Actions Supported by Identity Policy-based Authorization

workspace:authConfigs:get

Grants permission to query the configuration of the authentication login mode.

Read

-

-

-

workspace:authConfigs:update

Grants permission to update the authentication policy configuration.

Write

-

-

-

workspace:assistAuthConfigs:get

Grants permission to query the configuration of auxiliary authentication.

Read

-

-

-

workspace:assistAuthConfigs:update

Grants permission to update the configuration of auxiliary authentication.

Write

-

-

-

workspace:jobs:retry

Grants permission to retry a job.

Write

-

-

-

workspace:quotas:get

Grants permission to query tenant quota.

Read

-

-

-

workspace:tenants:getRoles

Grants permission to query tenant roles.

Read

-

-

-

workspace:tenants:ListConfig

Grants permission to list customized tenant configurations.

List

-

-

-

workspace:tenants:updateConfig

Grants permission to modify customized tenant configurations.

Write

-

-

-

workspace:natMappings:getConfig

Grants permission to query NAT mapping configuration items of a tenant.

Read

-

-

-

workspace:natMappings:updateConfig

Grants permission to modify NAT mapping configuration items of a tenant.

Write

-

-

-

workspace:tenants:get

Grants permission to query details about the workspace service.

Read

-

-

-

workspace:tenants:open

Grants permission to subscribe to the workspace service.

Write

-

workspace:AccessMode

-

workspace:tenants:delete

Grants permission to deregister the workspace service.

Write

-

-

-

workspace:tenants:update

Grants permission to modify the attributes of the workspace service.

Write

-

workspace:AccessMode

-

workspace:tenants:getLockStatus

Grants permission to check whether the workspace service has been locked.

Read

-

-

-

workspace:tenants:unlock

Grants permission to unlock the workspace service.

Write

-

-

-

workspace:agencies:create

Grants permission to create an agency.

Write

-

-

-

workspace:agencies:get

Grants permission to query an agency.

Read

-

-

-

workspace:desktops:commitAiAccelerateJob

Grants permission to create an ai accelerate job.

Write

-

-

-

workspace:desktops:createAiAccelerateJob

Grants permission to create an ai accelerate job.

Write

-

-

-

workspace:desktops:getAiAccelerateJob

Grants permission to query an ai accelerate job.

Read

-

-

-

workspace:desktops:getSysPrepInfo

Grants permission to query sysprep details.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:checkBatchChangeImage

Grants permission to verify params for changing image.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:tenants:listDesktopNamePolicies

Grants permission to list desktop name policies.

List

-

-

-

workspace:tenants:createDesktopNamePolicy

Grants permission to create a desktop name policy.

Write

-

-

-

workspace:tenants:updateDesktopNamePolicy

Grants permission to update desktop name policy.

Write

-

-

-

workspace:tenants:batchDeleteDesktopNamePolicies

Grants permission to batch delete desktop name policies.

Write

-

-

-

workspace:desktopPools:create

Grants permission to create a desktop pool.

Write

desktopPool *

-

-

user

-

userGroup

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktopPools:list

Grants permission to list desktop pools.

List

desktopPool *

-

-

workspace:desktopPools:update

Grants permission to modify desktop pool attributes.

Write

desktopPool *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktopPools:delete

Grants permission to delete a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:get

Grants permission to query desktop pool details.

Read

desktopPool *

-

-

workspace:desktopPools:expand

Grants permission to expand the disk capacity of a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:resize

Grants permission to modify desktop pool specifications.

Write

desktopPool *

-

-

workspace:desktopPools:rebuild

Grants permission to recompose system disks in a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:batchAddVolumes

Grants permission to batch add disks to a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:batchDeleteVolumes

Grants permission to batch delete disks from a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:batchExpandVolumes

Grants permission to batch expand the disk capacity of a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:operate

Grants permission to perform operations on a desktop pool.

Write

desktopPool *

-

-

workspace:desktopPools:listUsers

Grants permission to query authorized users and user groups of a desktop pool.

List

desktopPool *

-

-

workspace:desktopPools:authorizeUsers

Grants permission to authorize users and user groups to use a desktop pool.

Write

desktopPool *

-

-

user

-

userGroup

-

workspace:desktopPools:listDesktops

Grants permission to query desktop pool desktop information.

List

desktopPool *

-

-

workspace:desktopPools:listScriptTasks

Grants permission to list desktop pool script execution tasks.

List

desktopPool *

-

-

workspace:desktopPools:executeScripts

Grants permission to batch execute Desktop pool scripts.

Write

desktopPool *

-

-

script

-

workspace:desktopPools:sendNotifications

Grants permission to send notifications.

Write

desktopPool *

-

-

workspace:desktops:export

Grants permission to export desktops.

List

desktop *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktops:create

Grants permission to create a desktop.

Write

desktop *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId
• workspace:AssociatePublicIp
• workspace:AccessMode

workspace:desktops:list

Grants permission to list desktops.

List

desktop *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktops:update

Grants permission to update a desktop.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:delete

Grants permission to delete a desktop.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:get

Grants permission to query desktop details.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchDelete

Grants permission to batch delete desktops.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:logoff

Grants permission to batch logoff desktops.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listDetail

Grants permission to list desktop details.

List

desktop *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktops:operate

Grants permission to perform operations on a desktop.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:resize

Grants permission to change specifications.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getConnectStatus

Grants permission to query desktop login status statistics.

Read

-

-

-

workspace:desktops:ListStatus

Grants permission to query desktop login status.

List

-

-

-

workspace:desktops:rebuild

Grants permission to rebuild a desktop.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getActions

Grants permission to query desktop power-on/off information.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:createConsole

Grants permission to obtain the URL for remote login to the console.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:updateSids

Grants permission to update a desktop SID.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:rejoinDomain

Grants permission to rejoin the AD domain.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:createImage

Grants permission to convert a desktop to an image.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchDetach

Grants permission to btach unbind a user.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:detach

Grants permission to unbind a user.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:attach

Grants permission to assign desktops to a user.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getNetwork

Grants permission to query desktop network.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:changeNetwork

Grants permission to change desktop network.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:exclusiveHosts:listDesktops

Grants permission to list exclusive desktop details.

List

exclusiveHost *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktops:listAll

Grants permission to list all desktops.

List

desktop *

-

-

workspace:desktopAssociate:listDiscoverVmInfo

Grants permission to list discover VM.

List

-

-

-

workspace:desktopAssociate:startTask

Grants permission to start discover VM task.

Write

-

-

-

workspace:desktopAssociate:switchScanTask

Grants permission to enable discover VM scanning task.

Write

-

-

-

workspace:desktopAssociate:getScanTaskSwitch

Grants permission to query discover VM scanning task switch.

Read

-

-

-

workspace:desktops:setMaintenanceMode

Grants permission to batch set maintenance mode.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:prepAttachUsers

Grants permission to batch pre-assign users.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchAttachUsers

Grants permission to batch assign users.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:changeUsername

Grants permission to change the user name associated with the desktop in the Windows AD scenario.

Write

-

-

-

workspace:desktops:sendNotifications

Grants permission to send notifications.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:migrate

Grants permission to migrate a desktop.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listAgents

Grants permission to list installed agents.

List

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchInstallAgents

Grants permission to batch install agents.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listTags

Grants permission to query desktop labels.

List

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:tag

Grants permission to create a desktop label.

Tagging

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:desktops:untag

Grants permission to delete a desktop label.

Tagging

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:desktops:listProjectTags

Grants permission to query project labels.

List

-

-

-

workspace:desktops:operateTags

Grants permission to batch add or delete labels.

Tagging

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:desktops:listByTags

Grants permission to filter desktops by label.

List

-

-

-

workspace:exclusiveHosts:create

Grants permission to create exclusive hosts.

Write

exclusiveHost *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:exclusiveHosts:list

Grants permission to list exclusive hosts.

List

exclusiveHost *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:exclusiveHosts:check

Grants permission to check whether exclusive hosts can be created.

Write

-

-

-

workspace:exclusiveHosts:get

Grants permission to query exclusive host details.

Read

exclusiveHost *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:exclusiveHosts:update

Grants permission to update exclusive hosts.

Write

exclusiveHost *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:exclusiveHosts:delete

Grants permission to delete exclusive hosts.

Write

exclusiveHost *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:mkp:listImages

Grants permission to list marketplace images.

List

-

-

-

workspace:mkp:listCommodityInfos

Grants permission to query marketplace commodity information.

List

-

-

-

workspace:mkp:createOrder

Grants permission to create marketplace product order.

Write

-

-

-

workspace:mkp:listListProductReserve

Grants permission to query marketplace inventory information.

List

-

-

-

workspace:mkp:listCommodityDetails

Grants permission to query marketplace commodity details.

List

-

-

-

workspace:mkp:listRelationCommodityDetails

Grants permission to query associated commodity.

List

-

-

-

workspace:mkp:listCommodityAgreements

Grants permission to query marketplace commodity agreement.

List

-

-

-

workspace:networks:listEips

Grants permission to list EIPs.

List

-

-

-

workspace:networks:createEips

Grants permission to create an EIP.

Write

-

-

-

workspace:networks:bindEips

Grants permission to bind an EIP.

Write

-

-

-

workspace:networks:unbindEips

Grants permission to unbind an EIP.

Write

-

-

-

workspace:networks:getEipQuota

Grants permission to query the EIP quota.

Read

-

-

-

workspace:networks:ListNatGateways

Grants permission to list nat gateways.

List

-

-

-

workspace:orders:create

Grants permission to subscribe to a yearly/monthly order.

Write

-

• workspace:CreateOrderType
• workspace:AssociatePublicIp
• workspace:AccessMode

-

workspace:orders:change

Grants permission to create a request for changing the subscription.

Write

-

workspace:ChangeOrderType

-

workspace:orders:batchInquiry

Grants permission to batch inquiry.

Write

-

-

-

workspace:quotas:check

Grants permission to check quotas.

Write

-

-

-

workspace:renderDesktops:create

Grants permission to create a rendering desktop.

Write

-

-

-

workspace:renderDesktops:delete

Grants permission to delete a rendering desktop.

Write

-

-

-

workspace:renderDesktops:list

Grants permission to list rendering desktops.

List

-

-

-

workspace:renderDesktops:action

Grants permission to perform operations on a rendering desktop.

Write

-

-

-

workspace:scheduledTasks:list

Grants permission to list scheduled tasks.

List

scheduledTask *

-

-

workspace:scheduledTasks:create

Grants permission to create a scheduled task.

Write

scheduledTask *

-

-

desktop

-

desktopPool

-

server

-

serverGroup

-

workspace:scheduledTasks:get

Grants permission to query scheduled task details.

Read

scheduledTask *

-

-

workspace:scheduledTasks:update

Grants permission to update a scheduled task.

Write

scheduledTask *

-

-

desktop

-

desktopPool

-

server

-

serverGroup

-

workspace:scheduledTasks:delete

Grants permission to delete a scheduled task.

Write

scheduledTask *

-

-

workspace:scheduledTasks:getFuture

Grants permission to query the future execution time of a scheduled task.

Read

-

-

-

workspace:scheduledTasks:batchDelete

Grants permission to batch delete scheduled tasks.

Write

scheduledTask *

-

-

workspace:scheduledTasks:listRecords

Grants permission to query the execution records of a scheduled task.

List

scheduledTask *

-

-

workspace:scheduledTasks:getRecord

Grants permission to query details about the execution records of a scheduled task.

Read

scheduledTask *

-

-

workspace:scheduledTasks:exportRecords

Grants permission to export details about the execution records of a scheduled task.

List

scheduledTask *

-

-

workspace:users:subscribeSharer

Grants permission to subscribe collaborative resources.

Write

user *

-

-

workspace:desktops:addSubResources

Grants permission to subscribe desktop auxiliary resources.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:deleteSubResources

Grants permission to delete desktop auxiliary resources.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:createSnapshots

Grants permission to create a desktop snapshot.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getSnapshots

Grants permission to query desktop snapshots.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:deleteSnapshots

Grants permission to delete a desktop snapshot.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:restoreBySnapshot

Grants permission to restore a desktop using a desktop snapshot.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:statistics:listDesktopStatus

Grants permission to statistical desktop statistics Status.

List

-

-

-

workspace:statistics:getUnused

Grants permission to query desktops not used in a specified period.

Read

-

-

-

workspace:statistics:getUsed

Grants permission to query the duration of using a desktop.

Read

-

-

-

workspace:bindingPolicies:export

Grants permission to export information about terminal-desktop binding to an Excel file.

List

-

-

-

workspace:bindingPolicies:getConfig

Grants permission to query the configuration of terminal-desktop binding.

Read

-

-

-

workspace:bindingPolicies:createConfig

Grants permission to configure terminal-desktop binding.

Write

-

-

-

workspace:bindingPolicies:get

Grants permission to list the configurations of terminal-desktop binding.

Read

-

-

-

workspace:bindingPolicies:add

Grants permission to add terminal-desktop binding.

Write

-

-

-

workspace:bindingPolicies:update

Grants permission to modify terminal-desktop binding.

Write

-

-

-

workspace:bindingPolicies:delete

Grants permission to delete terminal-desktop binding.

Write

-

-

-

workspace:volumes:delete

Grants permission to delete a data disk.

Write

desktop

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:volumes:batchAdd

Grants permission to add a desktop disk.

Write

desktop

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:volumes:batchExpand

Grants permission to expand the disk capacity of a desktop.

Write

desktop

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:wdh:getType

Grants permission to query workspace host types.

Read

wdh *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:wdh:get

Grants permission to list workspace hosts.

Read

wdh *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getRemoteAssistance

Grants permission to query desktop remote assistance.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:createRemoteAssistance

Grants permission to create desktop remote assistance.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:cancelRemoteAssistance

Grants permission to cancel desktop remote assistance.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:volumes:add

Grants permission to add a desktop disk.

Write

desktop

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:volumes:expand

Grants permission to expand the disk capacity.

Write

desktop

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:volumes:listDssPoolsDetail

Grants permission to list details of dedicated distributed storage pools.

List

-

-

-

workspace:orders:createDesktopOrder

Grants permission to create desktop order.

Write

-

-

-

workspace:common:listTimezones

Grants permission to query time zone configuration.

List

-

-

-

workspace:connections:securityExport

Grants permission to export connection records.

List

-

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:images:list

Grants permission to list supported images.

List

-

-

-

workspace:policyGroups:import

Grants permission to import policy group.

Write

-

-

-

workspace:accessPolicies:create

Grants permission to create an access policy.

Write

-

-

-

workspace:accessPolicies:get

Grants permission to query access policies.

Read

-

-

-

workspace:accessPolicies:delete

Grants permission to delete a specified access policy.

Write

-

-

-

workspace:accessPolicies:getTarget

Grants permission to query the target object of a specified access policy.

Read

-

-

-

workspace:accessPolicies:updateTarget

Grants permission to update the target object of a specified access policy.

Write

-

-

-

workspace:products:listDesktopProducts

Grants permission to list desktop products.

List

-

-

-

workspace:products:listSharerProducts

Grants permission to list sharer products.

List

-

-

-

workspace:products:listInternetProducts

Grants permission to list internet products.

List

-

-

-

workspace:availabilityZones:list

Grants permission to query supported AZs.

List

-

-

-

workspace:userGroups:export

Grants permission to export user group.

List

userGroup *

-

-

workspace:users:export

Grants permission to export users.

List

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:import

Grants permission to import a user.

Write

user *

-

-

workspace:userGroups:exportUsers

Grants permission to export users of an user group.

List

userGroup *

-

-

workspace:users:operate

Grants permission to indicate operations (locking, unlocking, and resetting passwords).

Write

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:randomPassword

Grants permission to reset a random password for a user.

Write

user *

-

-

workspace:users:deleteOtps

Grants permission to unbind an OTP device.

Write

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:resendEmail

Grants permission to resend an email.

Write

user *

-

-

workspace:connections:securityList

Grants permission to query connection information.

List

-

-

-

workspace:connections:listOnlineUsers

Grants permission to query the number of login users.

List

-

-

-

workspace:userGroups:list

Grants permission to query user groups.

List

userGroup *

-

-

workspace:userGroups:create

Grants permission to create a user group.

Write

userGroup *

-

-

workspace:userGroups:batchDelete

Grants permission to batch delete user groups.

Write

userGroup *

-

-

workspace:userGroups:delete

Grants permission to delete a desktop user group.

Write

userGroup *

-

-

workspace:userGroups:update

Grants permission to modify a user group.

Write

userGroup *

-

-

workspace:userGroups:operate

Grants permission to perform operations on a user group.

Write

userGroup *

-

-

user *

-

workspace:userGroups:getUsers

Grants permission to query users in a user group.

List

userGroup *

-

-

workspace:jobs:listSubJobs

Grants permission to list subjobs.

List

-

-

-

workspace:jobs:deleteSubJobRecords

Grants permission to delete subjob records.

Write

-

-

-

workspace:ou:get

Grants permission to query OU information.

List

-

-

-

workspace:ou:create

Grants permission to add OU information.

Write

-

-

-

workspace:ou:delete

Grants permission to delete OU information.

Write

-

-

-

workspace:ou:update

Grants permission to update OU information.

Write

-

-

-

workspace:policyGroups:list

Grants permission to list policy groups.

List

policyGroup *

-

-

workspace:policyGroups:create

Grants permission to add a policy group.

Write

policyGroup *

-

-

desktop

-

desktopPool

-

user

-

userGroup

-

appGroup

-

workspace:policyGroups:delete

Grants permission to delete a policy group.

Write

policyGroup *

-

-

workspace:policyGroups:get

Grants permission to query policy groups.

Read

policyGroup *

-

-

workspace:policyGroups:update

Grants permission to modify a policy group.

Write

policyGroup *

-

-

user

-

userGroup

-

appGroup

-

workspace:policyGroups:export

Grants permission to export a policy group.

List

policyGroup *

-

-

workspace:policyGroups:listPolicies

Grants permission to query policy items in a policy group.

List

policyGroup *

-

-

workspace:policyGroups:updatePolicies

Grants permission to modify policy items in a policy group.

Write

policyGroup *

-

-

workspace:policyGroups:listTargets

Grants permission to query the target object of a policy group.

List

policyGroup *

-

-

workspace:policyGroups:updateTargets

Grants permission to modify the target object of a policy group.

Write

policyGroup *

-

-

desktop

-

desktopPool

-

user

-

userGroup

-

appGroup

-

workspace:policyGroups:listDetail

Grants permission to list policy group details.

List

policyGroup *

-

-

workspace:policyGroups:getOriginalPolicies

Grants permission to query initial policy items.

Read

policyGroup *

-

-

workspace:users:list

Grants permission to query users.

List

user *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:users:create

Grants permission to create a user.

Write

user *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:users:delete

Grants permission to delete a specified user.

Write

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:get

Grants permission to query user details.

Read

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:update

Grants permission to modify user information.

Write

user *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:users:batchDelete

Grants permission to batch delete users.

Write

user *

-

-

workspace:users:resetPassword

Grants permission to reset a user password.

Write

user *

-

-

workspace:users:checkResetPasswordToken

Grants permission to verify and reset domain user password Token.

Write

user *

-

-

workspace:users:getTemplate

Grants permission to download a user template file.

Read

-

-

-

workspace:users:checkExist

Grants permission to check whether the user exists.

Write

user *

-

-

workspace:users:listOtps

Grants permission to query OTP devices.

List

user *

-

-

workspace:users:getImportTemplate

Grants permission to download a user template.

Read

-

-

-

workspace:users:batchCreate

Grants permission to batch create users.

Write

user *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:products:listVolumeProducts

Grants permission to list volume products.

List

-

-

-

workspace:products:listHourPackageProducts

Grants permission to list hour package products.

List

-

-

-

workspace:screenRecord:list

Grants permission to list screen records.

List

-

-

-

workspace:screenRecord:get

Grants permission to query screen records.

Read

-

-

-

workspace:screenRecord:export

Grants permission to export screen records.

List

-

-

-

workspace:screenRecord:batchDelete

Grants permission to batch delete screen records.

Write

-

-

-

workspace:screenRecord:listDownloadAddress

Grants permission to list download address.

List

-

-

-

workspace:screenRecord:listOperations

Grants permission to list desktop operations.

List

-

-

-

workspace:tenants:listExportTasks

Grants permission to list exporting tasks.

List

-

-

-

workspace:tenants:deleteExportTasks

Grants permission to batch delete exporting tasks.

Write

-

-

-

workspace:tenants:exportData

Grants permission to download a exported file.

Read

-

-

-

workspace:statistics:listAlarm

Grants permission to list alarms.

List

-

-

-

workspace:statistics:getAlarm

Grants permission to query alarm number.

Read

-

-

-

workspace:statistics:getGrowthRate

Grants permission to query metric chain ratio.

Read

-

-

-

workspace:statistics:getMetric

Grants permission to query metric.

Read

-

-

-

workspace:statistics:getMetricTrend

Grants permission to query metric trend.

Read

-

-

-

workspace:statistics:updateNotificationRules

Grants permission to update metric notification rule.

Write

-

-

-

workspace:statistics:deleteNotificationRules

Grants permission to delete metric notification rule.

Write

-

-

-

workspace:statistics:createNotifyRules

Grants permission to add metric notification rule.

Write

-

-

-

workspace:statistics:listNotificationRules

Grants permission to list metric notification rules.

List

-

-

-

workspace:statistics:listNotificationRecords

Grants permission to list metric notification records.

List

-

-

-

workspace:statistics:listDesktopMetrics

Grants permission to list desktop usage statistics.

List

-

-

-

workspace:statistics:exportDesktopMetrics

Grants permission to export desktop usage statistics.

List

-

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:statistics:listUserMetrics

Grants permission to list user usage statistics.

List

-

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:statistics:exportUserMetrics

Grants permission to export user usage statistics.

List

-

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:statistics:listAppUserAccessData

Grants permission to list app user access data.

List

-

-

-

workspace:statistics:exportAppUserAccessData

Grants permission to export app user access data.

Write

-

-

-

workspace:statistics:getUserAccessStages

Grants permission to show user access stages.

Read

-

-

-

workspace:session:exportAppConnection

Grants permission to export application usage records.

Write

-

-

-

workspace:session:exportUserConnection

Grants permission to export user login records.

Write

-

-

-

workspace:session:exportSessions

Grants permission to export session list.

Write

-

-

-

workspace:userEvents:list

Grants permission to list user operation events.

List

-

-

-

workspace:userEvents:export

Grants permission to export user operation events.

Write

-

-

-

workspace:userEvents:setLtsConfigurations

Grants permission to set user events lts configurations.

Write

-

-

-

workspace:userEvents:listLtsConfigurations

Grants permission to list user events lts configurations.

List

-

-

-

workspace:appcenter:createBucketCredential

Grants permission to generate OBS bucket credential information.

Write

-

-

-

workspace:appcenter:createAndAuthorizeBucket

Grants permission to add and authorize the default OBS bucket.

Write

-

-

-

workspace:appcenter:listApps

Grants permission to list apps.

List

-

-

-

workspace:appcenter:createApp

Grants permission to upload an app.

Write

-

-

-

workspace:appcenter:updateApp

Grants permission to update an app.

Write

-

-

-

workspace:appcenter:deleteApp

Grants permission to delete an app.

Write

-

-

-

workspace:appcenter:installApp

Grants permission to install an app.

Write

-

-

-

workspace:appcenter:listAppAuthorizations

Grants permission to query app authorizations.

List

-

-

-

workspace:appcenter:batchUpdateAppAuthorizations

Grants permission to assign app authorizations.

Write

-

-

-

workspace:appcenter:batchDeleteApps

Grants permission to batch delete apps.

Write

-

-

-

workspace:appcenter:batchDisableApps

Grants permission to batch set app invisible.

Write

-

-

-

workspace:appcenter:batchEnableApps

Grants permission to batch set app visible.

Write

-

-

-

workspace:appcenter:batchInstallApps

Grants permission to batch install apps.

Write

-

-

-

workspace:appcenter:listAppCatalogs

Grants permission to list app catalogs.

List

-

-

-

workspace:appcenter:listJobs

Grants permission to list app install job info.

List

-

-

-

workspace:appcenter:batchDeleteJobs

Grants permission to batch delete jobs.

Write

-

-

-

workspace:appcenter:retryJobs

Grants permission to retry failed jobs.

Write

-

-

-

workspace:appcenter:createAppRule

Grants permission to create an app rule.

Write

-

-

-

workspace:appcenter:listAppRule

Grants permission to list app rules.

List

-

-

-

workspace:appcenter:updateAppRule

Grants permission to update app rules.

Write

-

-

-

workspace:appcenter:deleteAppRule

Grants permission to delete an app rule.

Write

-

-

-

workspace:appcenter:batchDeleteAppRules

Grants permission to batch delete app rules.

Write

-

-

-

workspace:appcenter:enableRuleRestriction

Grants permission to enable app rules restriction.

Write

-

-

-

workspace:appcenter:disableRuleRestriction

Grants permission to disale app rules restriction.

Write

-

-

-

workspace:appcenter:addRestrictedRule

Grants permission to create app rule restrictions.

Write

-

-

-

workspace:appcenter:listRestrictedRule

Grants permission to list app rule restrictions.

List

-

-

-

workspace:appcenter:deleteRestrictedRule

Grants permission to batch delete app rule restrictions.

Write

-

-

-

workspace:appcenter:updateTenantProfile

Grants permission to enable and Disable tenant function.

Write

-

-

-

workspace:appcenter:listTenantProfiles

Grants permission to list tenant function status.

List

-

-

-

workspace:scripts:create

Grants permission to create a script.

Write

script *

-

-

workspace:scripts:list

Grants permission to list scripts.

List

script *

-

-

workspace:scripts:get

Grants permission to get scripts.

Read

script *

-

-

workspace:scripts:put

Grants permission to update scripts.

Write

script *

-

-

workspace:scripts:delete

Grants permission to delete scripts.

Write

script *

-

-

workspace:scripts:execute

Grants permission to executes scripts or command.

Write

script *

-

-

desktop *

-

workspace:scripts:getRecordDetail

Grants permission to get record detail.

Read

script *

-

-

workspace:scripts:listRecords

Grants permission to list script records.

List

script *

-

-

workspace:scripts:listTasks

Grants permission to list script tasks.

List

script *

-

-

workspace:scripts:retry

Grants permission to retry scripts.

Write

script *

-

-

workspace:scripts:stop

Grants permission to stop scripts or command.

Write

script *

-

-

workspace:scripts:download

Grants permission to download script record.

Write

script *

-

-

workspace:tenants:getShareSpaceConfig

Grants permission to query share space config.

Read

-

-

-

workspace:tenants:updateShareSpaceConfig

Grants permission to edit share space config.

Write

-

-

-

workspace:authConfigs:getStatus

Grants permission to query auth config status.

Read

-

-

-

workspace:privacystatements:sign

Grants permission to sign the privacy statement.

Write

-

-

-

workspace:sites:get

Grants permission to query site information.

Read

-

-

-

workspace:sites:add

Grants permission to add a site.

Write

-

workspace:AccessMode

-

workspace:sites:delete

Grants permission to delete a site.

Write

-

-

-

workspace:sites:updateAccessMode

Grants permission to modify the site access mode.

Write

-

workspace:AccessMode

-

workspace:sites:updateSubnets

Grants permission to modify a site service subnet.

Write

-

-

-

workspace:tenants:checkEnterpriseIds

Grants permission to check whether the enterprise ID has been used.

Write

-

-

-

workspace:tenants:updateEnterpriseId

Grants permission to modify an enterprise ID.

Write

-

-

-

workspace:bandwidth:create

Grants permission to create workapce bandwidth.

Write

-

-

-

workspace:bandwidth:list

Grants permission to list workspace bandwiths.

List

-

-

-

workspace:bandwidth:update

Grants permission to update workapce bandwidth.

Write

-

-

-

workspace:bandwidth:delete

Grants permission to delete workapce bandwidth.

Write

-

-

-

workspace:bandwidth:getControlConfig

Grants permission to query workspace bandwith control config.

Read

-

-

-

workspace:bandwidth:updateControlConfig

Grants permission to update workspace bandwith control config.

Write

-

-

-

workspace:bandwidth:createChangeOrder

Grants permission to create workspace bandwith change order.

Write

-

-

-

workspace:desktops:batchCreateSnapshots

Grants permission to batch create desktop snapshots.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchDeleteSnapshots

Grants permission to batch delete desktop snapshots.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:batchRestoreSnapshots

Grants permission to batch restore desktop snapshots.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listSnapshots

Grants permission to list desktop snapshots.

List

-

-

-

workspace:desktops:verifyDesktopName

Grants permission to verify the desktop name.

Write

-

-

-

workspace:networks:getAvailableIp

Grants permission to query available IP addresses of a subnet by subnet ID.

Read

-

-

-

workspace:desktops:getAdStatus

Grants permission to query the AD network status.

Read

-

-

-

workspace:networks:checkIpIfExist

Grants permission to check whether the ip exists.

Write

-

-

-

workspace:images:checkIfExist

Grants permission to check whether the image exists.

Write

-

-

-

workspace:wdh:listDesktops

Grants permission to query desktops of a workspace host.

List

wdh *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:wdh:update

Grants permission to update a workspace host.

Write

wdh *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:bindingPolicies:getTemplate

Grants permission to download the template for terminal-desktop binding.

Read

-

-

-

workspace:bindingPolicies:import

Grants permission to batch import terminal-desktop binding.

Write

-

-

-

workspace:statistics:getRunState

Grants permission to collect operating status statistics.

Read

-

-

-

workspace:statistics:getLoginState

Grants permission to collect login status statistics.

Read

-

-

-

workspace:networks:getUsingSubnets

Grants permission to query the list of subnets currently in use.

Read

-

-

-

workspace:networks:listPorts

Grants permission to list ports.

List

-

-

-

workspace:renderDesktops:createConsole

Grants permission to obtain the URL for remote login to the console.

Write

-

-

-

workspace:renderDesktops:resize

Grants permission to change rendering desktop specifications.

Write

-

-

-

workspace:exclusiveHosts:resizeLites

Grants permission to resize exclusive hosts.

Write

exclusiveHost *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:getMonitor

Grants permission to query desktop monitoring information.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listDetachInfo

Grants permission to query desktop historical detach user information.

List

desktop *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:desktops:getSysprepVersion

Grants permission to query sysprep version information.

Read

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:networks:createNat

Grants permission to enable network access of the NAT Gateway.

Write

-

-

-

workspace:networks:listNats

Grants permission to query network access of the NAT Gateway.

List

-

-

-

workspace:networks:listSubnets

Grants permission to query subnets.

List

-

-

-

workspace:networks:listVpcs

Grants permission to query VPCs.

List

-

-

-

workspace:policyGroups:createTemplate

Grants permission to create a policy template.

Write

-

-

-

workspace:policyGroups:listTemplate

Grants permission to query policy templates.

List

-

-

-

workspace:policyGroups:updateTemplate

Grants permission to update a policy template.

Write

-

-

-

workspace:networks:listSecurityGroups

Grants permission to list security groups.

List

-

-

-

workspace:availabilityZones:getSummary

Grants permission to query the summary of AZs.

Read

-

-

-

workspace:availabilityZones:get

Grants permission to query AZ details.

Read

-

-

-

workspace:users:importUser

Grants permission to import users.

Write

user *

-

-

workspace:users:uploadTemplate

Grants permission to import desktop users.

Write

user *

-

-

workspace:accessPolicies:update

Grants permission to update specified access policy.

Write

-

-

-

workspace:desktops:verifySource

Grants permission to check desktop source.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:desktops:listDesktopNetworks

Grants permission to list desktop networks.

List

desktop *

-

-

workspace:desktops:batchChangeNetwork

Grants permission to batch change desktop network.

Write

desktop *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:jobs:get

Grants permission to query job details.

Read

-

-

-

workspace:accessPolicies:importIp

Grants permission to import ip list.

Write

-

-

-

workspace:accessPolicies:getIpImportTemplate

Grants permission to download ip import template.

Read

-

-

-

workspace:sites:listEdgeSites

Grants permission to list edge sites.

List

-

-

-

workspace:sites:checkEdgeSiteResources

Grants permission to check edge site resource.

Write

-

-

-

workspace:ou:listAdOus

Grants permission to list AD OUs.

List

-

-

-

workspace:ou:listOuUsers

Grants permission to list AD OU users.

List

-

-

-

workspace:ou:importUsersByOU

Grants permission to import AD OU users.

Write

-

-

-

workspace:desktops:listWithConnectStatus

Grants permission to list desktops with connect status.

List

-

-

-

workspace:tenants:updateAccessAddressBackupConfig

Grants permission to update access address backup config.

Write

-

-

-

workspace:tenants:listAccessAddressBackupConfig

Grants permission to list access address backup config.

List

-

-

-

workspace:desktops:changeUserPrivilegeGroup

Grants permission to change user privilege group.

Write

desktop *

-

-

workspace:volumes:modifyQos

Grants permission to batch modify volumes qos.

Write

-

-

-

workspace:appcenter:getRuleRestriction

Grants permission to query control rules.

Read

-

-

-

workspace:appcenter:setRuleRestriction

Grants permission to set control rules.

Write

-

-

-

workspace:tenants:getDomains

Grants permission to list tenant domains.

List

-

-

-

workspace:tenants:addDomain

Grants permission to create tenant domain.

Write

-

-

-

workspace:tenants:updateDomain

Grants permission to update tenant domain.

Write

-

-

-

workspace:orders:createResourcePackagesOrder

Grants permission to create resource order.

Write

-

-

-

workspace:products:listResourcePackages

Grants permission to query resource packages.

Read

-

-

-

workspace:desktops:getHibernateType

Grants permission to query hibernate type.

Read

-

-

-

workspace:ca:list

Grants permission to list CA certs.

List

-

-

-

workspace:ca:create

Grants permission to create CA cert.

Write

-

-

-

workspace:ca:get

Grants permission to query CA cert detail.

Read

-

-

-

workspace:ca:delete

Grants permission to delete CA cert.

Write

-

-

-

workspace:ca:setStatus

Grants permission to set CA cert status.

Write

-

-

-

workspace:ca:export

Grants permission to export CA cert filefile.

List

-

-

-

workspace:ca:exportCrl

Grants permission to export CA cert crl file.

List

-

-

-

workspace:ca:exportCsr

Grants permission to export CA cert signature request.

List

-

-

-

workspace:ca:import

Grants permission to import CA cert.

Write

-

-

-

workspace:scripts:executeByDesktopTag

Grants permission to execute by desktop tag.

Write

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

-

workspace:authConfig:getSaml2Metadata

Grants permission to download SAML 2.0 Metadata Information.

Read

-

-

-

workspace:authConfig:validate

Grants permission to check whether the auth config is valid.

Write

-

-

-

workspace:desktopPools:listByUsers

Grants permission to query desktop pool list by users.

List

-

-

-

workspace:users:revokeCert

Grants permission to revoke user cetificate.

Write

-

-

-

workspace:assistAuthConfigs:getApplyObjects

Grants permission to query the list of auxiliary authentication application objects.

List

-

-

-

workspace:assistAuthConfigs:updateApplyObjects

Grants permission to update auxiliary authentication application object list.

Write

-

-

-

workspace:desktopPools:getStatisticsByInconsistent

Grants permission to list Desktop pool Inconsistent statics..

Read

-

-

-

workspace:appGroup:list

Grants permission to query application groups.

List

appGroup *

-

-

workspace:appGroup:create

Grants permission to create an application group.

Write

appGroup *

-

-

serverGroup

-

workspace:appGroup:delete

Grants permission to delete an application group.

Write

appGroup *

-

-

workspace:appGroup:get

Grants permission to query application group details.

Read

appGroup *

-

-

workspace:appGroup:update

Grants permission to modify an application group.

Write

appGroup *

-

-

serverGroup

-

workspace:app:listPublishedApp

Grants permission to query published applications.

List

app *

-

-

appGroup *

-

workspace:app:publish

Grants permission to publish an application.

Write

app *

-

-

appGroup *

-

workspace:app:get

Grants permission to query application details.

Read

app *

-

-

appGroup *

-

workspace:app:update

Grants permission to modify application information.

Write

app *

-

-

appGroup *

-

workspace:app:deleteIcon

Grants permission to delete a custom application icon.

Write

app *

-

-

appGroup *

-

workspace:app:uploadIcon

Grants permission to modify a custom application icon.

Write

app *

-

-

appGroup *

-

workspace:app:check

Grants permission to verify an application.

Write

app *

-

-

appGroup *

-

workspace:app:batchDisable

Grants permission to disable applications in batches.

Write

app *

-

-

appGroup *

-

workspace:app:batchEnable

Grants permission to enable applications in batches.

Write

app *

-

-

appGroup *

-

workspace:app:unpublish

Grants permission to unpublish applications in batches.

Write

app *

-

-

appGroup *

-

workspace:appGroup:listPublishableApp

Grants permission to publishable applications.

List

appGroup *

-

-

workspace:appGroup:batchDeleteAuthorization

Grants permission to cancel application group authorization.

Write

appGroup *

-

-

user

-

userGroup

-

workspace:appGroup:disassociate

Grants permission to disassociate a service group from all application groups.

Write

-

-

-

workspace:appGroup:listAuthorization

Grants permission to query application group authorization records.

List

appGroup *

-

-

workspace:appGroup:addAuthorization

Grants permission to add application group authorization.

Write

appGroup *

-

-

user

-

userGroup

-

workspace:appGroup:batchDelete

Grants permission to delete application groups in batches.

Write

appGroup *

-

-

workspace:appGroup:check

Grants permission to verify an application group.

Write

-

-

-

workspace:serverGroup:list

Grants permission to query server groups.

List

serverGroup *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:serverGroup:create

Grants permission to create a server group.

Write

serverGroup *

-

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:serverGroup:delete

Grants permission to delete a server group.

Write

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:serverGroup:get

Grants permission to query a specified server group.

Read

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:serverGroup:update

Grants permission to modify a server group.

Write

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:serverGroup:getServerState

Grants permission to query server statuses in a specified server group.

Read

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:serverGroup:listDetail

Grants permission to query basic information about a tenant server group.

List

serverGroup *

-

-

workspace:serverGroup:getRestrict

Grants permission to query specified tenant server groups.

Read

serverGroup *

-

-

workspace:serverGroup:validate

Grants permission to verify a server group.

Write

serverGroup *

-

-

workspace:serverGroup:tagResource

Grants permission to add a tag to a server group.

Tagging

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:serverGroup:unTagResource

Grants permission to delete a tag from a server group.

Tagging

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:serverGroup:listTagsForResource

Grants permission to query server group tags.

List

serverGroup *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:serverGroup:listTags

Grants permission to query tags on all servers of a tenant.

List

serverGroup *

-

-

workspace:serverGroup:batchCreateTags

Grants permission to add server group tags in batches.

Tagging

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:serverGroup:batchDeleteTags

Grants permission to delete server group tags in batches.

Tagging

serverGroup *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys

workspace:server:list

Grants permission to query servers.

List

server *

-

-

workspace:server:delete

Grants permission to delete a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:get

Grants permission to query a specified server.

Read

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:update

Grants permission to modify a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:changeImage

Grants permission to modify a server image.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:reinstall

Grants permission to reinstall a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:getVncUrl

Grants permission to obtain a VNC login address.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:accessAgent:list

Grants permission to query the latest versions of all HDAs of a tenant.

List

-

-

-

workspace:accessAgent:batchUpgrade

Grants permission to upgrade the HDA version of servers in batches.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:accessAgent:listLatestVersion

Grants permission to query the latest HDA version of a tenant.

List

-

-

-

workspace:server:listAccessAgentDetails

Grants permission to query HDA information of a server.

List

server *

-

-

workspace:accessAgent:getUpgradeFlag

Grants permission to query HDA upgrade notification flags.

Read

-

-

-

workspace:accessAgent:updateUpgradeFlag

Grants permission to update an HDA upgrade notification flag.

Write

-

-

-

workspace:accessAgent:listUpgradeRecords

Grants permission to query HDA upgrade tracing records of a server.

List

-

-

-

workspace:server:batchDelete

Grants permission to delete servers in batches.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchChangeMaintainMode

Grants permission to mark the server maintenance status.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchReboot

Grants permission to restart a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchRejoinDomain

Grants permission to rejoin servers to a domain in batches.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchStart

Grants permission to start a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchStop

Grants permission to stop a server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchUpdateTsvi

Grants permission to update virtual session IP configurations of servers in batches.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:create

Grants permission to create an application server.

Write

server *

-

-

serverGroup *

-

-

• g:RequestTag/<tag-key>g:RequestTag/<tag-key>
• g:TagKeysg:TagKeys
• g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:server:batchMigrateHosts

Grants permission to migrate servers at the source workspace host to the destination one.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

wdh *

-

workspace:server:getMetricData

Grants permission to query monitoring information of an Application Streaming server.

Read

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:jobs:batchDeleteSubJobs

Grants permission to delete subtasks in batches.

Write

-

-

-

workspace:jobs:countSubJobs

Grants permission to query the number of subtasks.

List

-

-

-

workspace:appWarehouse:authorizeObs

Grants permission to obtain the AK/SK uploaded to an OBS bucket.

Write

-

-

-

workspace:appWarehouse:batchDeleteApp

Grants permission to delete specified applications from the application repository in batches.

Write

-

-

-

workspace:appWarehouse:ListWarehouseApps

Grants permission to query applications in a tenant application repository.

List

-

-

-

workspace:appWarehouse:createApp

Grants permission to add an application to the application repository.

Write

-

-

-

workspace:appWarehouse:deleteApp

Grants permission to delete a specified application from the application repository.

Write

-

-

-

workspace:appWarehouse:uploadAppIcon

Grants permission to upload an icon file to the application repository.

Write

-

-

-

workspace:appWarehouse:createBucketOrAcl

Grants permission to add a bucket or bucket authorization.

Write

-

-

-

workspace:images:listImageJobs

Grants permission to query tasks of a tenant.

List

-

-

-

workspace:images:getImageJob

Grants permission to query task details.

Read

-

-

-

workspace:imageServer:list

Grants permission to query image instances.

List

imageServer *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:imageServer:create

Grants permission to create an image instance.

Write

imageServer *

-

-

-

g:EnterpriseProjectIdg:EnterpriseProjectId

workspace:imageServer:get

Grants permission to query a specified image instance.

Read

imageServer *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:imageServer:update

Grants permission to modify an image instance.

Write

imageServer *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:imageServer:attachApp

Grants permission to distribute software information to image instances.

Write

imageServer *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:imageServer:listLatestAttachedApp

Grants permission to query information about the latest distributed software.

List

imageServer *

-

-

workspace:imageServer:recreate

Grants permission to build an application streaming image.

Write

imageServer *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:imageServer:batchDelete

Grants permission to delete image instances in batches.

Write

imageServer *

g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:imageServer:listImageSubJobs

Grants permission to query subtasks.

List

-

-

-

workspace:imageServer:batchDeleteImageSubJobs

Grants permission to delete subtasks in batches.

Write

-

-

-

workspace:imageServer:countImageSubJobs

Grants permission to query the number of subtasks.

Read

-

-

-

workspace:appGroup:listMailRecord

Grants permission to query records of sending emails on application group authorization.

List

-

-

-

workspace:appGroup:resendMail

Grants permission to resend an email on application group authorization (based on authorization email records).

Write

-

-

-

workspace:storage:listPersistentStorage

Grants permission to query workspace storage space.

List

storage *

-

-

workspace:storage:createPersistentStorage

Grants permission to create workspace storage space.

Write

storage *

-

-

workspace:storage:deletePersistentStorage

Grants permission to delete workspace storage space.

Write

storage *

-

-

workspace:storage:updateUserFolderAssignment

Grants permission to create a personal storage directory.

Write

storage *

-

-

workspace:storage:updateShareFolderAssignment

Grants permission to change members of a shared directory.

Write

storage *

-

-

workspace:storage:createShareFolder

Grants permission to create a shared storage directory.

Write

storage *

-

-

workspace:storage:deleteStorageClaim

Grants permission to delete a shared directory.

Write

storage *

-

-

workspace:storage:deleteUserStorageAttachment

Grants permission to delete a personal storage directory.

Write

storage *

-

-

workspace:storage:batchDeletePersistentStorage

Grants permission to delete workspace storage space in batches.

Write

storage *

-

-

workspace:storage:listStorageAssignment

Grants permission to query personal storage directories.

List

storage *

-

-

workspace:storage:listShareFolder

Grants permission to query shared storage directories.

List

storage *

-

-

workspace:policyGroups:deleteTemplate

Grants permission to delete a policy template.

Write

-

-

-

workspace:privacystatements:get

Grants permission to query the latest privacy statement.

Read

-

-

-

workspace:scalingPolicy:delete

Grants permission to delete an Auto Scaling policy.

Write

-

-

-

workspace:scalingPolicy:list

Grants permission to query Auto Scaling policies of a server group.

Read

-

-

-

workspace:scalingPolicy:create

Grants permission to add or modify an Auto Scaling policy.

Write

-

-

-

workspace:session:listAppConnection

Grants permission to query application usage records.

Write

-

-

-

workspace:session:logoffUserSession

Grants permission to log out of a session.

Write

-

-

-

workspace:session:listUserConnection

Grants permission to query user login records.

Write

-

-

-

workspace:session:listSessionByUserName

Grants permission to query current sessions by username.

List

-

-

-

workspace:storagePolicy:create

Grants permission to add or update a custom policy for storage directory access.

Write

storage *

-

-

workspace:storagePolicy:list

Grants permission to query policies for storage directory access.

List

storage *

-

-

workspace:storage:listSfs3Storage

Grants permission to query SFS 3.0.

List

storage *

-

-

workspace:baseResource:list

Grants permission to query AZs.

List

-

-

-

workspace:tenants:listConfigInfo

Grants permission to query enterprise system configurations.

List

-

-

-

workspace:tenants:active

Grants permission to activate and initialize a tenant service.

Write

-

-

-

workspace:tenants:listTenantProfile

Grants permission to query tenant information.

List

-

-

-

workspace:server:listServerMetricData

Grants permission to query server monitoring data.

List

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:session:listSessions

Grants permission to query session list.

List

-

-

-

workspace:appWarehouse:updateApp

Grants permission to update an application to the application repository.

Write

-

-

-

workspace:server:batchChangeImage

Grants permission to batch change server image.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:server:batchReinstall

Grants permission to batch reinstall server.

Write

server *

• g:ResourceTag/<tag-key>g:ResourceTag/<tag-key>
• g:EnterpriseProjectIdg:EnterpriseProjectId

-

workspace:app:updatePreBootPolicy

Grants permission to batch update pre boot policy.

Write

appGroup *

-

-

workspace:appWarehouse:bindBucket

Grants permission to bind the application warehouse bucket.

Write

-

-

-

workspace:appWarehouse:getBucket

Grants permission to query the user application repository bucket.

Read

-

-

-

workspace:cloudStorage:listConfig

Grants permission to query cloud storage project configuration list.

List

-

-

-

workspace:cloudStorage:getConfig

Grants permission to query cloud storage project configuration information.

Read

-

-

-

workspace:cloudStorage:bind

Grants permission to bind cloud storage.

Write

-

-

-

workspace:cloudStorage:list

Grants permission to query cloud storage.

Read

-

-

-

workspace:cloudStorage:unbind

Grants permission to unbind cloud storage.

Write

-

-

-

workspace:cloudStorage:batchDeleteFolder

Grants permission to batch delete personal folder.

Write

-

-

-

workspace:cloudStorage:createFolder

Grants permission to create personal folder.

Write

-

-

-

workspace:cloudStorage:updateFolder

Grants permission to modify personal folder.

Write

-

-

-

workspace:cloudStorage:deleteFolder

Grants permission to delete personal folder.

Write

-

-

-

workspace:cloudStorage:listFolder

Grants permission to query personal folder list.

List

-

-

-

workspace:cloudStorage:resetUserProfile

Grants permission to reset User Profile.

Write

-

-

-

workspace:cloudStorage:listFiles

Grants permission to query Files in Personal Folder.

List

-

-

-

workspace:cloudStorage:transferFile

Grants permission to file Transfer.

Write

-

-

-

workspace:cloudStorage:preTransferFile

Grants permission to pre-Transfer of File.

Write

-

-

-

workspace:authConfigs:get

Grants permission to query the configuration of the authentication login mode.

Read

-

-

-

workspace:authConfigs:update

Grants permission to update the authentication policy configuration.

Write

-

-

-

workspace:assistAuthConfigs:get

Grants permission to query the configuration of auxiliary authentication.

Read

-

-

-

workspace:assistAuthConfigs:update

Grants permission to update the configuration of auxiliary authentication.

Write

-

-

-

workspace:jobs:retry

Grants permission to retry a job.

Write

-

-

-

workspace:quotas:get

Grants permission to query tenant quota.

Read

-

-

-