Policy Syntax

Policy Structure

A policy consists of a version and one or more statements (indicating different actions).

Figure 1 Policy structure

Policy Parameters

Policy parameters include Version and Statement, which are described in the following table. You can create custom policies by specifying the parameters. For details, see Custom Policy Use Cases.

• Condition key
  A condition key is a key in the Condition element of a statement. There are global and service-level condition keys.

  • Global condition keys (starting with g:) apply to all operations. IAM provides common global condition keys and special global condition keys.
    • Common global condition keys: Cloud services do not need to provide user identity information. Instead, IAM automatically abstracts user information and authenticates users. For details, see Table 2.
    • Special global condition keys: IAM obtains condition information from cloud services for authentication. Only certain cloud services support special global condition keys.
  • Service-level condition keys (starting with a service name abbreviation, for example, obs:) apply only to operations on the specified service. For details, see the user guide of the corresponding cloud service, for example, see OBS Request Conditions.

  Table 2 Common global condition keys

  Global Condition Key	Type	Description
  g:CurrentTime	Time	Time when an authentication request is received. The time is in ISO 8601 format, for example, 2012-11-11T23:59:59Z. (View an example policy that uses this condition key)
  g:DomainName	String	Account name of the requester. (View an example policy that uses this condition key)
  g:MFAPresent	Boolean	Whether to obtain a token through MFA authentication. (View an example policy that uses this condition key)
  g:MFAAge	Number	Validity period of a token obtained through MFA authentication. This condition must be used together with g:MFAPresent. (View an example policy that uses this condition key)
  g:ProjectName	String	Project name. (View an example policy that uses this condition key)
  g:ServiceName	String	Service name. (View an example policy that uses this condition key)
  g:UserId	String	IAM user ID. (View an example policy that uses this condition key)
  g:UserName	String	IAM username. (View an example policy that uses this condition key)

  Table 3 Special global condition keys

  Global Condition Key	Type	Description
  g:SourceIp	IP Address	IP address of the user sending a request.
  g:SourceVpc	String	VPC ID of the user sending a request.
  g:SourceVpce	String	VPC endpoint ID of the user sending a request.
  g:TagKeys	String	Resource tag key.
  g:ResourceTag/{TagKey}	String	Resource tag key value.

  1. g:CurrentTime

     Example: The following policy grants permission to create custom roles in IAM from March 1, 2023, 08:00 GMT+08:00 to March 30, 2023, 08:00 GMT+08:00. The value of the g:CurrentTime condition key is in UTC format.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               "DateGreaterThan": {
                                        "g:CurrentTime": ["2023-03-01T00:00:00Z"]
                               },
                               "DateLessThan": {
                                        "g:CurrentTime": ["2023-03-30T00:00:00Z"]
                               }
                       }
              }]
     }

  2. g: DomainName

     Example: The following policy only allows user zhangsan to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               "StringEquals": {
                                        "g:DomainName": ["zhangsan"]
                               }
                       }
              }]
     }

  3. g:MFAPresent

     Example: The following policy allows users who obtain credentials using MFA to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               "Bool": {
                                        "g:MFAPresent": ["true"]
                               }
                       }
              }]
     }

  4. g:MFAAge

     Example: The following policy allows users who obtain credentials using MFA with the valid period greater than 900s to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               " NumberGreaterThanEquals ": {
                                        "g:MFAAge": ["900"]
                               }
                       }
              }]
     }

  5. g:ProjectName

     Example: The following policy allows users who obtain credentials in CN North-Beijing to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               " StringEquals ": {
                                        "g: ProjectName ": ["cn-north-4"]
                               }
                       }
              }]
     }

  6. g: ServiceName

     Example: The following policy allows users to access all services except IAM. The value of this condition key is matched to Service Name in the authentication request.

     {
              "Version": "1.1",
              "Statement": [{
                       "Action": [
                               "*:*:*"
                       ],
                       "Effect": "Allow",
                       "Condition": {
                               "StringNotEqualsIgnoreCase": {
                                        "g:ServiceName": [
                                                 "iam"
                                        ]
                               }
                       }
              }]
     }

  7. g: UserId

     Example: The following policy only allows user whose ID is xxxxxxxxxxx… to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               "StringEquals": {
                                        "g: UserId ": ["xxxxxxxxxxx…"]
                               }
                       }
              }]
     }

  8. g: UserName

     Example: The following policy only allows user lisi to create custom roles in IAM.

     {
              "Version": "1.1",
              "Statement": [{
                       "Effect": "Allow",
                       "Action": ["iam:roles:createRoles"],
                       "Condition": {
                               "StringEquals": {
                                        "g: UserName ": ["lisi"]
                               }
                       }
              }]
     }

  • Multivalued condition keys
    1. ForAllValues: Tests whether the value of every member of the request set is a subset of the condition key set. The condition returns true if every key value in the request matches at least one value in the policy.

       {
           "Version": "1.1",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Action": [
                       "ims:images:share"
                   ],
                   "Condition": {
                       "ForAllValues:StringEquals": {
                           "ims:TargetOrgPaths": [
                               "orgPath1",
                               "orgPath2",
                               "orgPath3"
                           ]
                       }
                   }
               }
           ]
       }

       This policy shows how to use the ForAllValues qualifier with the StringEquals condition operator. The condition determines whether to allow sharing with the member accounts in organization path orgPath1, orgPath2, or orgPath3.

       Assume a user makes a request to share IMS with the member accounts in organization paths orgPath1 and orgPath3. The request is allowed because the user's requested attributes all match values specified in the policy.

       If the user's request includes orgPath1, orgPath2, orgPath3, and orgPath4, the request fails because orgPath4 is not included in the condition operator.

    2. ForAnyValue: Tests whether at least one member of the set of request values matches at least one member of the set of condition key values. The condition returns true if any one of the key values in the request matches any one of the condition values in the policy. For no matching key or a null dataset, the condition returns false.

       {
           "Version": "1.1",
           "Statement": [
               {
                   "Effect": "Allow",
                   "Action": [
                       "ims:images:share"
                   ],
                   "Condition": {
                       "ForAnyValue:StringEquals": {
                           "ims:TargetOrgPaths": [
                               "orgPath1",
                               "orgPath2",
                               "orgPath3"
                           ]
                       }
                   }
               }
           ]
       }

       This policy shows how to use the ForAnyValue qualifier with the StringEquals condition operator. The condition determines whether to allow sharing with the member accounts in organization path orgPath1, orgPath2, or orgPath3.

       Assume a user makes a request to share IMS with the member accounts in organization path orgPath1 or orgPath4. The request is allowed because the user's requested attributes all match values specified in the policy.

       If the user initiates a request to share IMS with the member accounts in organization path orgPath4 or orgPath5, the request fails because orgPath4 and orgPath5 are not included in the condition operator.

  Condition operators

  Figure 2 Condition operators
  
  1. If a single condition operator includes multiple values for one key, that condition operator is evaluated using a logical OR. The condition returns true if any one of the key values in the request matches any one of the condition values in the policy.
     

     For negated matching condition operators (such as StringNotEquals), the request value cannot match any of the condition values based on the condition operators.

  2. If your policy has multiple condition operators or multiple keys attached to a single condition operator, the conditions are evaluated using a logical AND.