IoT Device Access (IoTDA)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by IoTDA, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about condition keys defined by IoTDA, see Conditions.

The following table lists the actions that you can define in SCP statements for IoTDA.

**Table 1** Actions supported by IoTDA
Action	Description	Access Level	Resource Type	Condition Key
iotda:products:create	Creating a product	write	app	g:EnterpriseProjectId
iotda:products:queryList	Querying the product list	list	app	g:EnterpriseProjectId
iotda:products:query	Querying a product	read	app	g:EnterpriseProjectId
iotda:products:modify	Modifying a product	write	app	g:EnterpriseProjectId
iotda:products:delete	Deleting a product	write	app	g:EnterpriseProjectId
iotda:devices:register	Creating a device	write	app	g:EnterpriseProjectId
iotda:devices:queryList	Querying the device list	list	app	g:EnterpriseProjectId
iotda:devices:query	Querying a device	read	app	g:EnterpriseProjectId
iotda:devices:modify	Modifying a device	write	app	g:EnterpriseProjectId
iotda:devices:delete	Deleting a device	write	app	g:EnterpriseProjectId
iotda:devices:resetSecret	Resetting a device secret	write	app	g:EnterpriseProjectId
iotda:devices:freeze	Freezing a device	write	app	g:EnterpriseProjectId
iotda:devices:unfreeze	Unfreezing a device	write	app	g:EnterpriseProjectId
iotda:devices:resetFingerprint	Resetting a device fingerprint	write	app	g:EnterpriseProjectId
iotda:devices:queryList	Querying device list flexibly	list	app	g:EnterpriseProjectId
iotda:messages:send	Delivering a device message	write	app	g:EnterpriseProjectId
iotda:messages:queryList	Querying device messages	list	app	g:EnterpriseProjectId
iotda:messages:query	Query a message by message ID	read	app	g:EnterpriseProjectId
iotda:message:broadcast	Broadcasting a message	write	app	g:EnterpriseProjectId
iotda:commands:send	Delivering a device command	write	app	g:EnterpriseProjectId
iotda:asynccommands:send	Delivering an asynchronous command	write	app	g:EnterpriseProjectId
iotda:asynccommands:query	Querying a command with a specific ID	read	app	g:EnterpriseProjectId
iotda:properties:modify	Modifying device properties	write	app	g:EnterpriseProjectId
iotda:properties:query	Querying device properties	read	app	g:EnterpriseProjectId
iotda:shadow:query	Querying device shadow data	read	app	g:EnterpriseProjectId
iotda:shadow:config	Configuring desired device shadow data	write	app	g:EnterpriseProjectId
iotda:amqpqueue:create	Creating an AMQP queue	write	-	g:EnterpriseProjectId
iotda:amqpqueue:queryList	Querying the AMQP list	list	-	g:EnterpriseProjectId
iotda:amqpqueue:query	Querying an AMQP queue	read	-	g:EnterpriseProjectId
iotda:amqpqueue:delete	Deleting an AMQP queue	write	-	g:EnterpriseProjectId
iotda:accesscode:create	Generating an access credential	write	-	g:EnterpriseProjectId
iotda:routingrules:create	Creating a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingrules:queryList	Querying the rule triggering condition list	list	app	g:EnterpriseProjectId
iotda:routingrules:query	Querying a rule triggering condition	read	app	g:EnterpriseProjectId
iotda:routingrules:modify	Modifying a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingrules:delete	Deleting a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingactions:create	Creating a rule action	write	app	g:EnterpriseProjectId
iotda:routingactions:queryList	Querying the rule action list	list	app	g:EnterpriseProjectId
iotda:routingactions:query	Querying a rule action	read	app	g:EnterpriseProjectId
iotda:routingactions:modify	Modifying a rule action	write	app	g:EnterpriseProjectId
iotda:routingactions:delete	Deleting a rule action	write	app	g:EnterpriseProjectId
iotda:rules:create	Creating a rule	write	-	g:EnterpriseProjectId
iotda:rules:queryList	Querying the rule list	list	-	g:EnterpriseProjectId
iotda:rules:modify	Modifying a rule	write	-	g:EnterpriseProjectId
iotda:rules:query	Querying a rule	read	-	g:EnterpriseProjectId
iotda:rules:delete	Deleting a rule	write	-	g:EnterpriseProjectId
iotda:rules:modifyStatus	Modifying the rule status	write	-	g:EnterpriseProjectId
iotda:group:create	Adding a device group	write	app	g:EnterpriseProjectId
iotda:group:queryList	Querying the device group list	list	app	g:EnterpriseProjectId
iotda:group:query	Querying a device group	read	app	g:EnterpriseProjectId
iotda:group:modify	Modifying a device group	write	app	g:EnterpriseProjectId
iotda:group:delete	Deleting a device group	write	app	g:EnterpriseProjectId
iotda:group:addDevice	Managing devices in a device group	write	app	g:EnterpriseProjectId
iotda:group:queryDeviceList	Query devices in a device group	list	app	g:EnterpriseProjectId
iotda:tags:bind	Binding a tag	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:tags:unbind	Unbinding a tag	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:tags:queryResourceList	Querying resources by tag	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:apps:queryList	Querying the resource space list	list	app	g:EnterpriseProjectId
iotda:app:create	Creating a resource space	write	app	g:EnterpriseProjectId
iotda:apps:query	Querying a resource space	read	app	g:EnterpriseProjectId
iotda:apps:delete	Deleting a resource space	write	app	g:EnterpriseProjectId
iotda:batchtasks:create	Creating a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:queryList	Querying the batch task list	list	-	g:EnterpriseProjectId
iotda:batchtasks:query	Querying a batch task	read	-	g:EnterpriseProjectId
iotda:batchtasks:retry	Retrying a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:stop	Stopping a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:delete	Deleting a batch task	write	-	g:EnterpriseProjectId
iotda:batchtaskfiles:create	Uploading a batch task file	write	-	g:EnterpriseProjectId
iotda:batchtaskfiles:queryList	Querying the list of batch task files	list	-	g:EnterpriseProjectId
iotda:batchtaskfiles:delete	Deleting a batch task file	write	-	g:EnterpriseProjectId
iotda:certificates:upload	Uploading a device CA certificate	write	app	g:EnterpriseProjectId
iotda:certificates:queryList	Obtaining the device CA certificate list	list	app	g:EnterpriseProjectId
iotda:certificates:delete	Deleting a device CA certificate	write	app	g:EnterpriseProjectId
iotda:certificates:check	Verifying a device CA certificate	write	app	g:EnterpriseProjectId
iotda:otapackages:create	Creating an OTA upgrade package	write	-	g:EnterpriseProjectId
iotda:otapackages:queryList	Querying the OTA upgrade package list	list	-	g:EnterpriseProjectId
iotda:otapackages:query	Obtaining OTA upgrade package details	read	-	g:EnterpriseProjectId
iotda:otapackages:delete	Deleting an OTA upgrade package	write	-	g:EnterpriseProjectId
iotda:tunnel:queryList	Querying the tunnel list	list	-	g:EnterpriseProjectId
iotda:tunnel:create	Creating a device tunnel	write	-	g:EnterpriseProjectId
iotda:tunnel:delete	Deleting a device tunnel	write	-	g:EnterpriseProjectId
iotda:tunnel:query	Querying tunnel details	read	-	g:EnterpriseProjectId
iotda:tunnel:update	Modifying a device tunnel	write	-	g:EnterpriseProjectId

Each API of IoTDA usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by IoTDA APIs
API	Action	Dependencies
POST /v5/iot/{project_id}/products	iotda:products:create	-
GET /v5/iot/{project_id}/products	iotda:products:queryList	-
GET /v5/iot/{project_id}/products/{product_id}	iotda:products:query	-
PUT /v5/iot/{project_id}/products/{product_id}	iotda:products:modify	-
DELETE /v5/iot/{project_id}/products/{product_id}	iotda:products:delete	-
POST /v5/iot/{project_id}/devices	iotda:devices:register	-
GET /v5/iot/{project_id}/devices	iotda:devices:queryList	-
GET /v5/iot/{project_id}/devices/{device_id}	iotda:devices:query	-
PUT /v5/iot/{project_id}/devices/{device_id}	iotda:devices:modify	-
DELETE /v5/iot/{project_id}/devices/{device_id}	iotda:devices:delete	-
POST /v5/iot/{project_id}/devices/{device_id}/action	iotda:devices:resetSecret	-
POST /v5/iot/{project_id}/devices/{device_id}/freeze	iotda:devices:freeze	-
POST /v5/iot/{project_id}/devices/{device_id}/unfreeze	iotda:devices:unfreeze	-
POST /v5/iot/{project_id}/devices/{device_id}/reset-fingerprint	iotda:devices:resetFingerprint	-
POST /v5/iot/{project_id}/search/query-devices	iotda:devices:queryList	-
POST /v5/iot/{project_id}/devices/{device_id}/messages	iotda:messages:send	-
GET /v5/iot/{project_id}/devices/{device_id}/messages	iotda:messages:queryList	-
GET /v5/iot/{project_id}/devices/{device_id}/messages/{message_id}	iotda:messages:query	-
POST /v5/iot/{project_id}/broadcast-messages	iotda:message:broadcast	-
POST /v5/iot/{project_id}/devices/{device_id}/commands	iotda:commands:send	-
POST /v5/iot/{project_id}/devices/{device_id}/async-commands	iotda:asynccommands:send	-
GET /v5/iot/{project_id}/devices/{device_id}/async-commands/{command_id}	iotda:asynccommands:query	-
PUT /v5/iot/{project_id}/devices/{device_id}/properties	iotda:properties:modify	-
GET /v5/iot/{project_id}/devices/{device_id}/properties	iotda:properties:query	-
GET /v5/iot/{project_id}/devices/{device_id}/shadow	iotda:shadow:query	-
PUT /v5/iot/{project_id}/devices/{device_id}/shadow	iotda:shadow:config	-
POST /v5/iot/{project_id}/amqp-queues	iotda:amqpqueue:create	-
GET /v5/iot/{project_id}/amqp-queues	iotda:amqpqueue:queryList	-
GET /v5/iot/{project_id}/amqp-queues/{queue_id}	iotda:amqpqueue:query	-
DELETE /v5/iot/{project_id}/amqp-queues/{queue_id}	iotda:amqpqueue:delete	-
POST /v5/iot/{project_id}/auth/accesscode	iotda:accesscode:create	-
POST /v5/iot/{project_id}/routing-rule/rules	iotda:routingrules:create	-
GET /v5/iot/{project_id}/routing-rule/rules	iotda:routingrules:queryList	-
GET /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:query	-
PUT /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:modify	-
DELETE /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:delete	-
POST /v5/iot/{project_id}/routing-rule/actions	iotda:routingactions:create	-
GET /v5/iot/{project_id}/routing-rule/actions	iotda:routingactions:queryList	-
GET /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:query	-
PUT /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:modify	-
DELETE /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:delete	-
POST /v5/iot/{project_id}/rules	iotda:rules:create	-
GET /v5/iot/{project_id}/rules	iotda:rules:queryList	-
PUT /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:modify	-
GET /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:query	-
DELETE /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:delete	-
PUT /v5/iot/{project_id}/rules/{rule_id}/status	iotda:rules:modifyStatus	-
POST /v5/iot/{project_id}/device-group	iotda:group:create	-
GET /v5/iot/{project_id}/device-group	iotda:group:queryList	-
GET /v5/iot/{project_id}/device-group/{group_id}	iotda:group:query	-
PUT /v5/iot/{project_id}/device-group/{group_id}	iotda:group:modify	-
DELETE /v5/iot/{project_id}/device-group/{group_id}	iotda:group:delete	-
POST /v5/iot/{project_id}/device-group/{group_id}/action	iotda:group:addDevice	-
GET /v5/iot/{project_id}/device-group/{group_id}/devices	iotda:group:queryDeviceList	-
POST /v5/iot/{project_id}/tags/bind-resource	iotda:tags:bind	-
POST /v5/iot/{project_id}/tags/unbind-resource	iotda:tags:unbind	-
POST /v5/iot/{project_id}/tags/query-resources	iotda:tags:queryResourceList	-
GET /v5/iot/{project_id}/apps	iotda:apps:queryList	-
POST /v5/iot/{project_id}/apps	iotda:app:create	-
GET /v5/iot/{project_id}/apps/{app_id}	iotda:apps:query	-
DELETE /v5/iot/{project_id}/apps/{app_id}	iotda:apps:delete	-
POST /v5/iot/{project_id}/batchtasks	iotda:batchtasks:create	-
GET /v5/iot/{project_id}/batchtasks	iotda:batchtasks:queryList	-
GET /v5/iot/{project_id}/batchtasks/{task_id}	iotda:batchtasks:query	-
POST /v5/iot/{project_id}/batchtasks/{task_id}/retry	iotda:batchtasks:retry	-
POST /v5/iot/{project_id}/batchtasks/{task_id}/stop	iotda:batchtasks:stop	-
DELETE /v5/iot/{project_id}/batchtasks/{task_id}	iotda:batchtasks:delete	-
POST /v5/iot/{project_id}/batchtask-files	iotda:batchtaskfiles:create	-
GET /v5/iot/{project_id}/batchtask-files	iotda:batchtaskfiles:queryList	-
DELETE /v5/iot/{project_id}/batchtask-files/{file_id}	iotda:batchtaskfiles:delete	-
POST /v5/iot/{project_id}/certificates	iotda:certificates:upload	-
GET /v5/iot/{project_id}/certificates	iotda:certificates:queryList	-
DELETE /v5/iot/{project_id}/certificates/{certificate_id}	iotda:certificates:delete	-
POST /v5/iot/{project_id}/certificates/{certificate_id}/action	iotda:certificates:check	-
POST /v5/iot/{project_id}/ota-upgrades/packages	iotda:otapackages:create	-
GET /v5/iot/{project_id}/ota-upgrades/packages	iotda:otapackages:queryList	-
GET /v5/iot/{project_id}/ota-upgrades/packages/{package_id}	iotda:otapackages:query	-
DELETE /v5/iot/{project_id}/ota-upgrades/packages/{package_id}	iotda:otapackages:delete	-
GET /v5/iot/{project_id}/tunnels	iotda:tunnel:queryList	-
POST /v5/iot/{project_id}/tunnels	iotda:tunnel:create	-
DELETE /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:delete	-
GET /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:query	-
PUT /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:update	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.