ServiceStage

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by ServiceStage, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by ServiceStage, see Condition.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for ServiceStage.

**Table 1** Actions supported by ServiceStage
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
servicestage:app:getApplication	Querying an application	read	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:get
servicestage:app:createApplication	Creating an application	write	app	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	servicestage:app:create
servicestage:app:modifyApplication	Updating an application	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	servicestage:app:modify
servicestage:app:deleteApplication	Deleting an application	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:delete
servicestage:app:listApplication	Querying the application list	list	-	-	servicestage:app:list
servicestage:app:getConfiguration	Querying application configuration	read	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:get
servicestage:app:deleteConfiguration	Deleting application configuration	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:modify
servicestage:app:modifyConfiguration	Updating application configuration	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:modify
servicestage:app:getComponent	Querying an application component	read	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:get
servicestage:app:createComponent	Creating an application component	write	app	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	servicestage:app:create
servicestage:app:modifyComponent	Updating an application component	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:modify
servicestage:app:deleteComponent	Deleting an application component	write	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:delete
servicestage:app:listComponent	Querying the application component list	list	-	-	servicestage:app:list
servicestage:environment:create	Creating an environment	write	environment	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
servicestage:environment:get	Querying an environment	read	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
servicestage:environment:list	Querying the environment list	list	-	-	servicestage:app:list
servicestage:environment:modify	Updating an environment	write	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	-
servicestage:environment:delete	Deleting an environment	write	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
servicestage:environment:refresh	Updating an environment	write	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
servicestage:environment:tag	(TMS users) Creating an environment tag	tagging	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	servicestage:environment:modify
servicestage:app:tag	(TMS users) Creating an application tag	tagging	app	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	servicestage:app:modify
servicestage:environment:listResourcesByTag	(TMS users) Querying environments by tag	read	environment	g:RequestTag/<tag-key> g:TagKeys	servicestage:environment:list
servicestage:app:listResourcesByTag	(TMS users) Querying applications by tag	read	app	g:RequestTag/<tag-key> g:TagKeys	servicestage:app:list
servicestage:environment:unTagResource	(TMS users) Deleting an environment tag	tagging	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	servicestage:environment:modify
servicestage:app:unTagResource	(TMS users) Deleting an application tag	tagging	app	g:EnterpriseProjectId g:ResourceTag/<tag-key> g:RequestTag/<tag-key> g:TagKeys	servicestage:app:modify
servicestage:environment:listTags	(TMS users) Querying the environment tag list	read	-	-	servicestage:environment:list
servicestage:app:listTags	(TMS users) Querying the application tag list	read	-	-	servicestage:app:list
servicestage:environment:createAddon	Creating a plug-in	write	-	-	-
servicestage:environment:listAddon	Querying a plug-in list	list	-	-	-
servicestage:environment:getAddon	Querying the plug-in details	read	-	-	-
servicestage:environment:modifyAddon	Modifying a plug-in	write	-	-	-
servicestage:environment:deleteAddon	Deleting a plug-in	write	-	-	-
servicestage:config:createGroup	Creating a configuration group	write	configGroup	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
servicestage:config:getGroup	Obtaining group details based on the configured group ID	read	configGroup	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
servicestage:config:listGroup	Configuring group permissions	list	-	-	-
servicestage:config:deleteGroup	Deleting a group based on the group ID	write	configGroup	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
servicestage:config:get	Obtaining configuration file information based on the configuration file ID	read	config	g:EnterpriseProjectId	-
servicestage:config:list	Obtaining the configuration file information	list	-	-	-
servicestage:config:create	Creating a configuration file	write	config	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
servicestage:config:modify	Modifying a configuration file based on the configuration file ID	write	config	g:EnterpriseProjectId	-
servicestage:config:delete	Deleting a configuration file based on the configuration file ID	write	config	g:EnterpriseProjectId	-
servicestage:config:import	Importing a configuration file	write	-	-	-
servicestage:config:listHistories	Obtaining configuration file history based on the configuration file ID	list	config	g:EnterpriseProjectId	-
servicestage:config:getHistory	Obtaining configuration file historical information based on the configuration file history ID	read	config	g:EnterpriseProjectId	-
servicestage:config:deleteHistory	Deleting configuration file history based on the configuration file history ID	write	config	g:EnterpriseProjectId	-
servicestage::getRuntimeStack	Querying a technology stack based on the technology stack ID	read	-	-	-
servicestage::createRuntimeStack	Creating a technology stack	write	-	-	-
servicestage::modifyRuntimeStack	Modifying a technology stack based on the technology stack ID	write	-	-	-
servicestage::deleteRuntimeStack	Deleting a technology stack based on the technology stack ID	write	-	-	-
servicestage::switchRuntimeStackStatus	Releasing a technology stack or canceling the release of a technology stack	write	-	-	-
servicestage:vmappConfig:list	Querying directory configurations	list	-	-	-
servicestage:vmappConfig:get	Querying directory configurations based on the directory configuration ID	read	-	-	-
servicestage:vmappConfig:create	Creating directory configurations	write	-	-	-
servicestage:vmappConfig:modify	Modifying directory configurations based on the directory configuration ID	write	-	-	-
servicestage:vmappConfig:delete	Deleting directory configurations based on the directory configuration ID	write	-	-	-
servicestage::createReleasePlan	Creating a release task	write	-	-	-
servicestage::getReleasePlan	Obtaining information about a release task based on the release task ID	read	-	-	-
servicestage::listReleasePlan	Obtaining a release task list	list	-	-	-
servicestage::modifyReleasePlan	Modifying a release task based on the release task ID	write	-	-	-
servicestage::deleteReleasePlan	Deleting a release task based on the release task ID	write	-	-	-
servicestage:pipeline:get	Querying a pipeline	read	pipeline	g:EnterpriseProjectId	-
servicestage:pipeline:create	Creating a pipeline	write	pipeline	g:EnterpriseProjectId	-
servicestage:pipeline:modify	Updating a pipeline	write	pipeline	g:EnterpriseProjectId	-
servicestage:pipeline:delete	Deleting a pipeline	write	pipeline	g:EnterpriseProjectId	-
servicestage:pipeline:list	Querying the pipeline list	list	-	-	-
servicestage:assembling:runtimeList	Querying the technology stack list	read	-	-	servicestage:assembling:get
servicestage:assembling:getInfo	Querying a build task	list	-	-	-
servicestage:assembling:create	Creating a build task	write	assembling	-	-
servicestage:assembling:modify	Updating a build task	write	assembling	-	-
servicestage:assembling:delete	Deleting a build task	write	assembling	-	-
servicestage:assembling:list	Querying the build task list	list	-	-	-
servicestage:repositoryAuth:list	Obtaining the repository authorization list	list	-	-	-
servicestage:repositoryAuth:get	Obtaining repository authorization	read	repositoryAuth	-	-
servicestage:repositoryAuth:create	Creating repository authorization	write	repositoryAuth	-	-
servicestage:repositoryAuth:delete	Deleting repository authorization	write	repositoryAuth	-	-
servicestage:environment:listTagsForResource	(EPS users) Querying the environment tag list	read	environment	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:list
servicestage:app:listTagsForResource	(EPS users) Querying the application tag list	read	app	g:EnterpriseProjectId g:ResourceTag/<tag-key>	servicestage:app:list

**Table 2** Actions supported by CSE
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
cse:config:upload	Assigning permissions to upload microservice configurations	write	-	g:EnterpriseProjectId	cse:config:modify
cse:config:download	Assigning permissions to download microservice configurations	write	-	g:EnterpriseProjectId	cse:config:modify
cse:engine:get	Assigning permissions to view engines	read	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:engine:list	Assigning permissions to view the engine list	list	-	-	-
cse:engine:backupRecover	Assigning permissions to back up and restore engine data and change backup policies	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:engine:associatePublicips	Assigning permissions to bind or unbind an engine to or from a public network	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:engine:update	Assigning permissions to modify the engine configuration and system management	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:engine:create	Assigning permissions to create an engine	write	-	g:ResourceTag/<tag-key> g:EnterpriseProjectId g:TagKeys	-
cse:engine:upgrade	Assigning permissions to upgrade engine permissions	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:engine:delete	Assigning permissions to deleting an engine	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cse:namespace:get	Assigning permissions to view namespaces	read	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cse:namespace:read
cse:namespace:update	Assigning permissions to modify namespace resources	write	engine	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cse:namespace:write

Each API of ServiceStage usually supports one or more actions. Table 3 lists the actions and dependencies supported by ServiceStage APIs.

**Table 3** Actions and dependencies supported by ServiceStage APIs
API	Action	Dependencies
GET /v2/{project_id}/cas/metadata/runtimes	servicestage:app:listApplication	-
GET /v2/{project_id}/cas/metadata/flavors	servicestage:app:listApplication	-
POST /v2/{project_id}/cas/environments	servicestage:environment:create	-
GET /v2/{project_id}/cas/environments	servicestage:environment:list	-
PUT /v2/{project_id}/cas/environments/{environment_id}	servicestage:environment:modify	-
DELETE /v2/{project_id}/cas/environments/{environment_id}	servicestage:environment:delete	-
GET /v2/{project_id}/cas/environments/{environment_id}	servicestage:environment:get	-
PATCH /v2/{project_id}/cas/environments/{environment_id}/resources	servicestage:environment:modify	-
POST /v2/{project_id}/cas/applications	servicestage:app:createApplication	-
GET /v2/{project_id}/cas/applications	servicestage:app:listApplication	-
PUT /v2/{project_id}/cas/applications/{application_id}	servicestage:app:modifyApplication	-
DELETE /v2/{project_id}/cas/applications/{application_id}	servicestage:app:deleteApplication	-
GET /v2/{project_id}/cas/applications/{application_id}	servicestage:app:getApplication	-
PUT /v2/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:modifyConfiguration	-
DELETE /v2/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:deleteConfiguration	-
GET /v2/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:getConfiguration	-
POST /v2/{project_id}/cas/applications/{application_id}/components	servicestage:app:createComponent	servicestage:assembling:getInfo servicestage:assembling:create
GET /v2/{project_id}/cas/applications/{application_id}/components	servicestage:app:listComponent	-
PUT /v2/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:modifyComponent	-
DELETE /v2/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:deleteComponent	-
GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:getComponent	-
POST /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances	servicestage:app:createComponent	servicestage:assembling:getInfo servicestage:assembling:create
GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances	servicestage:app:listComponent	-
POST /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}/action	servicestage:app:modifyComponent	-
PUT /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}	servicestage:app:modifyComponent	-
DELETE /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}	servicestage:app:deleteComponent	-
GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}	servicestage:app:getComponent	-
GET /v2/{project_id}/cas/applications/{application_id}/components/{component_id}/instances/{instance_id}/snapshots	servicestage:app:getComponent	-
GET /v2/{project_id}/cas/jobs/{job_id}	servicestage:app:listApplication	-
POST /v3/{project_id}/cas/environments	servicestage:environment:create	-
GET /v3/{project_id}/cas/environments	servicestage:environment:list	-
PUT /v3/{project_id}/cas/environments/{environment_id}	servicestage:environment:modify	-
DELETE /v3/{project_id}/cas/environments/{environment_id}	servicestage:environment:delete	-
GET /v3/{project_id}/cas/environments/{environment_id}	servicestage:environment:get	-
PUT /v3/{project_id}/cas/environments/{environment_id}/resources	servicestage:environment:modify	-
GET /v3/{project_id}/cas/environments/{environment_id}/resources	servicestage:environment:list	-
POST /v3/{project_id}/cas/environments/{environment_id}/refresh	servicestage:environment:refresh	-
POST /v3/{project_id}/cas/applications	servicestage:app:createApplication	-
GET /v3/{project_id}/cas/applications	servicestage:app:listApplication	-
PUT /v3/{project_id}/cas/applications/{application_id}	servicestage:app:modifyApplication	-
GET /v3/{project_id}/cas/applications/{application_id}	servicestage:app:getApplication	-
DELETE /v3/{project_id}/cas/applications/{application_id}	servicestage:app:deleteApplication	-
GET /v3/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:getConfiguration	-
PUT /v3/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:modifyConfiguration	-
DELETE /v3/{project_id}/cas/applications/{application_id}/configuration	servicestage:app:deleteConfiguration	-
POST /v3/{project_id}/cas/applications/{application_id}/components	servicestage:app:createComponent	servicestage:assembling:getInfo servicestage:assembling:create
GET /v3/{project_id}/cas/applications/{application_id}/components	servicestage:app:listComponent	-
GET /v3/{project_id}/cas/components	servicestage:app:listComponent	-
PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:modifyComponent	-
DELETE /v3/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:deleteComponent	-
GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id}	servicestage:app:getComponent	-
POST /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/action	servicestage:app:modifyComponent	-
GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/records	servicestage:app:listComponent	-
PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/refresh	servicestage:app:modifyComponent	-
GET /v3/{project_id}/cas/components/filterOptions	servicestage:app:listComponent	-
POST /v3/{project_id}/cas/components	servicestage:app:createComponent	servicestage:assembling:getInfo servicestage:assembling:create
POST /v3/{project_id}/cas/components/parse-template-package	servicestage:app:getComponent	-
PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/redeployment	servicestage:app:modifyComponent	-
GET /v3/{project_id}/cas/jobs/{job_id}	servicestage:app:listApplication	-
POST /v3/{project_id}/cas/config-groups	servicestage:config:createGroup	-
GET /v3/{project_id}/cas/config-groups	servicestage:config:listGroup	-
POST /v3/{project_id}/cas/configs	servicestage:config:create	-
POST /v3/{project_id}/cas/configs/import	servicestage:config:import	-
GET /v3/{project_id}/cas/configs	servicestage:config:list	-
GET /v3/{project_id}/cas/configs/{config_id}	servicestage:config:get	-
DELETE /v3/{project_id}/cas/configs/{config_id}	servicestage:config:delete	-
PUT /v3/{project_id}/cas/configs/{config_id}	servicestage:config:modify	-
GET /v3/{project_id}/cas/configs/{config_id}/histories	servicestage:config:listHistories	-
GET /v3/{project_id}/cas//configs/{config_id}/histories/{config_history_id}	servicestage:config:getHistory	-
DELETE /v3/{project_id}/cas/configs/{config_id}/histories/{config_history_id}	servicestage:config:deleteHistory	-
GET /v3/{project_id}/cas/config-groups/{config_group_id}	servicestage:config:getGroup	-
DELETE /v3/{project_id}/cas/config-groups/{config_group_id}	servicestage:config:deleteGroup	-
POST /v3/{project_id}/cas/environments/{environment_id}/addons	servicestage:environment:createAddon	-
GET /v3/{project_id}/cas/environments/{environment_id}/addons	servicestage:environment:listAddon	-
GET /v3/{project_id}/cas/environments/{environment_id}/addons-metadata	servicestage:environment:listAddon	-
GET /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}	servicestage:environment:getAddon	-
POST /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}/action	servicestage:environment:modifyAddon	-
DELETE /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}	servicestage:environment:deleteAddon	-
POST /v3/{project_id}/cas/release-plans	servicestage::createReleasePlan	-
PUT /v3/{project_id}/cas/release-plans/{release_plan_id}	servicestage::modifyReleasePlan	-
DELETE /v3/{project_id}/cas/release-plans/{release_plan_id}	servicestage::deleteReleasePlan	-
GET /v3/{project_id}/cas/release-plans	servicestage::listReleasePlan	-
GET /v3/{project_id}/cas/release-plans/{release_plan_id}	servicestage::getReleasePlan	-
GET /v3/{project_id}/cas/release-plans/{release_plan_id}/deploy-info	servicestage::getReleasePlan	-
POST /v3/{project_id}/cas/release-plans/{release_plan_id}/execute	servicestage::createReleasePlan	-
POST /v3/{project_id}/cas/release-plans/{release_plan_id}/rollback	servicestage::createReleasePlan	-
POST /v3/{project_id}/cas/release-plans/{release_plan_id}/abort	servicestage::createReleasePlan	-
POST /v3/{project_id}/pipeline/pipelines	servicestage:pipeline:create	-
GET /v3/{project_id}/pipeline/pipelines	servicestage:pipeline:list	-
PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id}	servicestage:pipeline:modify	-
POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/action	servicestage:pipeline:modify	-
GET /v3/{project_id}/pipeline/pipelines/{pipeline_id}	servicestage:pipeline:get	-
GET /v3/{project_id}/pipeline/pipelines/{id}/records	servicestage:pipeline:get	-
POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks	servicestage:pipeline:create	-
PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks	servicestage:pipeline:modify	-
GET /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks	servicestage:pipeline:list	-
POST /v3/{project_id}/pipeline/pipelines/parse-template-package	servicestage:pipeline:get	-
POST /v3/{project_id}/cas/runtimestacks	servicestage::createRuntimeStack	-
GET /v3/{project_id}/cas/runtimestacks	servicestage:app:listApplication	-
GET /v3/{project_id}/cas/runtimestacks/{runtimestack_id}	servicestage::getRuntimeStack	-
PUT /v3/{project_id}/cas/runtimestacks/{runtimestack_id}	servicestage::modifyRuntimeStack	-
DELETE /v3/{project_id}/cas/runtimestacks/{runtimestack_id}	servicestage::deleteRuntimeStack	-
POST /v3/{project_id}/cas/runtimestacks/action	servicestage::switchRuntimeStackStatus	-
GET /v3/{project_id}/cas/innerimages	servicestage:app:listApplication	-
POST /v3/{project_id}/cas/vmapp-configs	servicestage:vmappConfig:create	-
GET /v3/{project_id}/cas/vmapp-configs	servicestage:vmappConfig:list	-
GET /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}	servicestage:vmappConfig:get	-
PUT /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}	servicestage:vmappConfig:modify	-
DELETE /v3/{project_id}/cas/vmapp-configs/{vmapp_config_id}	servicestage:vmappConfig:delete	-
GET /v1/{project_id}/git/auths	servicestage:repositoryAuth:list	-
GET /v1/{project_id}/git/auths/{repo_type}/redirect	servicestage:repositoryAuth:get	-
POST /v1/{project_id}/git/auths/{repo_type}/oauth	servicestage:repositoryAuth:create	-
POST /v1/{project_id}/git/auths/{repo_type}/personal	servicestage:repositoryAuth:create	-
POST /v1/{project_id}/git/auths/{repo_type}/password	servicestage:repositoryAuth:create	-
DELETE /v1/{project_id}/git/auths/{name}	servicestage:repositoryAuth:delete	-
GET /v1/{project_id}/git/auths/{repo_type}/password/valid	servicestage:repositoryAuth:get	-
GET /v2/{project_id}/servicestage-environment/{environment_id}/tags	servicestage:environment:listTagsForResource	-
GET /v2/{project_id}/servicestage-application/{app_id}/tags	servicestage:app:listTagsForResource	-
POST /v1/{project_id}/kie/file	cse:config:upload	-
POST /v1/{project_id}/kie/download	cse:config:download	-
GET /v2/{project_id}/enginemgr/engines	cse:engine:list	-
POST /v2/{project_id}/enginemgr/engines	cse:engine:create	-
GET /v2/{project_id}/enginemgr/engines/{engine_id}	cse:engine:get	-
DELETE /v2/{project_id}/enginemgr/engines/{engine_id}	cse:engine:delete	-
GET /v2/{project_id}/enginemgr/engines/{engine_id}/jobs/{job_id}	cse:engine:get	-
POST /v1/{project_id}/kie/kv	cse:namespace:update	-
PUT /v1/{project_id}/kie/kv/{kv_id}	cse:namespace:update	-
GET /v1/{project_id}/kie/kv	cse:namespace:get	-
DELETE /v1/{project_id}/kie/kv/{kv_id}	cse:namespace:update	-
DELETE /v1/{project_id}/kie/kv	cse:namespace:update	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 4, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for ServiceStage.

**Table 4** Resource types supported by ServiceStage
Resource Type	URN
app	servicestage:<region>:<account-id>:app:<app-id>
environment	servicestage:<region>:<account-id>:environment:<environment-id>
pipeline	servicestage:<region>:<account-id>:pipeline:<pipeline-id>
assembling	servicestage:<region>:<account-id>:assembling:<assembling-id>
repositoryAuth	servicestage:<region>:<account-id>:repositoryAuth:<repositoryAuth-id>
configGroup	servicestage:<region>:<account-id>:configGroup:<config-group-id>
config	servicestage:<region>:<account-id>:config:<config-group-id>/<config-id>