Cloud Backup and Recovery (CBR)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted IAM permissions can be applied only if they are allowed by the SCPs.

This section describes the elements (Action, Resource, and Condition) used by Organizations SCPs.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your SCP policy statements.
- If this column includes a resource type, you must specify the resource URN in the Resource element of your policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CBR, see Resources.
The Condition Key column includes keys that you can specify in the Condition element of an SCP policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column of an action is empty (-), the action does not support any condition keys.
For details about the condition keys defined by CBR, see Conditions.

The following table lists the actions that you can define in SCP statements for CBR.

**Table 1** Supported Actions
Action	Description	Access Level	Resource Type (*: required)	Condition Key
cbr:tasks:list	Grants permission to query the task list.	list	task *	-
cbr:tasks:list	Grants permission to query the task list.	list	-	g:EnterpriseProjectId
cbr:tasks:get	Grants permission to query a task.	read	task *	g:EnterpriseProjectId
cbr:member:create	Grants permission to add a share member.	permission_management	backup *	g:EnterpriseProjectId
cbr:member:create	Grants permission to add a share member.	permission_management	-	cbr:TargetOrgPaths
cbr:member:update	Grants permission to update the share member status.	write	backup *	g:EnterpriseProjectId
cbr:member:get	Grants permission to query share member details.	read	backup *	g:EnterpriseProjectId
cbr:member:list	Grants permission to obtain the share member list.	list	backup *	-
cbr:member:delete	Grants permission to delete a share member.	permission_management	backup *	g:EnterpriseProjectId
cbr:vaults:showCheckpoint	Grants permission to query a restore point.	read	-	-
cbr:vaults:showSummary	Grants permission to query the vault overview.	list	-	-
cbr:vaults:replicate	Grants permission to replicate a restore point.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:backup	Grants permission to create a restore point.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:sync	Grants permission to synchronize a restore point.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:create	Grants permission to create a vault.	write	vault *	-
cbr:vaults:create	Grants permission to create a vault.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId cbr:PolicyId
cbr:vaults:get	Grants permission to query a specified vault.	read	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:list	Grants permission to query the vault list.	list	vault *	-
cbr:vaults:list	Grants permission to query the vault list.	list	-	g:EnterpriseProjectId
cbr:vaults:update	Grants permission to modify a vault.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:delete	Grants permission to delete a vault.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:removeResources	Grants permission to dissociate resources.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:addResources	Grants permission to associate resources.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:setResources	Grants permission to set auto backup for a vault.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:associatePolicy	Grants permission to apply a policy to a vault.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:dissociatePolicy	Grants permission to remove a policy from a vault.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:vaults:listExternalVaults	Grants permission to query the vault list in other regions.	list	vault *	-
cbr:vaults:migrateResources	Grants permission to migrate resources.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:backups:sync	Grants permission to synchronize a backup.	write	vault *	g:EnterpriseProjectId
cbr:backups:get	Grants permission to query a specified backup.	read	backup *	g:EnterpriseProjectId
cbr:backups:showMetadata	Grants permission to query backup metadata.	read	backup *	g:EnterpriseProjectId
cbr:backups:list	Grants permission to query all backups.	list	backup *	-
cbr:backups:list	Grants permission to query all backups.	list	-	g:EnterpriseProjectId
cbr:backups:delete	Grants permission to delete a backup.	write	backup *	g:EnterpriseProjectId
cbr:backups:replicate	Grants permission to replicate a backup.	write	backup *	g:EnterpriseProjectId
cbr:backups:restore	Grants permission to restore data from a backup.	write	backup *	g:EnterpriseProjectId
cbr:backups:update	Grants permission to update a backup.	write	backup *	g:EnterpriseProjectId
cbr:policies:list	Grants permission to query the policy list.	list	policy *	-
cbr:policies:create	Grants permission to create a policy.	write	policy *	-
cbr:policies:create	Grants permission to create a policy.	write	-	cbr:EnabledPolicy
cbr:policies:get	Grants permission to query a policy.	read	policy *	-
cbr:policies:update	Grants permission to modify a policy.	write	policy *	-
cbr:policies:update	Grants permission to modify a policy.	write	-	cbr:EnabledPolicy
cbr:policies:delete	Grants permission to delete a policy.	write	policy *	-
cbr:vaults:listProtectables	Grants permission to query protectable resources.	list	-	g:EnterpriseProjectId
cbr:vaults:getProtectables	Grants permission to query a protectable resource.	read	-	-
cbr:backups:queryReplicationCapability	Grants permission to query the replication capability.	list	-	-
cbr:backups:checkAgent	Grants permission to query the Agent status.	read	-	-
cbr:vaults:listResourceInstances	Grants permission to query vault resources.	list	vault *	-
cbr:vaults:bulkCreateOrDeleteTags	Grants permission to batch add or delete tags of a vault resource.	write	vault *	g:ResourceTag/<tag-key>
cbr:vaults:bulkCreateOrDeleteTags		write	-	g:RequestTag/<tag-key> g:TagKeys
cbr:vaults:setTags	Grants permission to add a tag to a vault resource.	write	vault *	g:ResourceTag/<tag-key>
cbr:vaults:setTags	Grants permission to add a tag to a vault resource.	write	-	g:RequestTag/<tag-key> g:TagKeys
cbr:vaults:deleteTags	Grants permission to delete a tag of a vault resource.	write	vault *	g:ResourceTag/<tag-key>
cbr:vaults:deleteTags	Grants permission to delete a tag of a vault resource.	write	-	g:TagKeys
cbr:vaults:getTags	Grants permission to query tags of a vault resource.	read	vault *	g:ResourceTag/<tag-key>
cbr:vaults:listProjectTags	Grants permission to query tags of a vault project.	list	vault *	-
cbr:backups:listStorageUsage	Grants permission to query capacity statistics.	list	-	-
cbr:vaults:updateOrder	Grants permission to update order information.	write	vault *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cbr:agents:addPath	Grants permission to add file paths.	write	agent *	-
cbr:agents:get	Grants permission to query a specified client.	read	agent *	-
cbr:agents:update	Grants permission to modify a client.	write	agent *	-
cbr:agents:register	Grants permission to register a client.	write	agent *	-
cbr:agents:delete	Grants permission to remove a client.	write	agent *	-
cbr:agents:removePath	Grants permission to remove file paths.	write	agent *	-
cbr:agents:list	Grants permission to query the client list.	list	agent *	-
cbr:backups:migratesCreate	Grants permission to migrate resources of a tenant.	write	-	-
cbr:backups:migratesIndex	Grants permission to query the migration results.	read	-	-
cbr:organizationPolicies:create	Grants permission to create an organizational policy.	write	-	-
cbr:organizationPolicies:listPolicyDetail	Grants permission to query organizational policy delivery info.	read	-	-
cbr:organizationPolicies:delete	Grants permission to delete an organizational policy.	write	-	-
cbr:organizationPolicies:update	Grants permission to modify an organizational policy.	write	-	-
cbr:organizationPolicies:list	Grants permission to query the organizational policy list.	list	-	-
cbr:organizationPolicies:get	Grants permission to query an organizational policy.	read	-	-

A CBR API usually supports one or more actions. Table 2 lists actions supported by each API and dependencies of actions.

**Table 2** Actions and dependencies supported by CBR APIs
API	Action	Dependencies
GET /v3/{project_id}/operation-logs	cbr:tasks:list	-
GET /v3/{project_id}/operation-logs/{operation_log_id}	cbr:tasks:get	-
POST /v3/{project_id}/backups/{backup_id}/members	cbr:member:create	-
PUT /v3/{project_id}/backups/{backup_id}/members/{member_id}	cbr:member:update	-
GET /v3/{project_id}/backups/{backup_id}/members/{member_id}	cbr:member:get	-
GET /v3/{project_id}/backups/{backup_id}/members	cbr:member:list	-
DELETE /v3/{project_id}/backups/{backup_id}/members/{member_id}	cbr:member:delete	-
GET /v3/{project_id}/checkpoints/{checkpoint_id}	cbr:vaults:showCheckpoint	-
GET /v3/{project_id}/vaults/summary	cbr:vaults:showSummary	-
POST /v3/{project_id}/checkpoints/replicate	cbr:vaults:replicate	-
POST /v3/{project_id}/checkpoints	cbr:vaults:backup	ecs:cloudServers:listServersDetails evs:volumes:list
POST /v3/{project_id}/checkpoints/sync	cbr:vaults:sync	-
POST /v3/{project_id}/vaults	cbr:vaults:create	ecs:cloudServers:listServersDetails evs:volumes:list
POST /v3/{project_id}/vaults/order	cbr:vaults:create	ecs:cloudServers:listServersDetails evs:volumes:list
GET /v3/{project_id}/vaults/{vault_id}	cbr:vaults:get	-
GET /v3/{project_id}/vaults	cbr:vaults:list	-
PUT /v3/{project_id}/vaults/{vault_id}	cbr:vaults:update	-
PUT /v3/{project_id}/vaults/batch-update	cbr:vaults:update	-
DELETE /v3/{project_id}/vaults/{vault_id}	cbr:vaults:delete	-
POST /v3/{project_id}/vaults/{vault_id}/removeresources	cbr:vaults:removeResources	-
POST /v3/{project_id}/vaults/{vault_id}/addresources	cbr:vaults:addResources	ecs:cloudServers:listServersDetails evs:volumes:list
PUT /v3/{project_id}/vaults/{vault_id}/set-resources	cbr:vaults:setResources	-
POST /v3/{project_id}/vaults/{vault_id}/associatepolicy	cbr:vaults:associatePolicy	-
POST /v3/{project_id}/vaults/{vault_id}/dissociatepolicy	cbr:vaults:dissociatePolicy	-
GET /v3/{project_id}/vaults/external	cbr:vaults:listExternalVaults	-
POST /v3/{project_id}/vaults/{vault_id}/migrateresources	cbr:vaults:migrateResources	-
POST /v3/{project_id}/backups/sync	cbr:backups:sync	-
GET /v3/{project_id}/backups/{backup_id}	cbr:backups:get	-
GET /v3/{project_id}/backups/{backup_id}/metadata	cbr:backups:showMetadata	-
GET /v3/{project_id}/backups	cbr:backups:list	-
DELETE /v3/{project_id}/backups/{backup_id}	cbr:backups:delete	-
POST /v3/{project_id}/backups/{backup_id}/replicate	cbr:backups:replicate	-
POST /v3/{project_id}/backups/{backup_id}/restore	cbr:backups:restore	ecs:cloudServers:listServersDetails evs:volumes:list
PUT /v3/{project_id}/backups/{backup_id}	cbr:backups:update	-
GET /v3/{project_id}/policies	cbr:policies:list	-
POST /v3/{project_id}/policies	cbr:policies:create	-
GET /v3/{project_id}/policies/{policy_id}	cbr:policies:get	-
PUT /v3/{project_id}/policies/{policy_id}	cbr:policies:update	-
DELETE /v3/{project_id}/policies/{policy_id}	cbr:policies:delete	-
GET /v3/{project_id}/protectables/{protectable_type}/instances	cbr:vaults:listProtectables	ecs:cloudServers:listServersDetails evs:volumes:list
GET /v3/{project_id}/protectables/{protectable_type}/instances/{instance_id}	cbr:vaults:getProtectables	ecs:cloudServers:listServersDetails evs:volumes:list
GET /v3/{project_id}/replication-capabilities	cbr:backups:queryReplicationCapability	-
POST /v3/{project_id}/agent/check	cbr:backups:checkAgent	-
POST /v3/{project_id}/vault/resource_instances/action	cbr:vaults:listResourceInstances	-
POST /v3/{project_id}/vault/{vault_id}/tags/action	cbr:vaults:bulkCreateOrDeleteTags	-
POST /v3/{project_id}/vault/{vault_id}/tags	cbr:vaults:setTags	-
DELETE /v3/{project_id}/vault/{vault_id}/tags/{key}	cbr:vaults:deleteTags	-
GET /v3/{project_id}/vault/{vault_id}/tags	cbr:vaults:getTags	-
GET /v3/{project_id}/vault/tags	cbr:vaults:listProjectTags	-
GET /v3/{project_id}/storage_usage	cbr:backups:listStorageUsage	-
PUT /v3/{project_id}/orders/{order_id}	cbr:vaults:updateOrder	-
POST /v3/{project_id}/agents/{agent_id}/add-path	cbr:agents:addPath	-
GET /v3/{project_id}/agents/{agent_id}	cbr:agents:get	-
PUT /v3/{project_id}/agents/{agent_id}	cbr:agents:update	-
POST /v3/{project_id}/agents	cbr:agents:register	-
DELETE /v3/{project_id}/agents/{agent_id}	cbr:agents:delete	-
POST /v3/{project_id}/agents/{agent_id}/remove-path	cbr:agents:removePath	-
GET /v3/{project_id}/agents	cbr:agents:list	-
POST /v3/migrates	cbr:backups:migratesCreate	-
GET /v3/migrates	cbr:backups:migratesIndex	-

Resources

A resource type indicates the resources that an SCP policy applies to. If you specify a resource type for any action in Table 3, a resource URN must be specified in the SCP policy statements using that action, and the SCP policy applies only to the resource. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP policy applies to all resources. You can also set condition keys in an SCP policy to define resource types.

The following table lists the resource types that you can define in SCP policy statements for CBR.

**Table 3** Resource types supported by CBR
Resource Type	URN
Vault	cbr:<region>:<account-id>:vault:<vault-id>
Policy	cbr:<region>:<account-id>:policy:<policy-id>
Task	cbr:<region>:<account-id>:task:<task-id>
Backup	cbr:<region>:<account-id>:backup:<backup-id>
Agent	cbr:<region>:<account-id>:agent:<agent-id>

Conditions

A Condition element lets you specify conditions for when an SCP policy is in effect. It contains condition keys and operators.

A key in the Condition element of a statement can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, IAM automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cbr:) apply only to operations of the CBR service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
An operator, a condition key, and a condition value constitute a complete condition statement. An SCP policy applies only when its conditions are met. For supported condition operators, see condition operators.

The following table lists the condition keys that you can define in custom SCP policies for CBR. You can include these condition keys to specify conditions for when your SCP policy is in effect.

**Table 4** Service-specific condition keys supported by CBR
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
cbr:TargetOrgPaths	string	Single-valued	Organization path to which the target account specified in the API request for adding a share member of CBR belongs.
cbr:VaultId	string	Single-valued	Filters access based on the vault ID specified in the request parameter.
cbr:PolicyId	string	Single-valued	Filters access based on the policy ID specified in the request parameter.
cbr:EnabledPolicy	boolean	Single-valued	Whether to enable access filtering based on the policy.