Virtual Private Cloud

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by vpc, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by vpc, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for vpc.

**Table 1** Actions supported by vpc
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
vpc:vpcs:create	Grants permission to create vpc.	Write	vpc *	-	-
vpc:vpcs:create	Grants permission to create vpc.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys vpc:VpcBlockServiceEndpointStates	-
vpc:vpcs:get	Grants permission to get vpc.	Read	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	-
vpc:vpcs:list	Grants permission to list vpc.	List	vpc *	-	-
vpc:vpcs:list	Grants permission to list vpc.	List	-	g:EnterpriseProjectId	-
vpc:vpcs:update	Grants permission to update vpc.	Write	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	-
vpc:vpcs:update	Grants permission to update vpc.	Write	-	vpc:VpcBlockServiceEndpointStates	-
vpc:vpcs:delete	Grants permission to delete vpc.	Write	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	-
vpc:subnets:create	Grants permission to create subnet.	Write	subnet *	-	-
			vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId
			-	vpc:AvailabilityZone vpc:SubnetIpv6Enable g:RequestTag/<tag-key> g:TagKeys
vpc:subnets:get	Grants permission to get subnet.	Read	subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId	-
vpc:subnets:list	Grants permission to list subnets.	List	subnet *	-	vpc:subnets:get
vpc:subnets:list	Grants permission to list subnets.	List	-	g:EnterpriseProjectId	vpc:subnets:get
vpc:subnets:update	Grants permission to update subnet.	Write	subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId	-
vpc:subnets:update	Grants permission to update subnet.	Write	-	vpc:SubnetIpv6Enable	-
vpc:subnets:delete	Grants permission to delete subnet.	Write	subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId	-
vpc:subnets:createReservation	Grants permission to create a subnet cidr reservation.	Write	subnet *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
vpc:subnets:getReservation	Grants permission to get a subnet cidr reservation.	Read	subnet *	g:ResourceTag/<tag-key> vpc:VirsubnetCidrReservationId g:EnterpriseProjectId	-
vpc:subnets:listReservations	Grants permission to list subnet cidr reservation.	List	subnet *	-	-
vpc:subnets:listReservations	Grants permission to list subnet cidr reservation.	List	-	g:EnterpriseProjectId	-
vpc:subnets:updateReservation	Grants permission to update a subnet cidr reservation.	Write	subnet *	g:ResourceTag/<tag-key> vpc:VirsubnetCidrReservationId g:EnterpriseProjectId	-
vpc:subnets:deleteReservation	Grants permission to delete a subnet cidr reservation.	Write	subnet *	g:ResourceTag/<tag-key> vpc:VirsubnetCidrReservationId g:EnterpriseProjectId	-
vpc:quotas:list	Grants permission to list quotas.	List	-	-	vpc:quotas:get
vpc:privateIps:create	Grants permission to create private.	Write	privateIp *	-	-
vpc:privateIps:create	Grants permission to create private.	Write	subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone	-
vpc:privateIps:get	Grants permission to get privateIp.	Read	privateIp *	vpc:PrivateIpId vpc:SubnetId vpc:VpcId	-
vpc:privateIps:list	Grants permission to list privateIp.	List	privateIp *	-	-
vpc:privateIps:delete	Grants permission to delete privateIp.	Write	privateIp *	vpc:PrivateIpId vpc:SubnetId vpc:VpcId	-
vpc:securityGroups:create	Grants permission to create securityGroup.	Write	securityGroup *	-	-
			securityGroupRule	vpc:SecurityGroupRuleDirection vpc:SecurityGroupRuleProtocol vpc:SecurityGroupRuleAction vpc:SecurityGroupRulePort vpc:SecurityGroupRuleRemoteIpAddressGroup vpc:SecurityGroupRuleRemoteSecurityGroup vpc:SecurityGroupRuleRemoteIpPrefix
			-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
vpc:securityGroups:get	Grants permission to get securityGroup.	Read	securityGroup *	g:EnterpriseProjectId vpc:SecurityGroupId g:ResourceTag/<tag-key>	-
vpc:securityGroups:list	Grants permission to list securityGroups.	List	securityGroup *	-	vpc:securityGroups:get
vpc:securityGroups:list	Grants permission to list securityGroups.	List	-	g:EnterpriseProjectId	vpc:securityGroups:get
vpc:securityGroups:update	Grants permission to update securityGroup.	Write	securityGroup *	g:EnterpriseProjectId vpc:SecurityGroupId g:ResourceTag/<tag-key>	-
vpc:securityGroups:delete	Grants permission to delete securityGroup.	Write	securityGroup *	g:EnterpriseProjectId vpc:SecurityGroupId g:ResourceTag/<tag-key>	-
vpc:securityGroupRules:create	Grants permission to create securityGroupRule.	Write	securityGroupRule *	vpc:SecurityGroupRuleDirection vpc:SecurityGroupRuleProtocol vpc:SecurityGroupRuleAction vpc:SecurityGroupRulePort vpc:SecurityGroupRuleRemoteIpAddressGroup vpc:SecurityGroupRuleRemoteSecurityGroup vpc:SecurityGroupRuleRemoteIpPrefix	-
vpc:securityGroupRules:create	Grants permission to create securityGroupRule.	Write	securityGroup *	g:EnterpriseProjectId vpc:SecurityGroupId g:ResourceTag/<tag-key>	-
vpc:securityGroupRules:get	Grants permission to get securityGroupRule.	Read	securityGroupRule *	g:EnterpriseProjectId vpc:SecurityGroupId	-
vpc:securityGroupRules:list	Grants permission to list securityGroupRules.	List	-	g:EnterpriseProjectId	vpc:securityGroupRules:get
vpc:securityGroupRules:update	Grants permission to update securityGroupRule.	Write	securityGroupRule *	g:EnterpriseProjectId vpc:SecurityGroupId	-
vpc:securityGroupRules:update	Grants permission to update securityGroupRule.	Write	-	vpc:SecurityGroupRuleDirection vpc:SecurityGroupRuleProtocol vpc:SecurityGroupRuleAction vpc:SecurityGroupRulePort vpc:SecurityGroupRuleRemoteIpAddressGroup vpc:SecurityGroupRuleRemoteSecurityGroup vpc:SecurityGroupRuleRemoteIpPrefix	-
vpc:securityGroupRules:delete	Grants permission to delete securityGroupRule.	Write	securityGroupRule *	g:EnterpriseProjectId vpc:SecurityGroupId	-
vpc:ports:create	Grants permission to create port.	Write	port *	-	-
			subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId
			-	g:RequestTag/<tag-key> g:TagKeys
vpc:ports:get	Grants permission to get port.	Read	port *	vpc:SubnetId vpc:PortId vpc:VpcId g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
vpc:ports:list	Grants permission to list ports.	List	port *	-	vpc:ports:get
vpc:ports:list	Grants permission to list ports.	List	-	g:EnterpriseProjectId	vpc:ports:get
vpc:ports:update	Grants permission to update port.	Write	port *	vpc:SubnetId vpc:PortId vpc:VpcId g:EnterpriseProjectId g:ResourceTag/<tag-key>	vpc:vips:update
vpc:ports:delete	Grants permission to delete port.	Write	port *	vpc:SubnetId vpc:PortId vpc:VpcId g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
vpc:peerings:create	Grants permission to create peering.	Write	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:AccepterVpcOrgPath vpc:AccepterVpcOwner	-
vpc:peerings:create	Grants permission to create peering.	Write	vpc *	g:ResourceTag/<tag-key> vpc:VpcId	-
vpc:peerings:get	Grants permission to get peering.	Read	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:PeeringId	-
vpc:peerings:list	Grants permission to list peerings.	List	peering *	-	vpc:peerings:get
vpc:peerings:accept	Grants permission to accept peering.	Write	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:PeeringId vpc:RequesterVpcOrgPath vpc:RequesterVpcOwner	-
vpc:peerings:reject	Grants permission to reject peering.	Write	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:PeeringId	-
vpc:peerings:update	Grants permission to update peering.	Write	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:PeeringId	-
vpc:peerings:delete	Grants permission to delete peering.	Write	peering *	vpc:AccepterVpcId vpc:RequesterVpcId vpc:PeeringId	-
vpc:routeTables:create	Grants permission to create routeTable.	Write	routeTable *	-	-
vpc:routeTables:create	Grants permission to create routeTable.	Write	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	-
vpc:routeTables:get	Grants permission to get routeTable.	Read	routeTable *	vpc:RouteTableId vpc:VpcId g:EnterpriseProjectId	-
vpc:routeTables:list	Grants permission to list routeTables.	List	routeTable *	-	-
vpc:routeTables:list	Grants permission to list routeTables.	List	-	g:EnterpriseProjectId	-
vpc:routeTables:update	Grants permission to update routeTable.	Write	routeTable *	vpc:RouteTableId vpc:VpcId g:EnterpriseProjectId	-
vpc:routeTables:associate	Grants permission to associate a routeTable.	Write	routeTable *	vpc:RouteTableId vpc:VpcId	-
vpc:routeTables:associate	Grants permission to associate a routeTable.	Write	subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId	-
vpc:routeTables:delete	Grants permission to delete routeTable.	Write	routeTable *	vpc:RouteTableId vpc:VpcId g:EnterpriseProjectId	-
vpc:flowLogs:create	Grants permission to create flowLog.	Write	flowLog *	-	-
			port	vpc:PortId vpc:SubnetId vpc:VpcId
			subnet	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone
			vpc	g:ResourceTag/<tag-key> vpc:VpcId
			-	vpc:FlogLogResourceType
vpc:flowLogs:get	Grants permission to get flowLog.	Read	flowLog *	vpc:FlowLogId vpc:FlogLogResourceType	-
vpc:flowLogs:list	Grants permission to list flowLog.	List	flowLog *	-	vpc:flowLogs:get
vpc:flowLogs:update	Grants permission to update flowLog.	Write	flowLog *	vpc:FlowLogId vpc:FlogLogResourceType	-
vpc:flowLogs:delete	Grants permission to delete flowLog.	Write	flowLog *	vpc:FlowLogId vpc:FlogLogResourceType	-
vpc:addressGroups:create	Grants permission to create addressGroup.	Write	addressGroup *	-	-
vpc:addressGroups:create	Grants permission to create addressGroup.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
vpc:addressGroups:get	Grants permission to get addressGroup.	Read	addressGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:AddressGroupId	-
vpc:addressGroups:list	Grants permission to list addressGroup.	List	addressGroup *	-	-
vpc:addressGroups:list	Grants permission to list addressGroup.	List	-	g:EnterpriseProjectId	-
vpc:addressGroups:update	Grants permission to update addressGroup.	Write	addressGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:AddressGroupId	-
vpc:addressGroups:delete	Grants permission to delete addressGroup.	Write	addressGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:AddressGroupId	-
vpc:firewalls:create	Grants permission to create firewall.	Write	firewall *	-	-
vpc:firewalls:create	Grants permission to create firewall.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
vpc:firewalls:get	Grants permission to get firewall.	Read	firewall *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:FirewallId	-
vpc:firewalls:list	Grants permission to list firewall.	List	firewall *	-	-
vpc:firewalls:list	Grants permission to list firewall.	List	-	g:EnterpriseProjectId	-
vpc:firewalls:update	Grants permission to update firewall.	Write	firewall *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:FirewallId vpc:FirewallRuleDirection vpc:FirewallRuleProtocol vpc:FirewallRuleAction vpc:FirewallRuleSourcePort vpc:FirewallRuleDestinationPort vpc:FirewallOperationType vpc:FirewallRuleSourceIp vpc:FirewallRuleSourceIpAddressGroup vpc:FirewallRuleDestinationIp vpc:FirewallRuleDestinationIpAddressGroup	-
vpc:firewalls:update	Grants permission to update firewall.	Write	subnet	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone g:EnterpriseProjectId	-
vpc:firewalls:delete	Grants permission to delete firewall.	Write	firewall *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:FirewallId	-
vpc:vpcs:createTags	Grants permission to create a tag for an vpc.	Tagging	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	vpc:vpcTags:create
vpc:vpcs:createTags	Grants permission to create a tag for an vpc.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:vpcTags:create
vpc:vpcs:listTags	Grants permission to query tags of a specified vpc.	List	vpc *	-	vpc:vpcTags:get
vpc:vpcs:deleteTags	Grants permission to delete an vpc tag.	Tagging	vpc *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId	vpc:vpcTags:delete
vpc:vpcs:deleteTags	Grants permission to delete an vpc tag.	Tagging	-	g:TagKeys	vpc:vpcTags:delete
vpc:subnets:createTags	Grants permission to create a tag for an subnet.	Tagging	subnet *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId vpc:SubnetId vpc:AvailabilityZone	vpc:subnetTags:create
vpc:subnets:createTags	Grants permission to create a tag for an subnet.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:subnetTags:create
vpc:subnets:listTags	Grants permission to query tags of a specified subnet.	List	subnet *	-	vpc:subnetTags:get
vpc:subnets:deleteTags	Grants permission to delete an subnet tag.	Tagging	subnet *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:VpcId vpc:SubnetId vpc:AvailabilityZone	vpc:subnetTags:delete
vpc:subnets:deleteTags	Grants permission to delete an subnet tag.	Tagging	-	g:TagKeys	vpc:subnetTags:delete
vpc:addressGroups:createTags	Grants permission to create a tag for an addressGroup.	Tagging	addressGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:AddressGroupId	vpc:addressGroupTags:create
vpc:addressGroups:createTags	Grants permission to create a tag for an addressGroup.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:addressGroupTags:create
vpc:addressGroups:listTags	Grants permission to query tags of a specified addressGroup.	List	addressGroup *	-	vpc:addressGroupTags:get
vpc:addressGroups:deleteTags	Grants permission to delete an addressGroup tag.	Tagging	addressGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:AddressGroupId	vpc:addressGroupTags:delete
vpc:addressGroups:deleteTags	Grants permission to delete an addressGroup tag.	Tagging	-	g:TagKeys	vpc:addressGroupTags:delete
vpc:securityGroups:createTags	Grants permission to create a tag for a securityGroup.	Tagging	securityGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SecurityGroupId	vpc:securityGroupTags:create
vpc:securityGroups:createTags	Grants permission to create a tag for a securityGroup.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:securityGroupTags:create
vpc:securityGroups:listTags	Grants permission to query tags of a specified securityGroup.	List	securityGroup *	-	vpc:securityGroupTags:get
vpc:securityGroups:deleteTags	Grants permission to delete a securityGroup tag.	Tagging	securityGroup *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SecurityGroupId	vpc:securityGroupTags:delete
vpc:securityGroups:deleteTags	Grants permission to delete a securityGroup tag.	Tagging	-	g:TagKeys	vpc:securityGroupTags:delete
vpc:firewalls:createTags	Grants permission to create a tag for a firewall.	Tagging	firewall *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:FirewallId	vpc:firewallTags:create
vpc:firewalls:createTags	Grants permission to create a tag for a firewall.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:firewallTags:create
vpc:firewalls:listTags	Grants permission to query tags of a specified firewall.	List	firewall *	-	vpc:firewallTags:get
vpc:firewalls:deleteTags	Grants permission to delete an firewall tag.	Tagging	firewall *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:FirewallId	vpc:firewallTags:delete
vpc:firewalls:deleteTags	Grants permission to delete an firewall tag.	Tagging	-	g:TagKeys	vpc:firewallTags:delete
vpc:subNetworkInterfaces:createTags	Grants permission to create a tag for a subNetworkInterface.	Tagging	subNetworkInterface *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SubNetworkInterfaceId vpc:SubnetId vpc:VpcId	vpc:subNetworkInterfaceTags:create
vpc:subNetworkInterfaces:createTags		Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:subNetworkInterfaceTags:create
vpc:subNetworkInterfaces:listTags	Grants permission to query tags of a specified subNetworkInterface.	List	subNetworkInterface *	-	vpc:subNetworkInterfaceTags:get
vpc:subNetworkInterfaces:deleteTags	Grants permission to delete a subNetworkInterface tag.	Tagging	subNetworkInterface *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SubNetworkInterfaceId vpc:SubnetId vpc:VpcId	vpc:subNetworkInterfaceTags:delete
vpc:subNetworkInterfaces:deleteTags	Grants permission to delete a subNetworkInterface tag.	Tagging	-	g:TagKeys	vpc:subNetworkInterfaceTags:delete
vpc:ports:createTags	Grants permission to create a tag for a port.	Tagging	port *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:PortId vpc:SubnetId vpc:VpcId	vpc:portTags:create
vpc:ports:createTags	Grants permission to create a tag for a port.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	vpc:portTags:create
vpc:ports:listTags	Grants permission to query tags of a specified port.	List	port *	-	vpc:portTags:get
vpc:ports:deleteTags	Grants permission to delete a port tag.	Tagging	port *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:PortId vpc:SubnetId vpc:VpcId	vpc:portTags:delete
vpc:ports:deleteTags	Grants permission to delete a port tag.	Tagging	-	g:TagKeys	vpc:portTags:delete
vpc:subNetworkInterfaces:create	Grants permission to create subNetworkInterface.	Write	subNetworkInterface *	-	-
			subnet *	g:ResourceTag/<tag-key> vpc:SubnetId vpc:VpcId vpc:AvailabilityZone
			-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
vpc:subNetworkInterfaces:get	Grants permission to get subNetworkInterface.	Read	subNetworkInterface *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SubnetId vpc:SubNetworkInterfaceId vpc:VpcId	-
vpc:subNetworkInterfaces:list	Grants permission to list subNetworkInterface.	List	subNetworkInterface *	-	-
vpc:subNetworkInterfaces:list	Grants permission to list subNetworkInterface.	List	-	g:EnterpriseProjectId	-
vpc:subNetworkInterfaces:update	Grants permission to update subNetworkInterface.	Write	subNetworkInterface *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SubnetId vpc:SubNetworkInterfaceId vpc:VpcId	-
vpc:subNetworkInterfaces:delete	Grants permission to delete subNetworkInterface.	Write	subNetworkInterface *	g:EnterpriseProjectId g:ResourceTag/<tag-key> vpc:SubnetId vpc:SubNetworkInterfaceId vpc:VpcId	-
vpc:networks:create	Grants permission to create network.	Write	network *	-	-
vpc:networks:get	Grants permission to get network.	Read	network *	-	-
vpc:networks:list	Grants permission to list network.	List	network *	-	vpc:networks:get
vpc:networks:update	Grants permission to update network.	Write	network *	-	-
vpc:networks:delete	Grants permission to delete network.	Write	addressGroup *	-	-
vpc:trafficMirrorFilters:create	Grants permission to create trafficMirrorFilter.	Write	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilters:get	Grants permission to get trafficMirrorFilter.	Read	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilters:list	Grants permission to list trafficMirrorFilter.	List	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilters:update	Grants permission to update trafficMirrorFilter.	Write	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilters:delete	Grants permission to delete trafficMirrorFilter.	Write	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilterRules:create	Grants permission to create trafficMirrorFilterRule.	Write	trafficMirrorFilter *	-	-
vpc:trafficMirrorFilterRules:create	Grants permission to create trafficMirrorFilterRule.	Write	trafficMirrorFilterRule *	-	-
vpc:trafficMirrorFilterRules:get	Grants permission to get trafficMirrorFilterRule.	Read	trafficMirrorFilterRule *	vpc:TrafficMirrorFilterId	-
vpc:trafficMirrorFilterRules:list	Grants permission to list trafficMirrorFilterRule.	List	trafficMirrorFilterRule *	-	-
vpc:trafficMirrorFilterRules:update	Grants permission to update trafficMirrorFilterRule.	Write	trafficMirrorFilterRule *	vpc:TrafficMirrorFilterId	-
vpc:trafficMirrorFilterRules:delete	Grants permission to delete trafficMirrorFilterRule.	Write	trafficMirrorFilterRule *	vpc:TrafficMirrorFilterId	-
vpc:trafficMirrorSessions:create	Grants permission to create trafficMirrorSession.	Write	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorSourceId vpc:TrafficMirrorFilterId	-
vpc:trafficMirrorSessions:create	Grants permission to create trafficMirrorSession.	Write	trafficMirrorFilter *	-	-
vpc:trafficMirrorSessions:get	Grants permission to get trafficMirrorSession.	Read	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorFilterId vpc:TrafficMirrorSourceId	-
vpc:trafficMirrorSessions:list	Grants permission to list trafficMirrorSession.	List	trafficMirrorSession *	-	-
vpc:trafficMirrorSessions:update	Grants permission to update trafficMirrorSession.	Write	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorFilterId vpc:TrafficMirrorSourceId	-
vpc:trafficMirrorSessions:update	Grants permission to update trafficMirrorSession.	Write	trafficMirrorFilter	-	-
vpc:trafficMirrorSessions:addSource	Grants permission to add trafficMirrorSession source resource.	Write	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorFilterId vpc:TrafficMirrorSourceId	-
vpc:trafficMirrorSessions:removeSource	Grants permission to remove trafficMirrorSession source resource.	Write	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorFilterId vpc:TrafficMirrorSourceId	-
vpc:trafficMirrorSessions:delete	Grants permission to delete trafficMirrorSession.	Write	trafficMirrorSession *	vpc:TrafficMirrorTargetType vpc:TrafficMirrorTargetId vpc:TrafficMirrorSourceType vpc:TrafficMirrorFilterId vpc:TrafficMirrorSourceId	-

Each API of vpc usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by vpc APIs
API	Action	Dependencies
POST /v1/{project_id}/vpcs	vpc:vpcs:create	-
GET /v1/{project_id}/vpcs/{vpc_id}	vpc:vpcs:get	-
GET /v1/{project_id}/vpcs	vpc:vpcs:list	-
PUT /v1/{project_id}/vpcs/{vpc_id}	vpc:vpcs:update	-
DELETE /v1/{project_id}/vpcs/{vpc_id}	vpc:vpcs:delete	-
POST /v1/{project_id}/subnets	vpc:subnets:create	-
GET /v1/{project_id}/subnets/{subnet_id}	vpc:subnets:get	-
GET /v1/{project_id}/subnets	vpc:subnets:list	-
PUT /v1/{project_id}/vpcs/{vpc_id}/subnets/{subnet_id}	vpc:subnets:update	-
DELETE /v1/{project_id}/vpcs/{vpc_id}/subnets/{subnet_id}	vpc:subnets:delete	-
GET /v1/{project_id}/quotas	vpc:quotas:list	-
POST /v1/{project_id}/privateips	vpc:privateIps:create	-
GET /v1/{project_id}/privateips/{privateip_id}	vpc:privateIps:get	-
GET /v1/{project_id}/subnets/{subnet_id}/privateips	vpc:privateIps:list	-
DELETE /v1/{project_id}/privateips/{privateip_id}	vpc:privateIps:delete	-
POST /v1/{project_id}/security-groups	vpc:securityGroups:create	-
GET /v1/{project_id}/security-groups/{security_group_id}	vpc:securityGroups:get	-
GET /v1/{project_id}/security-groups	vpc:securityGroups:list	-
DELETE /v1/{project_id}/security-groups/{security_group_id}	vpc:securityGroups:delete	-
POST /v1/{project_id}/security-group-rules	vpc:securityGroupRules:create	-
POST /v3/{project_id}/vpc/security-groups/{security_group_id}/security-group-rules/batch-create	vpc:securityGroupRules:create	-
GET /v1/{project_id}/security-group-rules/{security_group_rule_id}	vpc:securityGroupRules:get	-
GET /v1/{project_id}/security-group-rules	vpc:securityGroupRules:list	-
DELETE /v1/{project_id}/security-group-rules/{security_group_rule_id}	vpc:securityGroupRules:delete	-
POST /v1/{project_id}/ports	vpc:ports:create	-
GET /v1/{project_id}/ports/{port_id}	vpc:ports:get	-
GET /v1/{project_id}/ports	vpc:ports:list	-
PUT /v1/{project_id}/ports/{port_id}	vpc:ports:update	-
DELETE /v1/{project_id}/ports/{port_id}	vpc:ports:delete	-
POST /v2.0/vpc/peerings	vpc:peerings:create	-
PUT /v2.0/vpc/peerings/{peering_id}/accept	vpc:peerings:accept	-
PUT /v2.0/vpc/peerings/{peering_id}/reject	vpc:peerings:reject	-
GET /v2.0/vpc/peerings/{peering_id}	vpc:peerings:get	-
GET /v2.0/vpc/peerings	vpc:peerings:list	-
PUT /v2.0/vpc/peerings/{peering_id}	vpc:peerings:update	-
DELETE /v2.0/vpc/peerings/{peering_id}	vpc:peerings:delete	-
POST /v1/{project_id}/routetables	vpc:routeTables:create	-
GET /v1/{project_id}/routetables/{routetable_id}	vpc:routeTables:get	-
GET /v1/{project_id}/routetables	vpc:routeTables:list	-
PUT /v1/{project_id}/routetables/{routetable_id}	vpc:routeTables:update	-
POST /v1/{project_id}/routetables/{routetable_id}/action	vpc:routeTables:associate	-
POST 01 /v1/{project_id}/routetables/{routetable_id}/action	vpc:routeTables:associate	-
DELETE /v1/{project_id}/routetables/{routetable_id}	vpc:routeTables:delete	-
POST /v1/{project_id}/fl/flow_logs	vpc:flowLogs:create	-
GET /v1/{project_id}/fl/flow_logs/{flowlog_id}	vpc:flowLogs:get	-
GET /v1/{project_id}/fl/flow_logs	vpc:flowLogs:list	-
PUT /v1/{project_id}/fl/flow_logs/{flowlog_id}	vpc:flowLogs:update	-
DELETE /v1/{project_id}/fl/flow_logs/{flowlog_id}	vpc:flowLogs:delete	-
PUT /v3/{project_id}/vpc/vpcs/{vpc_id}/add-extend-cidr	vpc:vpcs:update	-
PUT /v3/{project_id}/vpc/vpcs/{vpc_id}/remove-extend-cidr	vpc:vpcs:update	-
PUT /v3/{project_id}/vpc/security-groups/{security_group_id}	vpc:securityGroups:update	-
POST /v3/{project_id}/vpc/address-groups	vpc:addressGroups:create	-
GET /v3/{project_id}/vpc/address-groups/{address_group_id}	vpc:addressGroups:get	-
GET /v3/{project_id}/vpc/address-groups	vpc:addressGroups:list	-
PUT /v3/{project_id}/vpc/address-groups/{address_group_id}	vpc:addressGroups:update	-
DELETE /v3/{project_id}/vpc/address-groups/{address_group_id}	vpc:addressGroups:delete	-
DELETE /v3/{project_id}/vpc/address-groups/{address_group_id}/force	vpc:addressGroups:delete	-
POST /v3/{project_id}/vpc/firewalls	vpc:firewalls:create	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}	vpc:firewalls:update	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}/associate-subnets	vpc:firewalls:update	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}/disassociate-subnets	vpc:firewalls:update	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}/insert-rules	vpc:firewalls:update	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}/remove-rules	vpc:firewalls:update	-
PUT /v3/{project_id}/vpc/firewalls/{firewall_id}/update-rules	vpc:firewalls:update	-
DELETE /v3/{project_id}/vpc/firewalls/{firewall_id}	vpc:firewalls:delete	-
GET /v3/{project_id}/vpc/firewalls	vpc:firewalls:list	-
GET /v3/{project_id}/vpc/firewalls/{firewall_id}	vpc:firewalls:get	-
POST /v2.0/{project_id}/vpcs/{vpc_id}/tags/action	vpc:vpcs:createTags	-
POST 01 /v2.0/{project_id}/vpcs/{vpc_id}/tags/action	vpc:vpcs:deleteTags	-
POST /v2.0/{project_id}/vpcs/{vpc_id}/tags	vpc:vpcs:createTags	-
POST /v2.0/{project_id}/vpcs/resource_instances/action	vpc:vpcs:listTags	-
GET /v2.0/{project_id}/vpcs/tags	vpc:vpcs:listTags	-
GET /v2.0/{project_id}/vpcs/{vpc_id}/tags	vpc:vpcs:listTags	-
DELETE /v2.0/{project_id}/vpcs/{vpc_id}/tags/{key}	vpc:vpcs:deleteTags	-
POST 01 /v2.0/{project_id}/subnets/{subnet_id}/tags/action	vpc:subnets:createTags	-
POST /v2.0/{project_id}/subnets/{subnet_id}/tags/action	vpc:subnets:deleteTags	-
POST /v2.0/{project_id}/subnets/{subnet_id}/tags	vpc:subnets:createTags	-
POST /v2.0/{project_id}/subnets/resource_instances/action	vpc:subnets:listTags	-
GET /v2.0/{project_id}/subnets/tags	vpc:subnets:listTags	-
GET /v2.0/{project_id}/subnets/{subnet_id}/tags	vpc:subnets:listTags	-
DELETE /v2.0/{project_id}/subnets/{subnet_id}/tags/{key}	vpc:subnets:deleteTags	-
POST /v3/{project_id}/vpc/sub-network-interfaces	vpc:subNetworkInterfaces:create	-
POST /v3/{project_id}/vpc/sub-network-interfaces/batch-create	vpc:subNetworkInterfaces:create	-
GET /v3/{project_id}/vpc/sub-network-interfaces/{sub_network_interface_id}	vpc:subNetworkInterfaces:get	-
GET /v3/{project_id}/vpc/sub-network-interfaces	vpc:subNetworkInterfaces:list	-
GET /v3/{project_id}/vpc/sub-network-interfaces/count	vpc:subNetworkInterfaces:list	-
PUT /v3/{project_id}/vpc/sub-network-interfaces/{sub_network_interface_id}	vpc:subNetworkInterfaces:update	-
DELETE /v3/{project_id}/vpc/sub-network-interfaces/{sub_network_interface_id}	vpc:subNetworkInterfaces:delete	-
POST /v3/{project_id}/firewalls/{firewall_id}/tags/create	vpc:firewalls:createTags	-
POST /v3/{project_id}/firewalls/{firewall_id}/tags/delete	vpc:firewalls:deleteTags	-
POST /v3/{project_id}/firewalls/{firewall_id}/tags	vpc:firewalls:createTags	-
POST /v3/{project_id}/firewalls/resource-instances/filter	vpc:firewalls:listTags	-
POST /v3/{project_id}/firewalls/resource-instances/count	vpc:firewalls:listTags	-
GET /v3/{project_id}/firewalls/tags	vpc:firewalls:listTags	-
GET /v3/{project_id}/firewalls/{firewall_id}/tags	vpc:firewalls:listTags	-
DELETE /v3/{project_id}/firewalls/{firewall_id}/tags/{tag_key}	vpc:firewalls:deleteTags	-
POST 01 /v2.0/{project_id}/security-groups/{security_group_id}/tags/action	vpc:securityGroups:createTags	-
POST /v2.0/{project_id}/security-groups/{security_group_id}/tags/action	vpc:securityGroups:deleteTags	-
POST /v2.0/{project_id}/security-groups/{security_group_id}/tags	vpc:securityGroups:createTags	-
POST /v2.0/{project_id}/security-groups/resource_instances/action	vpc:securityGroups:listTags	-
GET /v2.0/{project_id}/security-groups/tags	vpc:securityGroups:listTags	-
GET /v2.0/{project_id}/security-groups/{security_group_id}/tags	vpc:securityGroups:listTags	-
DELETE /v2.0/{project_id}/security-groups/{security_group_id}/tags/{key}	vpc:securityGroups:deleteTags	-
POST /v3/{project_id}/vpc/traffic-mirror-filters	vpc:trafficMirrorFilters:create	-
PUT /v3/{project_id}/vpc/traffic-mirror-filter/{traffic_mirror_filter_id}	vpc:trafficMirrorFilters:update	-
GET /v3/{project_id}/vpc/traffic-mirror-filter/{traffic_mirror_filter_id}	vpc:trafficMirrorFilters:get	-
GET /v3/{project_id}/vpc/traffic-mirror-filters	vpc:trafficMirrorFilters:list	-
DELETE /v3/{project_id}/vpc/traffic-mirror-filter/{traffic_mirror_filter_id}	vpc:trafficMirrorFilters:delete	-
POST /v3/{project_id}/vpc/traffic-mirror-filter-rules	vpc:trafficMirrorFilterRules:create	-
PUT /v3/{project_id}/vpc/traffic-mirror-filter-rules/{traffic_mirror_filter_rule_id}	vpc:trafficMirrorFilterRules:update	-
GET /v3/{project_id}/vpc/traffic-mirror-filter-rules/{traffic_mirror_filter_rule_id}	vpc:trafficMirrorFilterRules:get	-
GET /v3/{project_id}/vpc/traffc-mirror-filter-rules	vpc:trafficMirrorFilterRules:list	-
DELETE /v3/{project_id}/vpc/traffic-mirror-filter-rules/{traffic_mirror_filter_rule_id}	vpc:trafficMirrorFilterRules:delete	-
POST /v3/{project_id}/vpc/traffic-mirror-sessions	vpc:trafficMirrorSessions:create	-
PUT /v3/{project_id}/vpc/traffic-mirror-sessions/{traffic_mirror_session_id}/add-sources	vpc:trafficMirrorSessions:addSource	-
PUT /v3/{project_id}/vpc/traffic-mirror-sessions/{traffic_mirror_session_id}/remove-sources	vpc:trafficMirrorSessions:removeSource	-
PUT /v3/{project_id}/vpc/traffic-mirror-sessions/{traffic_mirror_session_id}	vpc:trafficMirrorSessions:update	-
GET /v3/{project_id}/vpc/traffic-mirror-sessions/{traffic_mirror_session_id}	vpc:trafficMirrorSessions:get	-
GET /v3/{project_id}/vpc/traffic-mirror-sessions	vpc:trafficMirrorSessions:list	-
DELETE /v3/{project_id}/vpc/traffic-mirror-sessions/{traffic_mirror_session_id}	vpc:trafficMirrorSessions:delete	-
PUT /v3/{project_id}/ports/{port_id}/insert-security-groups	vpc:ports:update	-
PUT /v3/{project_id}/ports/{port_id}/remove-security-groups	vpc:ports:update	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for vpc.

**Table 3** Resource types supported by vpc
Resource Type	URN
network	vpc:<region>:<account-id>:network:<network-id>
securityGroupRule	vpc:<region>:<account-id>:securityGroupRule:<security-group-rule-id>
addressGroup	vpc:<region>:<account-id>:addressGroup:<address-group-id>
firewall	vpc:<region>:<account-id>:firewall:<firewall-id>
port	vpc:<region>:<account-id>:port:<port-id>
trafficMirrorFilter	vpc:<region>:<account-id>:trafficMirrorFilter:<traffic-mirror-filter-id>
securityGroup	vpc:<region>:<account-id>:securityGroup:<security-group-id>
routeTable	vpc:<region>:<account-id>:routeTable:<route-table-id>
vpc	vpc:<region>:<account-id>:vpc:<vpc-id>
publicip	vpc:<region>:<account-id>:publicip:<publicip-id>
flowLog	vpc:<region>:<account-id>:flowLog:<flow-log-id>
trafficMirrorFilterRule	vpc:<region>:<account-id>:trafficMirrorFilterRule:<traffic-mirror-filter-rule-id>
bandwidth	vpc:<region>:<account-id>:bandwidth:<bandwidth-id>
trafficMirrorSession	vpc:<region>:<account-id>:trafficMirrorSession:<traffic-mirror-session-id>
subNetworkInterface	vpc:<region>:<account-id>:subNetworkInterface:<sub-network-interface-id>
subnet	vpc:<region>:<account-id>:subnet:<subnet-id>
privateIp	vpc:<region>:<account-id>:privateIp:<private-ip-id>
peering	vpc:<region>:<account-id>:peering:<peering-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, vpc) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by vpc

The following table lists the condition keys that you can define in identity policies for vpc. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by vpc
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
vpc:VpcId	string	Multivalued	Filters access based on the specified vpc id.
vpc:VpcBlockServiceEndpointStates	string	Single-valued	Filters access based on the specified vpc block service endpoint, valid values should be on and off.
vpc:SubnetId	string	Multivalued	Filters access based on the specified subnet id.
vpc:SecurityGroupId	string	Multivalued	Filters access based on the specified securityGroup id.
vpc:PeeringId	string	Multivalued	Filters access based on the specified peering id.
vpc:AccepterVpcId	string	Multivalued	Filters access based on the specified accepter vpc id.
vpc:AccepterVpcOrgPath	string	Multivalued	Filters access based on the org path of specified accepter vpc owner.
vpc:AccepterVpcOwner	string	Multivalued	Filters access based on the specified accepter vpc owner.
vpc:RequesterVpcOrgPath	string	Multivalued	Filters access based on the org path of specified requester vpc owner.
vpc:RequesterVpcOwner	string	Multivalued	Filters access based on the specified requester vpc owner.
vpc:RequesterVpcId	string	Multivalued	Filters access based on the specified requester vpc id.
vpc:RouteTableId	string	Multivalued	Filters access based on the specified routeTable id.
vpc:FlowLogId	string	Multivalued	Filters access based on the specified flowLog id.
vpc:AddressGroupId	string	Multivalued	Filters access based on the specified addressGroup id.
vpc:FirewallId	string	Multivalued	Filters access based on the specified firewall id.
vpc:PrivateIpId	string	Multivalued	Filters access based on the specified privateIp id.
vpc:PortId	string	Multivalued	Filters access based on the specified port id.
vpc:SubNetworkInterfaceId	string	Multivalued	Filters access based on the specified subNetworkInterface id.
vpc:FirewallRuleDirection	string	Multivalued	Filters access based on the specified firewallRule direction, valid values should be ingress and egress.
vpc:FirewallRuleProtocol	string	Multivalued	Filters access based on the specified firewallRule protocol, valid values should be tcp, udp, icmp, icmpv6 and any.
vpc:FirewallRuleAction	string	Multivalued	Filters access based on the specified firewallRule action, valid values should be allow and deny.
vpc:FirewallRuleSourcePort	numeric	Multivalued	Filters access based on the specified firewallRule source port.
vpc:FirewallRuleDestinationPort	numeric	Multivalued	Filters access based on the specified firewallRule destination port.
vpc:FirewallOperationType	string	Multivalued	Filters access based on the specified firewall operation type, valid values should be updateAcl, associateSubnet, disassociateSubnet, insertRule, updateRule and removeRule.
vpc:TrafficMirrorFilterId	string	Multivalued	Filters access based on the specified traffic mirror filter id.
vpc:TrafficMirrorTargetType	string	Multivalued	Filters access based on the specified traffic mirror session target resource type, valid values should be eni and elb.
vpc:TrafficMirrorTargetId	string	Multivalued	Filters access based on the specified traffic mirror session target resource id.
vpc:TrafficMirrorSourceType	string	Multivalued	Filters access based on the specified traffic mirror session source resource type, valid values should be eni.
vpc:TrafficMirrorSourceId	string	Multivalued	Filters access based on the specified traffic mirror session source resource id.
vpc:FirewallRuleSourceIp	ip_address	Single-valued	Filters access based on the source address in the specified network ACL rule.
vpc:FirewallRuleSourceIpAddressGroup	string	Single-valued	Filters access based on the unique ID of the IP address group used by the source address in the specified network ACL rule.
vpc:FirewallRuleDestinationIp	ip_address	Single-valued	Filters access based on the destination address in the specified network ACL rule.
vpc:FirewallRuleDestinationIpAddressGroup	string	Single-valued	Filters access based on the unique ID of the IP address group used by the destination address in the specified network ACL rule.
vpc:AvailabilityZone	string	Single-valued	Filters access based on the specified AvailabilityZone.
vpc:LegacyAPIFlavor	string	Single-valued	Filters access based on the native api.
vpc:SecurityGroupRuleDirection	string	Single-valued	Filters access based on the specified securityGroupRule direction, valid values should be ingress and egress.
vpc:SecurityGroupRuleProtocol	string	Single-valued	Filters access based on the specified securityGroupRule protocol, valid values should be tcp, udp, icmp, icmpv6, gre and any.
vpc:SecurityGroupRuleAction	string	Single-valued	Filters access based on the specified securityGroupRule action, valid values should be allow and deny.
vpc:SecurityGroupRulePort	numeric	Multivalued	Filters access based on the specified securityGroupRule port.
vpc:SecurityGroupRuleRemoteIpAddressGroup	string	Single-valued	Filters access based on the unique ID of the IP address group used by the remote address group in the specified security group rule.
vpc:SecurityGroupRuleRemoteSecurityGroup	string	Single-valued	Filters access based on the unique security group ID used by the remote security group in the specified security group rule.
vpc:SecurityGroupRuleRemoteIpPrefix	ip_address	Single-valued	Filters access based on the IP address used by the remote IP address in the specified security group rule.
vpc:VirsubnetCidrReservationId	string	Multivalued	Filters access based on the specified virsubnetCidrReservation id.
vpc:SubnetIpv6Enable	boolean	Single-valued	Filters access based on the IPv6 enabling status of the specified subnet.