Cloud Connect

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CC, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by CC, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for CC.

**Table 1** Actions supported by CC
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
cc:cloudConnections:create	Grants permission to create a cloud connection.	Write	cloudConnection *	-	-
cc:cloudConnections:create	Grants permission to create a cloud connection.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
cc:cloudConnections:delete	Grants permission to delete a cloud connection.	Write	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:cloudConnections:update	Grants permission to update a cloud connection.	Write	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:cloudConnections:get	Grants permission to query the details of a cloud connection.	Read	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:cloudConnections:list	Grants permission to query the cloud connections.	List	cloudConnection *	-	-
cc:cloudConnections:tag	Grants permission to add tags to a cloud connection.	Tagging	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:cloudConnections:tag	Grants permission to add tags to a cloud connection.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:cloudConnections:unTag	Grants permission to delete tags from a cloud connection.	Tagging	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:cloudConnections:unTag	Grants permission to delete tags from a cloud connection.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:cloudConnections:listTags	Grants permission to query the tags added to a cloud connection.	List	cloudConnection *	-	-
cc:networkInstances:create	Grants permission to create a network instance.	Write	networkInstance *	-	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId
cc:networkInstances:delete	Grants permission to remove a network instance.	Write	networkInstance *	cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:update	Grants permission to update a network instance.	Write	networkInstance *	cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:get	Grants permission to query the details of a network instance.	Read	networkInstance *	-	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:list	Grants permission to query the network instances.	List	networkInstance *	-	-
cc:bandwidthPackages:create	Grants permission to create a bandwidth package.	Write	bandwidthPackage *	-	-
cc:bandwidthPackages:create	Grants permission to create a bandwidth package.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
cc:bandwidthPackages:delete	Grants permission to delete a bandwidth package.	Write	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:bandwidthPackages:update	Grants permission to update a bandwidth package.	Write	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:bandwidthPackages:get	Grants permission to query the details of a bandwidth package.	Read	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:bandwidthPackages:list	Grants permission to query the bandwidth packages.	List	bandwidthPackage *	-	-
cc:bandwidthPackages:tag	Grants permission to add tags to a bandwidth package.	Tagging	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:bandwidthPackages:tag	Grants permission to add tags to a bandwidth package.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:bandwidthPackages:unTag	Grants permission to delete tags from a bandwidth package.	Tagging	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:bandwidthPackages:unTag	Grants permission to delete tags from a bandwidth package.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:bandwidthPackages:listTags	Grants permission to query the tags added to a bandwidth package.	List	bandwidthPackage *	-	-
cc:bandwidthPackages:associate	Grants permission to bind a bandwidth package to a cloud connection.	Write	bandwidthPackage *	g:ResourceTag/<tag-key>	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:bandwidthPackages:disassociate	Grants permission to unbind a bandwidth package from a cloud connection.	Write	bandwidthPackage *	g:ResourceTag/<tag-key>	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:create	Grants permission to assign an inter-region bandwidth.	Write	interRegionBandwidth *	-	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:BandwidthPackageId
cc:interRegionBandwidths:delete	Grants permission to delete an inter-region bandwidth.	Write	interRegionBandwidth *	cc:BandwidthPackageId	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:update	Grants permission to modify an inter-region bandwidth.	Write	interRegionBandwidth *	cc:BandwidthPackageId	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:get	Grants permission to query the details of an inter-region bandwidth.	Read	interRegionBandwidth *	-	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:list	Grants permission to query the inter-region bandwidths.	List	interRegionBandwidth *	-	-
cc:cloudConnectionRoutes:get	Grants permission to query the details of a cloud connection route.	Read	-	-	-
cc:cloudConnectionRoutes:list	Grants permission to query the cloud connection routes.	List	-	-	-
cc:authorisation:create	Grants permission to allow other accounts to load the VPCs in your account to their cloud connections.	Write	-	-	-
cc:authorisation:delete	Grants permission to stop allowing other accounts to load the VPCs in your account to their cloud connections.	Write	-	-	-
cc:authorisation:update	Grants permission to update the authorization that allows other accounts to load the VPCs in your account to their cloud connections.	Write	-	-	-
cc:authorisation:list	Grants permission to query the VPCs that are allowed to be loaded to the cloud connections in other accounts.	List	-	-	-
cc:authorisation:listPermissions	Grants permission to query the VPCs that other accounts allow you to load to your cloud connection.	List	-	-	-
cc:crossBorderConsent:show	Grants permission to query the explicit consent for cross-border transfer of personal data.	Read	-	-	-
cc:crossBorderConsent:create	Grants permission to allow users to express explicit consent for cross-border transfer of personal data.	Write	-	-	-
cc:quota:list	Grants permission to query the quotas.	List	-	-	-
cc:capability:list	Grants permission to query the capabilities of a cloud connection, central network, and site network.	List	-	-	-
cc:centralNetwork:create	Grants permission to create a central network.	Write	centralNetwork *	-	-
cc:centralNetwork:create	Grants permission to create a central network.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys cc:MultipleEnterpriseRouterIds	-
cc:centralNetwork:delete	Grants permission to delete a central network.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:update	Grants permission to update a central network.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:update	Grants permission to update a central network.	Write	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:centralNetwork:get	Grants permission to query the details of a central network.	Read	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:list	Grants permission to query the central networks.	List	centralNetwork *	-	-
cc:centralNetwork:tag	Grants permission to add tags to a central network.	Tagging	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:tag	Grants permission to add tags to a central network.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:centralNetwork:unTag	Grants permission to delete tags from a central network.	Tagging	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:unTag	Grants permission to delete tags from a central network.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
cc:centralNetwork:listTags	Grants permission to query the tags added to a central network.	List	centralNetwork *	-	-
cc:centralNetwork:createPolicy	Grants permission to add a policy to a central network.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:createPolicy	Grants permission to add a policy to a central network.	Write	-	cc:MultipleEnterpriseRouterIds	-
cc:centralNetwork:applyPolicy	Grants permission to apply a policy to a central network.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:deletePolicy	Grants permission to delete a policy from a central network.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:listPolicies	Grants permission to query the central network policies.	List	centralNetwork *	-	-
cc:centralNetwork:listChangeSet	Grants permission to query the changes between the current policy and an applied policy.	List	centralNetwork *	-	-
cc:centralNetwork:listConnections	Grants permission to query the central network connections.	List	centralNetwork *	-	-
cc:centralNetwork:updateConnection	Grants permission to update a central network connection.	Write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
cc:centralNetwork:updateConnection	Grants permission to update a central network connection.	Write	-	cc:GlobalConnectionBandwidthId	-
cc:centralNetworkAttachment:createGdgw	Grants permission to add a global DC gateway to a central network as an attachment.	Write	centralNetworkAttachment *	-	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:EnterpriseRouterId cc:GlobalDcGatewayId
cc:centralNetworkAttachment:updateGdgw	Grants permission to update a global DC gateway on a central network.	Write	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:getGdgw	Grants permission to query the details of a global DC gateway on a central network.	Read	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:listGdgws	Grants permission to query the global DC gateways on a central network.	List	centralNetworkAttachment *	-	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:createErRouteTable	Grants permission to add an enterprise router route table to a central network as an attachment.	Write	centralNetworkAttachment *	-	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:MultipleEnterpriseRouterIds
cc:centralNetworkAttachment:updateErRouteTable	Grants permission to update an enterprise router route table on a central network.	Write	centralNetworkAttachment *	cc:MultipleEnterpriseRouterIds	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:getErRouteTable	Grants permission to query the details of an enterprise router route table on a central network.	Read	centralNetworkAttachment *	cc:MultipleEnterpriseRouterIds	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:listErRouteTables	Grants permission to query the enterprise router route tables on a central network.	List	centralNetworkAttachment *	-	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:delete	Grants permission to delete an attachment from a central network.	Write	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId cc:MultipleEnterpriseRouterIds	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:list	Grants permission to query the central network attachments.	List	centralNetworkAttachment *	-	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:siteNetwork:createP2P	Grants permission to create a P2P site network.	Write	siteNetwork *	-	-
cc:siteNetwork:list	Grants permission to query the site networks.	List	siteNetwork *	-	-
cc:siteNetwork:get	Grants permission to query the details of a site network.	Read	siteNetwork *	-	-
cc:siteNetwork:update	Grants permission to update a site network.	Write	siteNetwork *	-	-
cc:siteNetwork:delete	Grants permission to delete a site network.	Write	siteNetwork *	-	-
cc:siteNetwork:disassociateBandwidth	Grants permission to unbind a site network bandwidth.	Write	siteNetwork *	-	-
cc:siteNetwork:associateBandwidth	Grants permission to bind a site network bandwidth.	Write	siteNetwork *	-	-
cc:siteNetwork:updateBandwidthSize	Grants permission to modify the site network bandwidth size.	Write	siteNetwork *	-	-
cc:siteNetwork:updateBandwidth	Grants permission to change the site network bandwidth.	Write	siteNetwork *	-	-
cc:gcbandwidth:list	Grants permission to query global connection bandwidths.	List	gcbandwidth *	-	cc:gcbandwidths:list
cc:gcbandwidth:list	Grants permission to query global connection bandwidths.	List	-	g:EnterpriseProjectId	cc:gcbandwidths:list
cc:gcbandwidth:get	Grants permission to query the details of a global connection bandwidth.	Read	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:get
cc:gcbandwidth:create	Grants permission to create a global connection bandwidth.	Write	gcbandwidth *	-	cc:gcbandwidths:create
cc:gcbandwidth:create	Grants permission to create a global connection bandwidth.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	cc:gcbandwidths:create
cc:gcbandwidth:update	Grants permission to update a global connection bandwidth.	Write	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:update
cc:gcbandwidth:delete	Grants permission to delete a global connection bandwidth.	Write	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:delete
cc:gcbandwidth:getRelations	Grants permission to query global connection bandwidth binding relations.	Read	gcbandwidth *	g:EnterpriseProjectId	cc:gcbandwidths:get
cc:gcbandwidth:associateInstance	Grants permission to bind a global connection bandwidth to an instance.	Write	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:update
cc:gcbandwidth:associateInstance		Write	-	cc:gcbAssociateResourceType	cc:gcbandwidths:update
cc:gcbandwidth:disassociateInstance	Grants permission to unbind a global connection bandwidth from an instance.	Write	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key> cc:gcbAssociateResourceType	cc:gcbandwidths:update
cc:gcbandwidth:listSupportBinding	Grants permission to query global connection bandwidths that can be bound to instances.	List	gcbandwidth *	-	cc:gcbandwidths:list
cc:gcbandwidth:listSupportBinding		List	-	g:EnterpriseProjectId	cc:gcbandwidths:list
cc:gcbandwidth:listTags	Grants permission to query tags of a global connection bandwidth.	List	gcbandwidth *	-	cc:gcbandwidths:listByTag
cc:gcbandwidth:tag	Grants permission to add tags to a global connection bandwidth.	Tagging	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:createTags
cc:gcbandwidth:tag		Tagging	-	g:RequestTag/<tag-key> g:TagKeys	cc:gcbandwidths:createTags
cc:gcbandwidth:unTag	Grants permission to delete tags from a global connection bandwidth.	Tagging	gcbandwidth *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cc:gcbandwidths:deleteTags
cc:gcbandwidth:unTag		Tagging	-	g:TagKeys	cc:gcbandwidths:deleteTags

Each API of CC usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by CC APIs
API	Action	Dependencies
POST /v3/{domain_id}/ccaas/cloud-connections	cc:cloudConnections:create	-
PUT /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:update	-
DELETE /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:delete	-
GET /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:get	-
GET /v3/{domain_id}/ccaas/cloud-connections	cc:cloudConnections:list	-
POST /v3/{domain_id}/ccaas/cloud-connections/filter	cc:cloudConnections:list	-
POST /v3/{domain_id}/ccaas/cloud-connections/{id}/tag	cc:cloudConnections:tag	-
POST /v3/{domain_id}/ccaas/cloud-connections/{id}/untag	cc:cloudConnections:unTag	-
GET /v3/{domain_id}/ccaas/cloud-connections/tags	cc:cloudConnections:listTags	-
POST /v3/{domain_id}/ccaas/network-instances	cc:networkInstances:create	-
PUT /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:update	-
DELETE /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:delete	-
GET /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:get	-
GET /v3/{domain_id}/ccaas/network-instances	cc:networkInstances:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages	cc:bandwidthPackages:create	-
PUT /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:update	-
DELETE /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:delete	-
GET /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:get	-
GET /v3/{domain_id}/ccaas/bandwidth-packages	cc:bandwidthPackages:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/filter	cc:bandwidthPackages:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/tag	cc:bandwidthPackages:tag	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/untag	cc:bandwidthPackages:unTag	-
GET /v3/{domain_id}/ccaas/bandwidth-packages/tags	cc:bandwidthPackages:listTags	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/associate	cc:bandwidthPackages:associate	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/disassociate	cc:bandwidthPackages:disassociate	-
GET /v3/{domain_id}/ccaas/bandwidth-packages/free-packages	cc:bandwidthPackages:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/orders/{order_id}	cc:bandwidthPackages:create	-
PUT /v3/{domain_id}/ccaas/bandwidth-packages/orders/{order_id}	cc:bandwidthPackages:update	-
POST /v3/{domain_id}/ccaas/inter-region-bandwidths	cc:interRegionBandwidths:create	-
PUT /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:update	-
DELETE /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:delete	-
GET /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:get	-
GET /v3/{domain_id}/ccaas/inter-region-bandwidths	cc:interRegionBandwidths:list	-
GET /v3/{domain_id}/ccaas/cloud-connection-routes/{id}	cc:cloudConnectionRoutes:get	-
GET /v3/{domain_id}/ccaas/cloud-connection-routes	cc:cloudConnectionRoutes:list	-
POST /v3/{domain_id}/ccaas/authorisations	cc:authorisation:create	-
DELETE /v3/{domain_id}/ccaas/authorisations/{id}	cc:authorisation:delete	-
PUT /v3/{domain_id}/ccaas/authorisations/{id}	cc:authorisation:update	-
GET /v3/{domain_id}/ccaas/authorisations	cc:authorisation:list	-
GET /v3/{domain_id}/ccaas/permissions	cc:authorisation:listPermissions	-
GET /v3/{domain_id}/ccaas/quotas	cc:quota:list	-
GET /v3/{domain_id}/gcn/quotas	cc:quota:list	-
GET /v3/{domain_id}/ccaas/capabilities	cc:capability:list	-
GET /v3/{domain_id}/gcn/capabilities	cc:capability:list	-
POST /v3/{domain_id}/gcn/central-networks	cc:centralNetwork:create	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
DELETE /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:delete	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:update	-
GET /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:get	-
GET /v3/{domain_id}/gcn/central-networks	cc:centralNetwork:list	-
POST /v3/{domain_id}/gcn/central-networks/filter	cc:centralNetwork:list	-
POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/tag	cc:centralNetwork:tag	-
POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/untag	cc:centralNetwork:unTag	-
GET /v3/{domain_id}/gcn/central-networks/tags	cc:centralNetwork:listTags	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies	cc:centralNetwork:createPolicy	er:instances:get er:routeTables:get
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/apply	cc:centralNetwork:applyPolicy	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}	cc:centralNetwork:deletePolicy	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies	cc:centralNetwork:listPolicies	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/change-set	cc:centralNetwork:listChangeSet	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/connections	cc:centralNetwork:listConnections	-
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/connections/{connection_id}	cc:centralNetwork:updateConnection	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments	cc:centralNetworkAttachment:createGdgw	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}	cc:centralNetworkAttachment:updateGdgw	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}	cc:centralNetworkAttachment:getGdgw	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments	cc:centralNetworkAttachment:listGdgws	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments	cc:centralNetworkAttachment:createErRouteTable	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}	cc:centralNetworkAttachment:updateErRouteTable	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}	cc:centralNetworkAttachment:getErRouteTable	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments	cc:centralNetworkAttachment:listErRouteTables	-
DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments/{attachment_id}	cc:centralNetworkAttachment:delete	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments	cc:centralNetworkAttachment:list	-
GET /v3/{domain_id}/ccaas/domain-cross-border-consents	cc:crossBorderConsent:show	-
POST /v3/{domain_id}/ccaas/domain-cross-border-consents	cc:crossBorderConsent:create	-
POST /v3/{domain_id}/dcaas/p2p-site-networks	cc:siteNetwork:createP2P	-
GET /v3/{domain_id}/dcaas/site-networks	cc:siteNetwork:list	-
GET /v3/{domain_id}/dcaas/site-networks/{site_network_id}	cc:siteNetwork:get	-
PUT /v3/{domain_id}/dcaas/site-networks/{site_network_id}	cc:siteNetwork:update	-
DELETE /v3/{domain_id}/dcaas/site-networks/{site_network_id}	cc:siteNetwork:delete	-
POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/disassociate	cc:siteNetwork:disassociateBandwidth	-
POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/associate	cc:siteNetwork:associateBandwidth	-
POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/update-bandwidth-size	cc:siteNetwork:updateBandwidthSize	-
POST /v3/{domain_id}/dcaas/site-network/{site_network_id}/connections/{site_connection_id}/update-bandwidth	cc:siteNetwork:updateBandwidth	-
GET /v3/{domain_id}/dcaas/site-network/capabilities	cc:capability:list	-
GET /v3/{domain_id}/dcaas/site-network/quotas	cc:quota:list	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for CC.

**Table 3** Resource types supported by CC
Resource Type	URN
cloudConnection	cc::<account-id>:cloudConnection:<cloud-connection-id>
gcbandwidth	cc::<account-id>:gcbandwidth:<gcbandwidth-id>
interRegionBandwidth	cc::<account-id>:interRegionBandwidth:<inter-region-bandwidth-id>
networkInstance	cc::<account-id>:networkInstance:<network-instance-id>
siteNetwork	cc::<account-id>:siteNetwork:<site-network-id>
bandwidthPackage	cc::<account-id>:bandwidthPackage:<bandwidth-package-id>
centralNetwork	cc::<account-id>:centralNetwork:<central-network-id>
centralNetworkAttachment	cc::<account-id>:centralNetworkAttachment:<central-network-attachment-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cc) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by CC

The following table lists the condition keys that you can define in identity policies for CC. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by CC
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
cc:VpcId	string	Single-valued	Filters access by VPC ID.
cc:VirtualGatewayId	string	Single-valued	Filters access by virtual gateway ID.
cc:EnterpriseRouterId	string	Single-valued	Filters access by enterprise router ID.
cc:MultipleEnterpriseRouterIds	string	Multivalued	Filters access by enterprise router IDs.
cc:BandwidthPackageId	string	Single-valued	Filters access by bandwidth package ID.
cc:GlobalConnectionBandwidthId	string	Single-valued	Filters access by global connection bandwidth ID.
cc:GlobalDcGatewayId	string	Single-valued	Filters access by global DC gateway ID.
cc:gcbAssociateResourceType	string	Single-valued	Filters access to global connection bandwidths by resource type.

Examples of Condition Keys

cc:VpcId

For example,Filters access to network instances by VPC ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:networkInstances:create",
        "cc:networkInstances:delete",
        "cc:networkInstances:update"
      ],
      "Condition": {
        "StringEquals": {
          "cc:VpcId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:VirtualGatewayId

For example,Filters access to network instances by virtual gateway ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:networkInstances:create",
        "cc:networkInstances:delete",
        "cc:networkInstances:update"
      ],
      "Condition": {
        "StringEquals": {
          "cc:VirtualGatewayId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:EnterpriseRouterId

For example,Filters access to global DC gateways attached to a central network by enterprise router ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:centralNetworkAttachment:createGdgw",
        "cc:centralNetworkAttachment:updateGdgw",
        "cc:centralNetworkAttachment:getGdgw",
        "cc:centralNetworkAttachment:delete"
      ],
      "Condition": {
        "StringEquals": {
          "cc:EnterpriseRouterId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:MultipleEnterpriseRouterIds

For example,Filters access to central networks and enterprise router route table attachments by enterprise router IDs.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:centralNetwork:create",
        "cc:centralNetwork:createPolicy",
        "cc:centralNetworkAttachment:createErRouteTable",
        "cc:centralNetworkAttachment:updateErRouteTable",
        "cc:centralNetworkAttachment:getErRouteTable",
        "cc:centralNetworkAttachment:delete"
      ],
      "Condition": {
        "StringEquals": {
          "cc:MultipleEnterpriseRouterIds": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:BandwidthPackageId

For example,Filters access to inter-region bandwidths by bandwidth package ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:interRegionBandwidths:create",
        "cc:interRegionBandwidths:delete",
        "cc:interRegionBandwidths:update"
      ],
      "Condition": {
        "StringEquals": {
          "cc:BandwidthPackageId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:GlobalConnectionBandwidthId

For example,Filters access to central network connections by global connection bandwidth ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:centralNetwork:updateConnection"
      ],
      "Condition": {
        "StringEquals": {
          "cc:GlobalConnectionBandwidthId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:GlobalDcGatewayId

For example,Filters access to global DC gateways attached to a central network by global DC gateway ID.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:centralNetworkAttachment:createGdgw",
        "cc:centralNetworkAttachment:updateGdgw",
        "cc:centralNetworkAttachment:getGdgw",
        "cc:centralNetworkAttachment:delete"
      ],
      "Condition": {
        "StringEquals": {
          "cc:GlobalDcGatewayId": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     

cc:gcbAssociateResourceType

For example,Filters access to the resource binding API or resource unbinding API by the type of the resource bound to the global connection bandwidth.

      
       
         
         
           {
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cc:gcbandwidth:associateInstance",
        "cc:gcbandwidth:disassociateInstance",
      ],
      "Condition": {
        "StringEquals": {
          "cc:gcbAssociateResourceType": [
            "xxx"
          ]
        }
      }
    }
  ]
}

          

        

      
     