Advanced Anti-DDoS (AAD)

The Service Control Policies (SCPs) in the Organizations service can use these authorization elements to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permission boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in a policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your SCP policy statements.
- If this column includes a resource type, you must specify a URN for the Resource element in your identity policy statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined by AAD, see Resources.
The Condition Key column includes keys that you can specify in the Condition element of a SCP policy statement.
- If the Resource Type column has values for an action, the condition key only takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by AAD, see Conditions.

The following table lists the actions that you can define in SCP statements for AAD.

**Table 1** Actions supported by AAD
Action	Description	Access Level	Resource Type (*: Required)	Condition Key
aad:alarmConfig:create	Create alarm settings.	write	alarmConfig *	-
aad:alarmConfig:put	Modify alarm settings.	write	alarmConfig *	-
aad:alarmConfig:get	Query alarm settings.	read	alarmConfig *	-
aad:alarmConfig:delete	Delete alarm settings.	write	alarmConfig *	-
aad:certificate:delete	Delete certificates.	write	certificate *	-
aad:certificate:list	Query certificates.	list	certificate *	-
aad:certificate:set	Modify domain name certificates.	write	certificate *	-
aad:certificate:set	Modify domain name certificates.	write	domain *	g:EnterpriseProjectId
aad:dashboard:delete	Delete report log configurations.	write	-	-
aad:dashboard:get	Obtain report data and log configurations.	read	-	-
aad:dashboard:set	Modify report log configurations.	write	-	-
aad:domain:create	Add protected domain names.	write	domain *	g:EnterpriseProjectId
aad:domain:delete	Delete protected domain names.	write	domain *	g:EnterpriseProjectId
aad:domain:get	Query domain name details.	read	domain *	g:EnterpriseProjectId
aad:domain:list	Query the domain name list.	list	domain *	g:EnterpriseProjectId
aad:domain:put	Modify domain protection attributes.	write	domain *	g:EnterpriseProjectId
aad:forwardingRule:create	Add forwarding rules.	write	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:delete	Delete forwarding rules.	write	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:get	Query forwarding rules.	read	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:list	Export forwarding rules.	list	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:put	Modify the back-to-source IP address permissions in the forwarding rule.	write	forwardingRule *	g:EnterpriseProjectId
aad:instance:create	Create an instance.	write	instance *	g:EnterpriseProjectId
aad:instance:get	Query instance attributes.	read	instance *	g:EnterpriseProjectId
aad:instance:list	Query the DB instance list.	list	instance *	g:EnterpriseProjectId
aad:instance:put	Modify instance attributes.	write	instance *	g:EnterpriseProjectId
aad:policy:create	Add protection rules.	write	policy *	g:EnterpriseProjectId
aad:policy:delete	Delete protection rules.	write	policy *	g:EnterpriseProjectId
aad:policy:get	Query protection rule details.	read	policy *	g:EnterpriseProjectId
aad:policy:list	Query protection rules.	list	policy *	g:EnterpriseProjectId
aad:policy:put	Modify protection rules.	write	policy *	g:EnterpriseProjectId
aad:quotas:get	Query protection specifications.	read	-	-
aad:whiteBlackIpRule:create	Add IP addresses to the blacklist or whitelist.	write	whiteBlackIpRule *	g:EnterpriseProjectId
aad:whiteBlackIpRule:delete	Delete IP addresses from the blacklist or whitelist.	write	whiteBlackIpRule *	g:EnterpriseProjectId
aad:whiteBlackIpRule:list	Query the protection blacklist and whitelist.	list	whiteBlackIpRule *	g:EnterpriseProjectId
aad:protectedIp:put	Modify the labels of protected objects.	write	-	-
aad:protectedIp:list	Query the protected object list.	list	-	-
aad:package:put	Modify the protection package.	write	package *	-
aad:package:list	Query the protected IP address list.	list	package *	-
aad:block:put	Unblock IP addresses.	write	-	-
aad:block:list	Query the blocked IP address list.	list	-	-
aad:block:get	Query blocking and unblocking information.	read	-	-
aad:alarmConfig:create	Create alarm settings.	write	alarmConfig *	-
aad:alarmConfig:put	Modify alarm settings.	write	alarmConfig *	-
aad:alarmConfig:get	Query alarm settings.	read	alarmConfig *	-
aad:alarmConfig:delete	Delete alarm settings.	write	alarmConfig *	-
aad:certificate:delete	Delete a certificate.	write	certificate *	-
aad:certificate:list	Query certificates.	list	certificate *	-
aad:certificate:set	Modify the certificate for a domain name.	write	certificate *	-
aad:certificate:set	Modify the certificate for a domain name.	write	domain *	g:EnterpriseProjectId
aad:dashboard:delete	Delete report log configurations.	write	-	-
aad:dashboard:get	Obtain report data and log configurations.	read	-	-
aad:dashboard:set	Modify report log configurations.	write	-	-
aad:domain:create	Add protected domain names.	write	domain *	g:EnterpriseProjectId
aad:domain:delete	Delete protected domain names.	write	domain *	g:EnterpriseProjectId
aad:domain:get	Query domain name details.	read	domain *	g:EnterpriseProjectId
aad:domain:list	Query the domain name list.	list	domain *	g:EnterpriseProjectId
aad:domain:put	Modify domain protection attributes.	write	domain *	g:EnterpriseProjectId
aad:forwardingRule:create	Add forwarding rules.	write	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:delete	Delete forwarding rules.	write	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:get	Query forwarding rules.	read	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:list	Export forwarding rules.	list	forwardingRule *	g:EnterpriseProjectId
aad:forwardingRule:put	Modify the back-to-source IP address permissions in the forwarding rule.	write	forwardingRule *	g:EnterpriseProjectId
aad:instance:create	Create an instance.	write	instance *	g:EnterpriseProjectId
aad:instance:get	Query instance attributes.	read	instance *	g:EnterpriseProjectId
aad:instance:list	Query the DB instance list.	list	instance *	g:EnterpriseProjectId
aad:instance:put	Modify instance attributes.	write	instance *	g:EnterpriseProjectId
aad:policy:create	Add protection rules.	write	policy *	g:EnterpriseProjectId
aad:policy:delete	Delete protection rules.	write	policy *	g:EnterpriseProjectId
aad:policy:get	Query protection rule details.	read	policy *	g:EnterpriseProjectId
aad:policy:list	Query protection rules.	list	policy *	g:EnterpriseProjectId
aad:policy:put	Modify protection rules.	write	policy *	g:EnterpriseProjectId
aad:quotas:get	Query protection specifications.	read	-	-
aad:whiteBlackIpRule:create	Add IP addresses to the blacklist or whitelist.	write	whiteBlackIpRule *	g:EnterpriseProjectId
aad:whiteBlackIpRule:delete	Delete IP addresses from the blacklist or whitelist.	write	whiteBlackIpRule *	g:EnterpriseProjectId
aad:whiteBlackIpRule:list	Query the protection blacklist and whitelist.	list	whiteBlackIpRule *	g:EnterpriseProjectId
aad:protectedIp:put	Modify the labels of protected objects.	write	-	-
aad:protectedIp:list	Query the protected object list.	list	-	-
aad:package:put	Modify the protection package.	write	package *	-
aad:package:list	Query the protected IP address list.	list	package *	-
aad:block:put	Grant permission to unblock IP addresses.	write	-	-
aad:block:list	Query the blocked IP address list.	list	-	-
aad:block:get	Query blocking and unblocking information.	read	-	-

Each API of AAD usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by AAD APIs
API	Action	Dependency
POST /v1/{project_id}/cad/alart/config	aad:alarmConfig:create	-
POST /v1/cnad/alarm-config	aad:alarmConfig:put	-
DELETE /v1/cnad/alarm-config	aad:alarmConfig:delete	-
GET /v1/{project_id}/cad/alart/list	aad:alarmConfig:get	-
GET /v1/cnad/alarm-config	aad:alarmConfig:get	-
DELETE /v1/aad/certificate/del	aad:certificate:delete	-
GET /v1/{project_id}/cad/domains/certificatelist	aad:certificate:list	-
GET /v1/aad/certificate-details	aad:certificate:list	-
POST /v1/{project_id}/cad/domains/certificate	aad:certificate:set	-
POST /v1/aad/configs/lts/delete	aad:dashboard:delete	-
GET /v1/{project_id}/cad/ddosinfo/events_type	aad:dashboard:get	-
GET /v1/aad/configs/lts_region	aad:dashboard:get	-
GET /v1/aad/configs/lts	aad:dashboard:get	-
GET /v1/{project_id}/waf/event/timeline	aad:dashboard:get	-
GET /v1/{project_id}/waf/event/request/peak	aad:dashboard:get	-
GET /v1/{project_id}/waf/event/attack/type	aad:dashboard:get	-
GET /v1/{project_id}/waf/event/attack/source/num	aad:dashboard:get	-
GET /v1/{project_id}/waf/event/attack/source	aad:dashboard:get	-
GET /v1/{project_id}/cad/instances/flow_pps	aad:dashboard:get	-
GET /v1/{project_id}/cad/instances/flow_bps	aad:dashboard:get	-
GET /v1/{project_id}/cad/instances/events	aad:dashboard:get	-
GET /v1/{project_id}/cad/ddosinfo/peak	aad:dashboard:get	-
POST /v1/aad/configs/lts	aad:dashboard:set	-
POST /v1/{project_id}/aad/domains	aad:domain:create	-
POST /v1/{project_id}/cad/domains/del	aad:domain:delete	-
GET /v1/{project_id}/aad/domains/{domain_id}/service-config	aad:domain:get	-
GET /v1/{project_id}/cad/domains/ports	aad:domain:list	-
GET /v1/{project_id}/cad/domains/name	aad:domain:get	-
GET /v1/{project_id}/cad/domains/line/{enterprise_project_id}	aad:domain:list	-
GET /v1/{project_id}/cad/domains/instances	aad:domain:get	-
GET /v1/{project_id}/cad/domains/brief	aad:domain:get	-
GET /v1/{project_id}/aad/domains/waf-list	aad:domain:list	-
GET /v1/{project_id}/cad/domains	aad:domain:list	-
POST /v1/{project_id}/aad/domains/{domain_id}/service-config	aad:domain:put	-
POST /v1/{project_id}/cad/domains/switch	aad:domain:put	-
POST /v1/{project_id}/cad/domains/cnameDispatchSwitch	aad:domain:put	-
POST /v1/{project_id}/cad/domains/cname/switch	aad:domain:put	-
POST /v1/{project_id}/cad/instances/protocol_rule	aad:forwardingRule:create	-
POST /v1/{project_id}/cad/instances/protocol_rule/import	aad:forwardingRule:create	-
DELETE /v1/{project_id}/cad/instances/protocol_rule/{rule_id}	aad:forwardingRule:delete	-
POST /v1/{project_id}/cad/instances/protocol_rule/batchdel	aad:forwardingRule:delete	-
GET /v1/{project_id}/cad/instances/rules	aad:forwardingRule:get	-
GET /v1/{project_id}/cad/instances/protocol_rule/export	aad:forwardingRule:list	-
PUT /v1/{project_id}/cad/instances/protocol_rule/{rule_id}	aad:forwardingRule:put	-
POST /v1/{project_id}/cad/instances/cad_open	aad:instance:create	-
GET /v1/{project_id}/cad/products	aad:instance:create	-
GET /v1/{project_id}/{resource_type}/{resource_id}/tags	aad:instance:get	-
GET /v1/{project_id}/cad/upgradeproducts/{instance_id}	aad:instance:get	-
GET /v1/{project_id}/cad/instances/detail/{instance_id}	aad:instance:get	-
GET /v1/{project_id}/aad/instances/brief-list	aad:instance:list	-
GET /v1/{project_id}/cad/sourceip	aad:instance:list	-
GET /v1/{project_id}/cad/instances	aad:instance:list	-
POST /v1/{project_id}/{resource_type}/{resource_id}/tags/action	aad:instance:put	-
POST /v1/{project_id}/cad/instances/cad_spec_upgrade	aad:instance:put	-
PUT /v1/{project_id}/cad/instances/{instance_id}/name	aad:instance:put	-
PUT /v1/{project_id}/cad/instances/{instance_id}/elastic/{ip_id}	aad:instance:put	-
POST /v1/{project_id}/aad/policies/waf/cc	aad:policy:create	-
POST /v1/cnad/policies	aad:policy:create	-
DELETE /v1/{project_id}/aad/policies/waf/cc/{rule_id}	aad:policy:delete	-
DELETE /v1/cnad/policies/{policy_id}	aad:policy:delete	-
GET /v1/{project_id}/cad/flowblock	aad:policy:get	-
GET /v1/cnad/policies/{policy_id}	aad:policy:get	-
GET /v1/{project_id}/aad/policies/waf/cc	aad:policy:list	-
GET /v1/cnad/policies	aad:policy:list	-
PUT /v1/{project_id}/aad/policies/waf/cc/{rule_id}	aad:policy:put	-
POST /v1/{project_id}/cad/flowblock/udp	aad:policy:put	-
POST /v1/{project_id}/cad/flowblock/foreign	aad:policy:put	-
POST /v1/cnad/policies/{policy_id}/ip-list/add	aad:policy:put	-
POST /v1/cnad/policies/{policy_id}/bind	aad:policy:put	-
POST /v1/cnad/policies/{policy_id}/ip-list/delete	aad:policy:put	-
POST /v1/cnad/policies/{policy_id}/unbind	aad:policy:put	-
PUT /v1/cnad/policies/{policy_id}	aad:policy:put	-
GET /v1/{project_id}/aad/quotas/domain-port	aad:quotas:get	-
GET /v1/{project_id}/scc/waf/quota	aad:quotas:get	-
GET /v1/{project_id}/cad/quotas	aad:quotas:get	-
GET /v1/{project_id}/cad/ip/quotas	aad:quotas:get	-
GET /v1/{project_id}/cad/bwlist/quota	aad:quotas:get	-
GET /v1/{project_id}/aad/user-configs	aad:quotas:get	-
POST /v1/{project_id}/cad/bwlist	aad:whiteBlackIpRule:create	-
POST /v1/{project_id}/cad/bwlist/delete	aad:whiteBlackIpRule:delete	-
GET /v1/{project_id}/cad/bwlist	aad:whiteBlackIpRule:list	-
PUT /v1/cnad/protected-ips/tags	aad:protectedIp:put	-
GET /v1/cnad/protected-ips	aad:protectedIp:list	-
POST /v1/cnad/packages/{package_id}/protected-ips	aad:package:put	-
PUT /v1/cnad/packages/{package_id}/name	aad:package:put	-
GET /v1/cnad/packages	aad:package:list	-
GET /v1/cnad/packages/{package_id}/unbound-protected-ips	aad:package:list	-
POST /v1/unblockservice/{domain_id}/unblock	aad:block:put	-
GET /v1/unblockservice/{domain_id}/block-list	aad:block:list	-
GET /v1/unblockservice/{domain_id}/unblock-quota-statistics	aad:block:get	-
GET /v1/unblockservice/{domain_id}/block-statistics	aad:block:get	-
GET /v1/unblockservice/{domain_id}/unblock-record	aad:block:get	-
GET /v1/{project_id}/cad/instances/{instance_id}/elastic_count/{ip_id}	aad:instance:get	-
GET /v1/{project_id}/cad/instances/{data_center}/elastic/{line}/{ip_id}	aad:instance:get	-
GET /v1/aad/remain-vip-number	aad:quotas:get	-
GET /v1/aad/instance/connection-num	aad:dashboard:get	-
PUT /v1/{project_id}/cad/instances/{instance_id}/pp-switch	aad:instance:put	-
GET /v1/aad-service/ces/{domain_id}/dims-info	aad:instance:list	-
GET /v1/aad-service/ces/v2/{domain_id}/instances	aad:instance:list	-
GET /v1/{project_id}/cad/instances/security-statistics	aad:instance:list	-
GET /v1/aad/domain/instances/rules	aad:domain:list	-
POST /v1/aad/policy/modify	aad:policy:put	-
POST /v1/aad/geoip	aad:policy:put	-
GET /v1/aad/geoip	aad:policy:get	-
DELETE /v1/aad/geoip/{ruleId}	aad:policy:delete	-
PUT /v1/aad/geoip/{ruleId}	aad:policy:put	-
POST /v1/aad/whiteip	aad:policy:put	-
GET /v1/aad/whiteip	aad:policy:get	-
DELETE /v1/aad/whiteip	aad:policy:delete	-
POST /v1/aad/custom	aad:policy:put	-
GET /v1/aad/custom	aad:policy:get	-
PUT /v1/aad/custom/{ruleId}	aad:policy:put	-
DELETE /v1/aad/custom/{ruleId}	aad:policy:delete	-
GET /v1/aad/policy/details	aad:policy:get	-
POST /v1/aad/cc/intelligent/modify	aad:policy:put	-
GET /v1/aad/geoip/map	aad:policy:get	-
GET /v1/aad/instances/{instance_id}/{ip}/ddos-statistics	aad:dashboard:get	-
GET /v1/aad/protected-domains/{domain_id}	aad:domain:get	-
GET /v1/aad/protected-domains	aad:domain:list	-
PUT /v1/aad/protected-domains/{domain_id}	aad:domain:put	-
POST /v1/aad/instances/{instance_id}/{ip}/rules/batch-create	aad:forwardingRule:create	-
POST /v1/aad/instances/{instance_id}/{ip}/rules/batch-delete	aad:forwardingRule:delete	-
GET /v1/aad/instances/{instance_id}/{ip}/rules	aad:forwardingRule:list	-
PUT /v1/aad/instances/{instance_id}/{ip}/rules/{rule_id}	aad:forwardingRule:put	-
GET /v1/aad/instances	aad:instance:list	-

Resources

A resource type indicates the resources that an SCP policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP policy statements using that action, and the policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the policy applies to all resources. You can also set condition keys in a policy to define resource types.

The following table lists the resource types that you can define in SCP policy statements for AAD.

**Table 3** Resource types supported by AAD
Resource Type	URN
forwardingRule	aad::<account-id>:forwardingRule:<forwarding-rule-id>
package	aad::<account-id>:package:<package-id>
policy	aad::<account-id>:policy:<policy-id>
alarmConfig	aad::<account-id>:alarmConfig:<alarm-config-id>
domain	aad::<account-id>:domain:<domain-id>
certificate	aad::<account-id>:certificate:<certificate-id>
instance	aad::<account-id>:instance:<instance-id>
whiteBlackIpRule	aad::<account-id>:whiteBlackIpRule:<white-black-ip-rule-id>