission to create a tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicies	Grants permission to list tag retention policies.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getRetentionPolicy	Grants permission to query details about a tag retention policy.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateRetentionPolicy	Grants permission to modify a tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteRetentionPolicy	Grants permission to delete a tag retention policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:executeRetentionPolicy	Grants permission to execute tag retention policies.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecutions	Grants permission to list tag retention records.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecTasks	Grants permission to list tag retention tasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listRetentionPolicyExecSubTasks	Grants permission to list tag retention subtasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createWebhook	Grants permission to create a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listWebhooks	Grants permission to list triggers.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getWebhook	Grants permission to query details about a trigger.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateWebhook	Grants permission to modify a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteWebhook	Grants permission to delete a trigger.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listWebhookJobs	Grants permission to list triggering records.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createRegistry	Grants permission to create a destination registry.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listRegistries	Grants permission to list destination registries.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getRegistry	Grants permission to query details about a destination registry.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateRegistry	Grants permission to modify a destination registry.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteRegistry	Grants permission to delete a destination repository.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createReplicationPolicy	Grants permission to create a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId swr:TargetRegion swr:SourceRegion swr:TargetUrls swr:SourceUrls	-
swr:instance:listReplicationPolicies	Grants permission to list replication policies.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getReplicationPolicy	Grants permission to query details about a replication policy.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateReplicationPolicy	Grants permission to modify a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId swr:TargetRegion swr:SourceRegion swr:TargetUrls swr:SourceUrls	-
swr:instance:deleteReplicationPolicy	Grants permission to delete a replication policy.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:executeReplicationPolicy	Grants permission to execute replication policies.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:stopReplicationPolicyExecution	Grants permission to stop replication tasks.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecutions	Grants permission to list replication records.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecTasks	Grants permission to list replication tasks.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listReplicationPolicyExecSubTasks	Grants permission to list replication subtasks.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:createSignPolicy	Grants permission to create a sign policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicies	Grants permission to list sign policies.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:getSignPolicy	Grants permission to query details about a sign policy.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:updateSignPolicy	Grants permission to modify a sign policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:deleteSignPolicy	Grants permission to delete a sign policy.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:executeSignPolicy	Grants permission to execute sign policies.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecutions	Grants permission to list signing records.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecTasks	Grants permission to list signing tasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:listSignPolicyExecSubTasks	Grants permission to list signing subtasks.	List	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateEndpointPolicy	Grants permission to update the trustlist configuration for public network access.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateEndpointPolicyStatus	Grants permission to update the status of the trustlist configuration for public network access.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:getEndpointPolicy	Grants permission to query the trustlist configuration for public network access.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createInternalEndpoint	Grants permission to allow a connection from the private network.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createInternalEndpoint		Write	-	swr:VpcId swr:SubnetId	-
swr:instance:getInternalEndpoint	Grants permission to query details about an allowed connection from the private network.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteInternalEndpoint	Grants permission to deny a connection from the private network.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listInternalEndpoints	Grants permission to list allowed connections from the private network.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:uploadArtifact	Grants permission to upload artifacts.	Write	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:repository:downloadArtifact	Grants permission to download artifacts.	Read	repository *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createTempCredential	Grants permission to create a temporary access credential.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:createLTCredential	Grants permission to create a long-term access credential.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateLTCredential	Grants permission to enable or disable long-term access credentials.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listLTCredentials	Grants permission to list long-term access credentials.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteLTCredential	Grants permission to delete a long-term access credential.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:addDomainName	Grants permission to add a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:deleteDomainName	Grants permission to delete a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:updateDomainName	Grants permission to update a domain name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listDomainNames	Grants permission to list domain names.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
swr:instance:listAllArtifacts	Grants permission to list all artifact tags in a repository.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-

Each API of SWR usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by SWR APIs
API	Action	Dependencies
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts	swr:repository:listArtifacts	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}	swr:repository:getArtifact	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}	swr:repository:deleteArtifact	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/accessories	swr:repository:listAccessories	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/additions/{addition}	swr:repository:getArtifactAddition	-
GET /v2/{project_id}/instances/{instance_id}/configurations	swr:instance:getConfigurations	-
PUT /v2/{project_id}/instances/{instance_id}/configurations	swr:instance:updateConfigurations	-
POST /v2/{project_id}/{resource_type}/resource-instances/filter	swr:instance:listResourceInstances	-
POST /v2/{project_id}/{resource_type}/resource-instances/count	swr:instance:getResourceInstancesCount	-
POST /v2/{project_id}/{resource_type}/{resource_id}/tags/create	swr:instance:createResourceTags	-
DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/delete	swr:instance:deleteResourceTags	-
GET /v2/{project_id}/instances/tags	swr:instance:getProjectTags	-
GET /v2/{project_id}/{resource_type}/{resource_id}/tags	swr:instance:getResourceTags	-
POST /v2/{project_id}/instances	swr:instance:create	-
GET /v2/{project_id}/instances	swr:instance:list	-
GET /v2/{project_id}/instances/{instance_id}	swr:instance:get	-
DELETE /v2/{project_id}/instances/{instance_id}	swr:instance:delete	-
GET /v2/{project_id}/instances/{instance_id}/audit-logs	swr:instance:getAuditLogs	-
GET /v2/{project_id}/instances/{instance_id}/statistics	swr:instance:getStatistics	-
GET /v2/{project_id}/jobs	swr:instance:listJobs	-
-	swr:instance:getJobs	-
DELETE /v2/{project_id}/jobs/{job_id}	swr:instance:deleteJob	-
POST /v2/{project_id}/instances/{instance_id}/namespaces	swr:repository:createNamespace	-
GET /v2/{project_id}/instances/{instance_id}/namespaces	swr:repository:listNamespaces	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:getNamespace	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:updateNamespace	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}	swr:repository:deleteNamespace	-
GET /v2/{project_id}/instances/{instance_id}/repositories	swr:repository:listRepositories	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:getRepository	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:updateRepository	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}	swr:repository:deleteRepository	-
GET /v2/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/tags	swr:repository:listTags	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/repositories/{repository_name}/artifacts/{reference}/additions/{addition}	swr:repository:getTagAddition	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies	swr:repository:createRetentionPolicy	-
GET /v2/{project_id}/instances/{instance_id}/retention/policies	swr:repository:listRetentionPolicies	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:getRetentionPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:updateRetentionPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}	swr:repository:deleteRetentionPolicy	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions	swr:repository:executeRetentionPolicy	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions	swr:repository:listRetentionPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions/{execution_id}/tasks	swr:repository:listRetentionPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/retention/policies/{policy_id}/executions/{execution_id}/tasks/{task_id}/subtasks	swr:repository:listRetentionPolicyExecSubTasks	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies	swr:repository:createWebhook	-
GET /v2/{project_id}/instances/{instance_id}/webhook/policies	swr:repository:listWebhooks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:getWebhook	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:updateWebhook	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}	swr:repository:deleteWebhook	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/webhook/policies/{policy_id}/jobs	swr:repository:listWebhookJobs	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules	swr:repository:createImmutableRule	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules/{immutable_rule_id}	swr:repository:deleteImmutableRule	-
GET /v2/{project_id}/instances/{instance_id}/immutabletagrules	swr:repository:listImmutableRules	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/immutabletagrules/{immutable_rule_id}	swr:repository:updateImmutableRule	-
POST /v2/{project_id}/instances/{instance_id}/registries	swr:instance:createRegistry	-
GET /v2/{project_id}/instances/{instance_id}/registries	swr:instance:listRegistries	-
GET /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:getRegistry	-
PUT /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:updateRegistry	-
DELETE /v2/{project_id}/instances/{instance_id}/registries/{registry_id}	swr:instance:deleteRegistry	-
POST /v2/{project_id}/instances/{instance_id}/replication/policies	swr:instance:createReplicationPolicy	-
GET /v2/{project_id}/instances/{instance_id}/replication/policies	swr:instance:listReplicationPolicies	-
GET /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:getReplicationPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:updateReplicationPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/replication/policies/{policy_id}	swr:instance:deleteReplicationPolicy	-
POST /v2/{project_id}/instances/{instance_id}/replication/executions	swr:instance:executeReplicationPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}	swr:instance:stopReplicationPolicyExecution	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions	swr:instance:listReplicationPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}/tasks	swr:instance:listReplicationPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/replication/executions/{execution_id}/tasks/{task_id}/subtasks	swr:instance:listReplicationPolicyExecSubTasks	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies	swr:repository:createSignPolicy	-
GET /v2/{project_id}/instances/{instance_id}/signature/policies	swr:repository:listSignPolicies	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:getSignPolicy	-
PUT /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:updateSignPolicy	-
DELETE /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}	swr:repository:deleteSignPolicy	-
POST /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions	swr:repository:executeSignPolicy	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions	swr:repository:listSignPolicyExecutions	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions/{execution_id}/tasks	swr:repository:listSignPolicyExecTasks	-
GET /v2/{project_id}/instances/{instance_id}/namespaces/{namespace_name}/signature/policies/{policy_id}/executions/{execution_id}/tasks/{task_id}/subtasks	swr:repository:listSignPolicyExecSubTasks	-
PUT /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:updateEndpointPolicy	-
POST /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:updateEndpointPolicyStatus	-
GET /v2/{project_id}/instances/{instance_id}/endpoint-policy	swr:instance:getEndpointPolicy	-
POST /v2/{project_id}/instances/{instance_id}/internal-endpoints	swr:instance:createInternalEndpoint	-
GET /v2/{project_id}/instances/{instance_id}/internal-endpoints/{internal_endpoints_id}	swr:instance:getInternalEndpoint	-
DELETE /v2/{project_id}/instances/{instance_id}/internal-endpoints/{internal_endpoints_id}	swr:instance:deleteInternalEndpoint	-
GET /v2/{project_id}/instances/{instance_id}/internal-endpoints	swr:instance:listInternalEndpoints	-
-	swr:repository:uploadArtifact	-
-	swr:repository:downloadArtifact	-
POST /v2/{project_id}/instances/{instance_id}/temp-credential	swr:instance:createTempCredential	-
POST /v2/{project_id}/instances/{instance_id}/long-term-credential	swr:instance:createLTCredential	-
PUT /v2/{project_id}/instances/{instance_id}/long-term-credentials/{credential_id}	swr:instance:updateLTCredential	-
GET /v2/{project_id}/instances/{instance_id}/long-term-credentials	swr:instance:listLTCredentials	-
DELETE /v2/{project_id}/instances/{instance_id}/long-term-credentials/{credential_id}	swr:instance:deleteLTCredential	-
POST /v2/{project_id}/instances/{instance_id}/domainname	swr:instance:addDomainName	scm:cert:export
DELETE /v2/{project_id}/instances/{instance_id}/domainname/{domainname_id}	swr:instance:deleteDomainName	-
PUT /v2/{project_id}/instances/{instance_id}/domainname/{domainname_id}	swr:instance:updateDomainName	-
GET /v2/{project_id}/instances/{instance_id}/domainname	swr:instance:listDomainNames	-
GET /v2/{project_id}/instances/{instance_id}/artifacts	swr:instance:listAllArtifacts	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can specify in identity policy statements for SWR.

**Table 3** Resource types supported by SWR
Resource Type	URN
repository	swr:<region>:<account-id>:repository:<instance-name>/<repository-path>
instance	swr:<region>:<account-id>:instance:<instance-name>

Conditions

Condition Key

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, swr:) only apply to operations of the SWR service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met.

Service-specific condition keys supported by SWR

The following table lists the condition keys that you can define in identity policies for SWR. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by SWR
Service-specific Condition Key	Type	Single-valued/Multivalued	Important Notes
swr:VpcId	string	Single-valued	Controls permissions based on VPC IDs.
swr:SubnetId	string	Single-valued	Controls permissions based on subnet IDs.
swr:EnablePublicNameSpace	boolean	Single-valued	(SWR Enterprise Edition) Controls whether public organizations can be created.
swr:EnableObsEncrypt	boolean	Single-valued	(SWR Enterprise Edition) Controls whether buckets must be encrypted.
swr:TargetRegion	string	Single-valued	Controls permissions based on destination regions.
swr:SourceRegion	string	Single-valued	Controls permissions based on source regions.
swr:TargetUrls	string	Multivalued	Controls permissions based on destination URLs.
swr:SourceUrls	string	Multivalued	Controls permissions based on source URLs.
swr:RepositoryIsPublic	boolean	Single-valued	Controls permissions based on whether the images are public.