SSL Certificate Manager (SCM)
The Organizations service also provides Service Control Policies (SCPs) to set access control policies.
SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.
This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.
For details about how to use these elements to create a custom SCP, see Creating an SCP.
Actions
Actions are specific operations that are allowed or denied in an SCP.
- The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
- The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN for the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined by the SCM, see Table 3.
- The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by SCM, see Conditions.
The following table lists the actions that you can define in SCP statements for SCM.
Action |
Description |
Access Level |
Resource Type (*: Required) |
Condition Key |
---|---|---|---|---|
scm:cert:subscribe |
Grants the permission to buy a certificate. |
write |
cert * |
- |
- |
g:EnterpriseProjectId |
|||
scm:cert:update |
Grants the permission to update a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:delete |
Grants the permission to delete a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:apply |
Grants the permission to request a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:revoke |
Grants the permission to revoke a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:cancel |
Grants the permission to cancel a certificate request. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:reissue |
Grants the permission to re-issue a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:push |
Grants the permission to push a certificate to other service. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:import |
Grants the permission to import a certificate. |
write |
cert * |
- |
- |
g:EnterpriseProjectId |
|||
scm:cert:export |
Grants the permission to export a certificate. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:upload |
Grants the permission to upload a certificate to SCM. |
write |
cert * |
- |
- |
g:EnterpriseProjectId |
|||
scm:cert:download |
Grants the permission to download a certificate. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:save |
Grants the permission to supplement certificate information. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:addDomain |
Grants the permission to add more domain names for a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:expandQuota |
Grants the permission to expand the certificate quota. |
write |
- |
g:EnterpriseProjectId |
scm:cert:renew |
Grants the permission to renew a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:unsubscribe |
Grants the permission to unsubscribe from a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:autoRenew |
Grants the permission to enable automatic certificate renewal. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:list |
Grants the permission to query the certificate list. |
list |
cert * |
- |
- |
g:EnterpriseProjectId |
|||
scm:cert:get |
Grants the permission to query certificate details. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:getApplicationInfo |
Grants the permission to query certificate supplementation information. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listPushHistory |
Grants the permission to query certificate push records. |
list |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:getDomainValidation |
Grants the permission to query domain name verification information. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:checkDomain |
Grants the permission to verify the certificate domain name ownership. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listDeployedResources |
Grants the permission to obtain the resources associated with the certificate. |
list |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:deletePrivacyAuthorization |
Grants the permission to cancel privacy authorization. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:enableAutoDeploy |
Grants the permission to automatically deploy a certificate. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listAutoDeployedResources |
Grants the permission to query the list of certificates that are automatically deployed. |
list |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listCertificatesByTag |
Grants the permission to query the certificate list by tag. |
list |
cert * |
- |
- |
|
|||
scm:cert:createTag |
Grants the permission to create or update a tag. |
tagging |
cert * |
g:ResourceTag/<tag-key> |
- |
|
|||
scm:cert:listTagsByCertificate |
Grants the permission to query the certificate tag list. |
list |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listAllTags |
Grants the permission to query the list of all tags. |
list |
cert * |
- |
scm:cert:seekHelp |
Grants the permission to send a help-seeking email. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:uploadAuthentication |
Grants the permission to upload authentication information. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm::createCsr |
Grants the permission to create a CSR. |
write |
- |
- |
scm::listCsr |
Grants the permission to query the CSR list. |
list |
- |
- |
scm::getCsr |
Grants the permission to query CSR details. |
read |
- |
- |
scm::getCsrPrivateKey |
Grants the permission to obtain the CSR private key. |
read |
- |
- |
scm::updateCsr |
Grants the permission to update a CSR. |
write |
- |
- |
scm::deleteCsr |
Grants the permission to delete a CSR. |
write |
- |
- |
scm::uploadCsr |
Grants the permission to upload a CSR. |
write |
- |
- |
scm::createDomainMonitor |
Grants the permission to add a domain name to be monitored. |
write |
- |
- |
scm::updateDomainMonitor |
Grants the permission to update domain names to be monitored. |
write |
- |
- |
scm::updateDomainMonitorSwitch |
Grants the permission to enable or disable domain name monitoring. |
write |
- |
- |
scm::deleteDomainMonitor |
Grants the permission to delete a monitored domain name. |
write |
- |
- |
scm::getDomainMonitor |
Grants the permission to query details about the domain name to be monitored. |
read |
- |
- |
scm::listDomainMonitors |
Grants the permission to query the list of domain names to be monitored. |
list |
- |
- |
scm:cert:operateNotification |
Grants the permission to configure certificate notifications. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm::orderDomainMonitor |
Grants the permission to buy the domain name monitoring quota. |
write |
- |
- |
scm:cert:deployResources |
Grants the permission to deploy the certificate to other service resources. |
write |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:listDeployResourcesHistory |
Grants permission to query the deployment history of a certificate. |
list |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
|||
scm:cert:getDeployQuota |
Grants the permission to obtain the certificate deployment quota. |
read |
cert * |
g:ResourceTag/<tag-key> |
- |
g:EnterpriseProjectId |
Each API of SCM usually supports one or more actions. Table 2 lists the actions and dependencies supported by SCM APIs.
API |
Action |
Dependencies |
---|---|---|
GET /v3/scm/certificates |
scm:cert:list |
- |
POST /v3/scm/certificates/import |
scm:cert:import |
- |
GET /v3/scm/certificates/{certificate_id} |
scm:cert:get |
- |
POST /v3/scm/certificates/{certificate_id}/export |
scm:cert:export |
- |
POST /v3/scm/certificates/{certificate_id}/push |
scm:cert:push |
- |
DELETE /v3/scm/certificates/{certificate_id} |
scm:cert:delete |
- |
POST /v3/scm/certificates/{certificate_id}/read |
scm:cert:getApplicationInfo |
- |
POST /v3/scm/domain/monitor/subscribe |
scm::orderDomainMonitor |
- |
PUT /v3/scm/domain/monitor/change |
scm::orderDomainMonitor |
- |
POST /v3/scm/certificates/{certificate_id}/deploy |
scm:cert:deployResources |
- |
GET /v3/scm/certificates/{certificate_id}/deploy-history |
scm:cert:listDeployResourcesHistory |
- |
GET /v3/scm/certificates/{certificate_id}/deploy-quota |
scm:cert:getDeployQuota |
- |
Resources
A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.
The following table lists the resource types that you can define in SCP statements for SCM.
Conditions
SCM does not support service-specific condition keys in SCP statements. SCM can use only global condition keys applicable to all services. For details, see Global Condition Keys.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot