FunctionGraph

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the defined resource types, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the defined condition keys, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for FunctionGraph.

**Table 1** Supported Actions
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
functiongraph:function:createFunction	Grants permission to create a function.	Write	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:create
functiongraph:function:createFunction	Grants permission to create a function.	Write	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:create
functiongraph:function:deleteFunction	Grants permission to delete a function.	Write	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:delete
functiongraph:function:deleteFunction	Grants permission to delete a function.	Write	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:delete
functiongraph:function:listFunctions	Grants permission to list functions.	List	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:list
functiongraph:function:listFunctions	Grants permission to list functions.	List	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:list
functiongraph:function:getFunctionCode	Grants permission to query the code of a function.	Read	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:getCode
functiongraph:function:getFunctionCode	Grants permission to query the code of a function.	Read	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:getCode
functiongraph:function:updateFunctionCode	Grants permission to modify the code of a function.	Write	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:updateCode
functiongraph:function:updateFunctionCode	Grants permission to modify the code of a function.	Write	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:updateCode
functiongraph:function:getFunctionConfig	Grants permission to query the metadata of a function.	Read	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:getConfig
functiongraph:function:getFunctionConfig	Grants permission to query the metadata of a function.	Read	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:getConfig
functiongraph:function:updateFunctionConfig	Grants permission to modify the metadata of a function.	Write	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:updateConfig
functiongraph:function:updateFunctionConfig	Grants permission to modify the metadata of a function.	Write	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:updateConfig
functiongraph:function:updateMaxInstanceConfig	Grants permission to update the maximum number of instances of a function.	Write	function *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	functiongraph:function:updateConfig
functiongraph:function:updateMaxInstanceConfig		Write	-	g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:updateConfig
functiongraph:function:updateSnapshot	Grants permission to enable or disable snapshot for a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph:function:getSnapshotState	Grants permission to query the snapshot status of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph:function:createUrl	Grants permission to create a function URL.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph:function:deleteUrl	Grants permission to delete a function URL.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph:function:updateUrl	Grants permission to update a function URL.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph:function:getUrl	Grants permission to query the URL of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph::getResourceInstance	Grants permission to query resources.	Read	-	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph::createTag	Grants permission to create resource tags.	Tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	functiongraph:function:updateConfig
functiongraph::deleteTag	Grants permission to delete resource tags.	Tagging	-	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph::listTags	Grants permission to list resource tags.	List	-	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph::createFunctionApp	Grants permission to create an application.	Write	-	g:EnterpriseProjectId	functiongraph:function:list
functiongraph::deleteFunctionApp	Grants permission to delete an application.	Write	-	g:EnterpriseProjectId	functiongraph:function:delete
functiongraph::getFunctionApp	Grants permission to query details about an application.	Read	-	g:EnterpriseProjectId	functiongraph:function:list
functiongraph::listFunctionApps	Grants permission to list applications.	List	-	g:EnterpriseProjectId	functiongraph:function:list
functiongraph::listFunctionAppTemplates	Grants permission to list application templates.	List	-	g:EnterpriseProjectId	functiongraph:function:list
functiongraph::createVpcEndpoint	Grants permission to create a VPC endpoint.	Write	-	g:EnterpriseProjectId	functiongraph:function:updateConfig
functiongraph::deleteVpcEndpoint	Grants permission to delete a VPC endpoint.	Write	-	g:EnterpriseProjectId	functiongraph:function:delete
functiongraph:function:export	Grants permission to export a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph:function:import	Grants permission to import a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:create
functiongraph::exportPackage	Grants permission to export a function application.	Read	-	g:EnterpriseProjectId	functiongraph:function:list
functiongraph::importPackage	Grants permission to import a function application.	Write	-	g:EnterpriseProjectId	functiongraph:function:create
functiongraph:function:createVersion	Grants permission to publish a function version.	Write	function *	g:EnterpriseProjectId	-
functiongraph:function:listVersion	Grants permission to list the versions of a function.	List	function *	g:EnterpriseProjectId	-
functiongraph:function:createAlias	Grants permission to create an alias for a function's additional version.	Write	function *	g:EnterpriseProjectId	-
functiongraph:function:deleteAlias	Grants permission to delete an alias of a function version.	Write	function *	g:EnterpriseProjectId	-
functiongraph:function:listAlias	Grants permission to list the versions and aliases of a function.	List	function *	g:EnterpriseProjectId	-
functiongraph:function:getAlias	Grants permission to query an alias of a function version.	Read	function *	g:EnterpriseProjectId	-
functiongraph:function:updateAlias	Grants permission to modify an alias of a function version.	Write	function *	g:EnterpriseProjectId	-
functiongraph::listQuota	Grants permission to query tenant quotas.	List	-	-	functiongraph:function:list
functiongraph:dependency:createDependency	Grants permission to create a dependency.	Write	-	-	functiongraph:function:create
functiongraph:dependency:deleteDependency	Grants permission to delete a dependency.	Write	-	-	functiongraph:function:delete
functiongraph:dependency:listDependencies	Grants permission to list the dependencies.	List	-	-	functiongraph:function:list
functiongraph:dependency:getDependency	Grants permission to query a dependency.	Read	-	-	functiongraph:function:getcode
functiongraph:dependency:updateDependency	Grants permission to update a dependency.	Write	-	-	functiongraph:function:updatecode
functiongraph:dependency:createDependencyVersion	Grants permission to create a dependency version.	Write	-	-	functiongraph:function:create
functiongraph:dependency:deleteDependencyVersion	Grants permission to delete a dependency version.	Write	-	-	functiongraph:function:delete
functiongraph:dependency:listDependencyVersion	Grants permission to list the versions of a dependency.	List	-	-	functiongraph:function:list
functiongraph:dependency:getDependencyVersion	Grants permission to query details about a dependency version.	Read	-	-	functiongraph:function:getcode
functiongraph:function:createEvent	Grants permission to create a test event.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:function:deleteEvent	Grants permission to delete a test event.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:function:updateEvent	Grants permission to update a test event.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:function:listEvent	Grants permission to list the test events of a function.	List	function *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:function:getEvent	Grants permission to query details about a test event of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:function:getTracing	Grants permission to query the tracing configurations of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:create
functiongraph:function:updateTracing	Grants permission to update the tracing configurations of a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:create
functiongraph::listFunctionByMetric	Grants permission to query functions for a specified metric.	List	-	-	functiongraph:function:list
functiongraph:function:listFunctionStatistics	Grants permission to query metrics of a function in a specified period.	List	function *	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph::listStatistics	Grants permission to query function statistics.	List	-	-	functiongraph:function:getconfig
functiongraph:function:getReservedInstanceMetrics	Grants permission to query the reserved instance usage of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph::enableLtsLogs	Grants permission to enable log reporting to LTS.	Write	-	-	functiongraph:function:create
functiongraph:function:getLtsLogConfiguration	Grants permission to query the LTS log group and stream settings of a function.	Read	function *	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph:function:updateReservedInstanceCount	Grants permission to change the number of reserved instances of a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateconfig
functiongraph::listReservedInstanceCount	Grants permission to query the number of reserved instances of a function.	List	-	-	functiongraph:function:getconfig
functiongraph::listReservedInstanceConfig	Grants permission to query the reserved instance configurations of a function.	List	function	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph::getReservedInstanceState	Grants permission to query the status of reserved instances of a function.	Read	-	-	functiongraph:function:getconfig
functiongraph:function:invokeAsync	Grants permission to execute a function asynchronously.	Write	function *	g:EnterpriseProjectId	-
functiongraph:function:invokeSync	Grants permission to execute a function synchronously.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:function:invokeReservedFunctionAsync	Grants permission to execute a function asynchronously and return reserved instance IDs.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invokeasync
functiongraph:function:stopAsyncInvoke	Grants permission to stop an asynchronous invocation request of a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:invokeasync
functiongraph:function:listAsyncInvocation	Grants permission to query asynchronous invocation requests of a function.	List	function *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:function:deleteAsyncInvokeConfig	Grants permission to delete the asynchronous invocation settings of a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:delete
functiongraph:function:updateAsyncInvokeConfig	Grants permission to configure asynchronous invocation settings for a function.	Write	function *	g:EnterpriseProjectId	functiongraph:function:updateconfig
functiongraph:function:listAsyncInvokeConfig	Grants permission to query the asynchronous invocation settings of a function's all versions.	List	function *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:function:getAsyncInvokeConfig	Grants permission to query the asynchronous invocation setting of a function version.	Read	function *	g:EnterpriseProjectId	functiongraph:function:getconfig
functiongraph::updateAsyncStatusLog	Grants permission to enable asynchronous notification.	Write	-	-	functiongraph:function:create
functiongraph::getAsyncStatusLogInfo	Grants permission to query details about asynchronous invocation logs.	Read	-	-	functiongraph:function:getConfig
functiongraph:function:listActiveAsyncInvocations	Grants permission to query active asynchronous invocation requests of a function.	List	function *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:trigger:createTrigger	Grants permission to create a trigger.	Write	function *	g:EnterpriseProjectId	functiongraph:trigger:create
functiongraph:trigger:delete	Grants permission to delete a trigger.	Write	trigger *	g:EnterpriseProjectId	-
functiongraph:trigger:update	Grants permission to update a trigger.	Write	function *	g:EnterpriseProjectId	functiongraph:trigger:create
functiongraph:trigger:list	Grants permission to list all triggers of a function.	List	function *	g:EnterpriseProjectId	functiongraph:trigger:listSpecifiedFunctionTriggers
functiongraph:trigger:get	Grants permission to query a trigger.	Read	trigger *	g:EnterpriseProjectId	-
functiongraph:trigger:batchDelete	Grants permission to delete all triggers of a function.	Write	function *	g:EnterpriseProjectId	functiongraph:trigger:deleteSpecifiedFunctionTriggers
functiongraph::listObsNotifications	Grants permission to query all notification settings of an OBS bucket.	Read	-	-	functiongraph:trigger:create
functiongraph::listObsBucket	Grants permission to list the OBS buckets.	List	-	-	functiongraph:trigger:listSpecifiedFunctionTriggers
functiongraph:workflow:create	Grants permission to create a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:create
functiongraph:workflow:delete	Grants permission to delete a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:delete
functiongraph:workflow:update	Grants permission to modify the instance metadata of a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:create
functiongraph:workflow:list	Grants permission to query a function flow.	List	workflow *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:workflow:getConfig	Grants permission to query the instance metadata of a function flow.	Read	workflow *	g:EnterpriseProjectId	functiongraph:function:getConfig
functiongraph:workflow:invoke	Grants permission to execute a function flow asynchronously.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:workflow:invokeSync	Grants permission to execute a function flow synchronously.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:workflow:terminate	Grants permission to stop a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:workflow:retry	Grants permission to retry a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:workflow:listExecutions	Grants permission to list the instances of a function flow.	List	workflow *	g:EnterpriseProjectId	functiongraph:function:list
functiongraph:workflow:getExecutionDetail	Grants permission to query a function flow instance.	Read	workflow *	g:EnterpriseProjectId	functiongraph:function:getConfig
functiongraph:workflow:getMetric	Grants permission to query the metrics of a function flow.	Read	workflow *	g:EnterpriseProjectId	functiongraph:function:getConfig
functiongraph:workflow:listMetrics	Grants permission to query function flow metrics.	List	-	-	functiongraph:function:getConfig
functiongraph:workflow:downloadOutput	Grants permission to download the node execution results of a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:getConfig
functiongraph:workflow:cancel	Grants permission to stop executing a function flow.	Write	workflow *	g:EnterpriseProjectId	functiongraph:function:invoke
functiongraph:workflow:metadata	Grants permission to query the metadata of a function flow.	List	-	-	functiongraph:function:list

Each API usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by FunctionGraph APIs
API	Action	Dependency
POST /v2/{project_id}/fgs/functions	functiongraph:function:createFunction	lts:groups:list lts:groups:create lts:logstreams:list lts:structConfig:create obs:object:GetObject
DELETE /v2/{project_id}/fgs/functions/{function_urn}	functiongraph:function:deleteFunction	functiongraph:trigger:batchDelete lts:groups:list lts:logstreams:list lts:logstreams:delete
PUT /v2/{project_id}/fgs/functions/{function_urn}/config	functiongraph:function:updateFunctionConfig	lts:groups:list lts:groups:create lts:logstreams:list lts:structConfig:create
PUT /v2/{project_id}/fgs/functions/{function_urn}/code	functiongraph:function:updateFunctionCode	obs:object:GetObject
GET /v2/{project_id}/fgs/functions	functiongraph:function:listFunctions	-
GET /v2/{project_id}/fgs/functions/{function_urn}/config	functiongraph:function:getFunctionConfig	-
GET /v2/{project_id}/fgs/functions/{function_urn}/code	functiongraph:function:getFunctionCode	-
GET /v2/{project_id}/fgs/public-network-bandwidth	functiongraph::getPublicNetworkBandwidth	-
GET /v2/{project_id}/fgs/resource-usage	functiongraph::getTenantResourceUsage	-
POST /v2/{project_id}/fgs/functions/{function_urn}/command	functiongraph::function:createTenantCommanmd	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/config-max-instance	functiongraph:function:updateMaxInstanceConfig	-
POST /v2/{project_id}/fgs/functions/{function_urn}/snapshots/{action}	functiongraph:function:updateSnapshot	-
POST /v2/{project_id}/fgs/functions/{function_urn}/function-url	functiongraph:function:createUrl	-
DELETE /v2/{project_id}/fgs/functions/{function_urn}/function-url	functiongraph:function:deleteUrl	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/function-url	functiongraph:function:updateUrl	-
GET /v2/{project_id}/fgs/functions/{function_urn}/function-url	functiongraph:function:getUrl	-
POST /v2/{project_id}/{resource_type}/resource-instances/{action}	functiongraph::getResourceInstance	-
POST /v2/{project_id}/{resource_type}/{resource_id}/tags/create	functiongraph::createTag	-
DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/delete	functiongraph::deleteTag	-
GET /v2/{project_id}/{resource_type}/tags	functiongraph::listTags	-
POST /v2/{project_id}/fgs/applications	functiongraph::createFunctionApp	-
DELETE /v2/{project_id}/fgs/applications/{id}	functiongraph::deleteFunctionApp	-
GET /v2/{project_id}/fgs/applications/{id}	functiongraph::getFunctionApp	-
GET /v2/{project_id}/fgs/applications	functiongraph::listFunctionApps	-
GET /v2/{project_id}/fgs/application/templates	functiongraph::listFunctionAppTemplates	-
POST /v2/{project_id}/fgs/vpc-endpoint	functiongraph::createVpcEndpoint	-
DELETE /v2/{project_id}/fgs/vpc-endpoint/{vpc_id}/{subnet_id}	functiongraph::deleteVpcEndpoint	-
GET /v2/{project_id}/fgs/functions/{func_urn}/download	functiongraph:function:getFunctionCode	-
GET /v2/{project_id}/fgs/admins/sysconfig	functiongraph:function:getFunctionConfig	-
GET /v2/{project_id}/fgs/domainname/vpc/{vpc_id}	functiongraph:function:getFunctionConfig	dns:zone:list
GET /v2/{project_id}/fgs/functions/{function_urn}/servicebridge/relation	functiongraph:function:listFunctions	-
POST /v2/{project_id}/fgs/packages	functiongraph:function:createFunction	-
DELETE /v2/{project_id}/fgs/packages/{package_name}	functiongraph:function:deleteFunction	-
PUT /v2/{project_id}/fgs/packages/{package_name}	functiongraph:function:createFunction	-
GET /v2/{project_id}/fgs/packages	functiongraph:function:listFunctions	-
PUT /v2/{project_id}/fgs/functions/{func_urn}/collect/{state}	functiongraph:function:updateFunctionConfig	-
GET /v2/{project_id}/fgs/template-labels	functiongraph:function:listFunctions	-
GET /v2/fgs/template-labels	functiongraph:function:listFunctions	-
GET /v2/{project_id}/fgs/templates	functiongraph:function:listFunctions	-
GET /v2/{project_id}/fgs/templates/{template_id}	functiongraph:function:listFunctions	-
GET /v2/fgs/runtimetypes	functiongraph:function:listFunctions	-
GET /v2/fgs/service-trusted-agencies	functiongraph:function:getFunctionConfig	-
GET /v2/{project_id}/fgs/feature	functiongraph:function:getFunctionConfig	-
POST /v2/{project_id}/fgs/agc/agency/{agency_name}	functiongraph:function:createFunction	-
POST /v2/{project_id}/fgs/functions/enable-async-status-logs	functiongraph::updateAsyncStatusLog	lts:groups:list lts:groups:create lts:logstreams:list lts:structConfig:create
GET /v2/{project_id}/fgs/functions/async-status-log-detail	functiongraph::getAsyncStatusLogInfo	-
GET /v2/{project_id}/fgs/functions/{function_urn}/active-async-invocations	functiongraph:function:listActiveAsyncInvocations	-
GET /v2/{project_id}/fgs/functions/{function_urn}/export	functiongraph:function:export	-
POST /v2/{project_id}/fgs/functions/import	functiongraph:function:import	-
GET /v2/{project_id}/fgs/packages/{package_name}/export	functiongraph::exportPackage	-
POST /v2/{project_id}/fgs/packages/import	functiongraph::importPackage	-
POST /v2/{project_id}/fgs/functions/{function_urn}/versions	functiongraph:function:createVersion	-
GET /v2/{project_id}/fgs/functions/{function_urn}/versions	functiongraph:function:listVersion	-
POST /v2/{project_id}/fgs/functions/{function_urn}/aliases	functiongraph:function:createAlias	-
DELETE /v2/{project_id}/fgs/functions/{function_urn}/aliases/{alias_name}	functiongraph:function:deleteAlias	functiongraph:trigger:list
PUT /v2/{project_id}/fgs/functions/{function_urn}/aliases/{alias_name}	functiongraph:function:updateAlias	-
GET /v2/{project_id}/fgs/functions/{function_urn}/aliases	functiongraph:function:listAlias	-
GET /v2/{project_id}/fgs/functions/{function_urn}/aliases/{alias_name}	functiongraph:function:getAlias	-
POST /v2/{project_id}/fgs/dependencies	functiongraph:dependency:createDependency	obs:object:GetObject
DELETE /v2/{project_id}/fgs/dependencies/{depend_id}	functiongraph:dependency:deleteDependency	-
PUT /v2/{project_id}/fgs/dependencies/{depend_id}	functiongraph:dependency:updateDependency	obs:object:GetObject
GET /v2/{project_id}/fgs/dependencies	functiongraph:dependency:listDependencies	-
GET /v2/{project_id}/fgs/dependencies/{depend_id}	functiongraph:dependency:getDependency	-
POST /v2/{project_id}/fgs/dependencies/version	functiongraph:dependency:createDependencyVersion	obs:object:GetObject
DELETE /v2/{project_id}/fgs/dependencies/{depend_id}/version/{version}	functiongraph:dependency:deleteDependencyVersion	-
GET /v2/{project_id}/fgs/dependencies/{depend_id}/version	functiongraph:dependency:listDependencyVersion	-
GET /v2/{project_id}/fgs/dependencies/{depend_id}/version/{version}	functiongraph:dependency:getDependencyVersion	-
POST /v2/{project_id}/fgs/functions/{function_urn}/events	functiongraph:function:createEvent	-
DELETE /v2/{project_id}/fgs/functions/{function_urn}/events/{event_id}	functiongraph:function:deleteEvent	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/events/{event_id}	functiongraph:function:updateEvent	-
GET /v2/{project_id}/fgs/functions/{function_urn}/events	functiongraph:function:listEvent	-
GET /v2/{project_id}/fgs/functions/{function_urn}/events/{event_id}	functiongraph:function:getEvent	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/tracing	functiongraph:function:updateTracing	-
GET /v2/{project_id}/fgs/functions/{function_urn}/tracing	functiongraph:function:getTracing	-
GET /v2/{project_id}/fgs/function/report	functiongraph::listFunctionByMetric	aom:metric:get aom:metric:list
GET /v2/{project_id}/fgs/functions/statistics	functiongraph::listStatistics	aom:metric:get
POST /v2/{project_id}/fgs/functions/enable-lts-logs	functiongraph::enableLtsLogs	lts:groups:list lts:groups:create lts:logstreams:list lts:structConfig:create
GET /v2/{project_id}/fgs/functions/{function_urn}/lts-log-detail	functiongraph:function:getLtsLogConfiguration	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/reservedinstances	functiongraph:function:updateReservedInstanceCount	-
GET /v2/{project_id}/fgs/functions/reservedinstances	functiongraph::listReservedInstanceCount	-
GET /v2/{project_id}/fgs/functions/reservedinstanceconfigs	functiongraph::listReservedInstanceConfig	-
GET /v2/{project_id}/fgs/functions/reservedinstances/state	functiongraph::getReservedInstanceState	-
POST /v2/{project_id}/fgs/functions/{function_urn}/cancel	functiongraph:function:stopAsyncInvoke	lts:structConfig:get
GET /v2/{project_id}/fgs/functions/{function_urn}/async-invocations	functiongraph:function:listAsyncInvocation	lts:structConfig:get lts:logStream:searchStructLog
DELETE /v2/{project_id}/fgs/functions/{function_urn}/async-invoke-config	functiongraph:function:deleteAsyncInvokeConfig	-
PUT /v2/{project_id}/fgs/functions/{function_urn}/async-invoke-config	functiongraph:function:updateAsyncInvokeConfig	-
GET /v2/{project_id}/fgs/functions/{function_urn}/async-invoke-configs	functiongraph:function:listAsyncInvokeConfig	-
GET /v2/{project_id}/fgs/functions/{function_urn}/async-invoke-config	functiongraph:function:getAsyncInvokeConfig	-
POST /v2/{project_id}/fgs/servicebridge	functiongraph:bridge:createServiceBridge	-
DELETE /v2/{project_id}/fgs/servicebridge/{bridge_name}	functiongraph:bridge:deleteServiceBridge	-
PUT /v2/{project_id}/fgs/servicebridge/{bridge_name}/config	functiongraph:bridge:updateServiceBridgeConfig	-
GET /v2/{project_id}/fgs/servicebridge	functiongraph:bridge:listServiceBridges	-
GET /v2/{project_id}/fgs/servicebridge/{bridge_name}/config	functiongraph:bridge:getServiceBridgeConfig	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for FunctionGraph.

**Table 3** Supported resource types
Resource Type	URN
workflow	functiongraph:<region>:<account-id>:workflow:<workflow-id>
function	functiongraph:<region>:<account-id>:function:<package-name>/<function-name>
trigger	functiongraph:<region>:<account-id>:trigger:<trigger-id>