Distributed Cache Service (DCS)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DCS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DCS, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for DCS.

**Table 1** Actions supported by DCS
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
dcs:instance:create	Grants permission to create DCS instances.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys dcs:backupEnabled	-
dcs:instance:list	Grants permission to query the DCS instance list.	List	-	g:EnterpriseProjectId	-
dcs:instance:exportListFile	Grants permission to download the exported DCS instance list file.	List	-	-	dcs:instance:list
dcs:instance:delete	Grants permission to delete DCS instances.	Write	instance	g:EnterpriseProjectId	-
dcs:instance:get	Grants permission to query DCS instances.	Read	instance *	g:EnterpriseProjectId	-
dcs:instance:modify	Grants permission to modify DCS instances.	Write	instance *	g:EnterpriseProjectId dcs:backupEnabled	-
dcs:instance:scale	Grants permission to scale up DCS instances.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:swap	Grants permission to perform master/replica switchover on DCS instances.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:modifyAuthInfo	Grants permission to modify the passwords of DCS instances.	Write	instance *	g:EnterpriseProjectId	dcs:instance:resetAuthInfo
dcs:instance:modifyStatus	Grants permission to restart DCS instances or clear their data.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:getConfiguration	Grants permission to query DCS instance configuration parameters.	Read	instance *	g:EnterpriseProjectId	-
dcs:instance:modifyConfiguration	Grants permission to modify DCS instance configuration parameters.	Write	instance *	g:EnterpriseProjectId	dcs:instance:modifyConfigureation
dcs:instance:deleteDataBackupFile	Grants permission to delete DCS instance backup data.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:restoreData	Grants permission to restore DCS instance data.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:getDataRestoreLog	Grants permission to query DCS instance restoration records.	Read	instance *	g:EnterpriseProjectId	-
dcs:instance:downloadBackupData	Grants permission to obtain backup file URLs.	Read	instance *	g:EnterpriseProjectId	-
dcs:instance:backupData	Grants permission to back up DCS instance data.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:getDataBackupLog	Grants permission to query DCS instance backup records.	Read	instance *	g:EnterpriseProjectId	-
dcs:migrationTask:create	Grants permission to create data migration tasks.	Write	-	-	-
dcs:migrationTask:list	Grants permission to query data migration tasks.	List	-	-	-
dcs:migrationTask:delete	Grants permission to delete data migration tasks.	Write	migrationTask	-	-
dcs:migrationTask:get	Grants permission to query data migration tasks.	Read	migrationTask *	-	-
dcs:migrationTask:modify	Grants permission to configure and stop data migration tasks.	Write	migrationTask *	-	dcs:migrationTask:exchangeIp
dcs:instance:listBigKey	Grants permission to query big keys.	List	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getBigKey	Grants permission to query big key details.	Read	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:deleteBigKeyScanTask	Grants permission to delete big key scan tasks.	Write	instance	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:updateBigKeyAutoScanConfig	Grants permission to reschedule big key scan tasks.	Write	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getBigKeyAutoScanConfig	Grants permission to query scheduled big key scan tasks.	Read	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:analyzeHotKey	Grants permission to perform hot key analysis.	Write	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:listHotKey	Grants permission to query hot keys.	List	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getHotKey	Grants permission to query hot key details.	Read	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:deleteHotKeyScanTask	Grants permission to delete hot key scan tasks.	Write	instance	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:updateHotKeyAutoScanConfig	Grants permission to reschedule hot key scan tasks.	Write	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getHotKeyAutoScanConfig	Grants permission to query scheduled hot key scan tasks.	Read	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:analyzeExpiredKey	Grants permission to perform expired key analysis.	Write	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getAutoExpiredKeyScanTask	Grants permission to query expired key scan tasks.	Read	instance *	-	dcs:instance:analyze
dcs:instance:updateExpiredKeyScanConfig	Grants permission to modify instance expired key scan task configuration.	Write	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:instance:getExpiredKeyScanConfig	Grants permission to query instance expired key scan task configuration.	Read	instance *	g:EnterpriseProjectId	dcs:instance:analyze
dcs:slowlog:list	Grants permission to query slow query logs.	List	instance *	g:EnterpriseProjectId	-
dcs:aclaccount:create	Grants permission to create ACL accounts.	Write	instance *	-	-
dcs:aclaccount:list	Grants permission to query ACL accounts.	List	instance *	-	-
dcs:aclaccount:modify	Grants permission to modify the passwords of ACL accounts.	Write	instance *	-	-
dcs:aclaccount:delete	Grants permission to delete ACL accounts.	Write	instance *	-	-
dcs:whitelist:modify	Grants permission to configure IP address whitelist groups.	Write	instance *	-	-
dcs:whitelist:list	Grants permission to query the IP address whitelist of instances.	List	instance *	-	-
dcs:instance:getBackgroundTask	Grants permission to query background tasks.	Read	instance *	g:EnterpriseProjectId	-
dcs:instance:deleteBackgroundTask	Grants permission to delete background tasks.	Write	instance *	g:EnterpriseProjectId	-
dcs:instance:createDiagnosisTask	Grants permission to diagnose DCS instances.	Write	instance *	g:EnterpriseProjectId	dcs:instance:diagnosis
dcs:instance:listDiagnosisTask	Grants permission to query diagnosis tasks.	List	instance *	g:EnterpriseProjectId	dcs:instance:diagnosis
dcs:instance:getDiagnosisTask	Grants permission to query diagnosis details.	Read	instance *	g:EnterpriseProjectId	dcs:instance:diagnosis
dcs:instance:deleteDiagnosisTask	Grants permission to delete diagnosis record.	Write	instance *	g:EnterpriseProjectId	dcs:instance:diagnosis
dcs:template:list	Grants permission to query parameter templates.	List	-	-	-
dcs:template:create	Grants permission to customize templates.	Write	-	-	-
dcs:template:get	Grants permission to query parameter template.	Read	-	-	-
dcs:template:modify	Grants permission to modify customized parameter templates.	Write	-	-	-
dcs:template:delete	Grants permission to delete customized parameter templates.	Write	-	-	-
dcs:tag:list	Grants permission to query all tags in your tenant account.	List	-	-	-
dcs:tag:modify	Grants permission to add or delete tags in batches.	Write	instance *	-	-
dcs:tag:modify	Grants permission to add or delete tags in batches.	Write	-	g:RequestTag/<tag-key> g:TagKeys	-
dcs:tag:get	Grants permission to query tags of instances.	Read	instance *	-	-
dcs:tag:get	Grants permission to query tags of instances.	Read	-	g:RequestTag/<tag-key> g:TagKeys	-
dcs:redisLog:get	Grants permission to obtain log download URLs.	Read	instance *	-	-
dcs:quota:get	Grants permission to query tenant quotas.	Read	-	-	-
dcs:instance:webcli	Grants permission to connect DCS instances with WebCli.	Write	instance *	-	-
dcs:clientIpTrans:modify	Grants permission to enables or disables transparent transmission of client IP addresses.	Write	instance *	-	dcs:clientiptrans:modify
dcs:clients:list	Grants permission to query redis client list.	Read	instance *	-	-
dcs:clients:kill	Grants permission to kill redis client.	Write	instance *	-	-
dcs:ssl:get	Grants permission to obtain SSL certificate information.	Read	instance *	-	-
dcs:ssl:modify	Grants permission to modify SSL switch configuration.	Write	instance *	-	-
dcs:job:get	Grants permission to obtain predecessor check results.	Read	-	-	-
dcs:task:list	Grants permission to obtains the background task list.	List	-	-	-
dcs:task:delete	Grants permission to delete background task records.	Write	-	-	-

Each API of DCS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by DCS APIs
API	Action	Dependencies
POST /v2/{project_id}/instances	dcs:instance:create	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get vpc:securityGroupRules:get vpc:securityGroups:get
GET /v2/{project_id}/instances	dcs:instance:list	-
DELETE /v2/{project_id}/instances	dcs:instance:delete	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get
GET /v2/{project_id}/instances/{instance_id}	dcs:instance:get	-
DELETE /v2/{project_id}/instances/{instance_id}	dcs:instance:delete	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get
PUT /v2/{project_id}/instances/{instance_id}	dcs:instance:modify	vpc:ports:get vpc:ports:update
POST /v2/{project_id}/instances/{instance_id}/resize	dcs:instance:scale	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get vpc:securityGroupRules:get vpc:securityGroups:get
POST /v2/{project_id}/instances/{instance_id}/resize/check-job	dcs:instance:scale	-
POST /v2/{project_id}/instances/{instance_id}/swap	dcs:instance:swap	-
PUT /v2/{project_id}/instances/{instance_id}/password	dcs:instance:modifyAuthInfo	-
POST /v2/{project_id}/instances/{instance_id}/password/reset	dcs:instance:modifyAuthInfo	-
GET /v2/{project_id}/instances/status	dcs:instance:list	-
PUT /v2/{project_id}/instances/status	dcs:instance:modifyStatus	-
GET /v2/{project_id}/instances/statistic	dcs:instance:list	-
POST /v2/{project_id}/instances/{instance_id}/groups/{group_id}/replications/{node_id}/slave-priority	dcs:instance:modify	-
DELETE /v2/{project_id}/instances/{instance_id}/groups/{group_id}/replications/{node_id}/remove-ip	dcs:instance:delete	-
GET /v2/{project_id}/instance/{instance_id}/groups	dcs:instance:get	-
GET /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:getConfiguration	-
PUT /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:modifyConfiguration	-
PUT /v2/{project_id}/instances/{instance_id}/async-configs	dcs:instance:modifyConfiguration	-
DELETE /v2/{project_id}/instances/{instance_id}/backups/{backup_id}	dcs:instance:deleteDataBackupFile	-
POST /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:restoreData	-
GET /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:getDataRestoreLog	-
POST /v2/{project_id}/instances/{instance_id}/backups/{backup_id}/links	dcs:instance:downloadBackupData	-
POST /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:backupData	-
GET /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:getDataBackupLog	-
POST /v2/{project_id}/migration-task	dcs:migrationTask:create	-
GET /v2/{project_id}/migration-tasks	dcs:migrationTask:list	-
DELETE /v2/{project_id}/migration-tasks/delete	dcs:migrationTask:delete	-
GET /v2/{project_id}/migration-task/{task_id}	dcs:migrationTask:get	-
POST /v2/{project_id}/migration-task/{task_id}/stop	dcs:migrationTask:modify	-
GET /v2/{project_id}/migration-task/{task_id}/stats	dcs:migrationTask:get	-
POST /v2/{project_id}/migration/instance	dcs:migrationTask:create	-
POST /v2/{project_id}/migration/{task_id}/task	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/batch-stop	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/{task_id}/sync-stop	dcs:migrationTask:modify	-
GET /v2/{project_id}/dcs/tags	dcs:tag:list	-
POST /v2/{project_id}/dcs/{instance_id}/tags/action	dcs:tag:modify	-
GET /v2/{project_id}/instances/{instance_id}/tags	dcs:tag:get	-
GET /v2/{project_id}/instances/{instance_id}/bigkey-tasks	dcs:instance:listBigKey	-
PUT /v2/{project_id}/instances/{instance_id}/bigkey/autoscan	dcs:instance:updateBigKeyAutoScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/bigkey/autoscan	dcs:instance:getBigKeyAutoScanConfig	-
POST /v2/{project_id}/instances/{instance_id}/hotkey-task	dcs:instance:analyzeHotKey	-
GET /v2/{project_id}/instances/{instance_id}/hotkey-tasks	dcs:instance:listHotKey	-
GET /v2/{project_id}/instances/{instance_id}/hotkey-task/{hotkey_id}	dcs:instance:getHotKey	-
DELETE /v2/{project_id}/instances/{instance_id}/hotkey-task/{hotkey_id}	dcs:instance:deleteHotKeyScanTask	-
PUT /v2/{project_id}/instances/{instance_id}/hotkey/autoscan	dcs:instance:updateHotKeyAutoScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/hotkey/autoscan	dcs:instance:getHotKeyAutoScanConfig	-
POST /v2/{project_id}/instances/{instance_id}/scan-expire-keys-task	dcs:instance:analyzeExpiredKey	-
GET /v2/{project_id}/instances/{instance_id}/auto-expire/histories	dcs:instance:getAutoExpiredKeyScanTask	-
POST /v2/{project_id}/instances/{instance_id}/auto-expire/scan	dcs:instance:analyzeExpiredKey	-
GET /v2/{project_id}/instances/{instance_id}/scan-expire-keys/autoscan-config	dcs:instance:getExpiredKeyScanConfig	-
PUT /v2/{project_id}/instances/{instance_id}/scan-expire-keys/autoscan-config	dcs:instance:updateExpiredKeyScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/slowlog	dcs:slowlog:list	-
GET /v2/{project_id}/instances/{instance_id}/redislog	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/redislog	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/redislog/{id}/links	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:create	-
GET /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:list	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/password/modify	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/password/reset	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/role	dcs:aclaccount:modify	-
DELETE /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:delete	-
PUT /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:modify	-
GET /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:list	-
GET /v2/{project_id}/instances/{instance_id}/tasks	dcs:instance:getBackgroundTask	-
DELETE /v2/{project_id}/instances/{instance_id}/tasks/{task_id}	dcs:instance:deleteBackgroundTask	-
GET /v2/{project_id}/quota	dcs:quota:get	-
GET /v2/{project_id}/dims/monitored-objects/{instance_id}	dcs:instance:get	-
GET /v2/{project_id}/dims/monitored-objects	dcs:instance:list	-
POST /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:createDiagnosisTask	-
GET /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:listDiagnosisTask	-
GET /v2/{project_id}/diagnosis/{report_id}	dcs:instance:getDiagnosisTask	-
DELETE /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:deleteDiagnosisTask	-
GET /v2/{project_id}/config-templates	dcs:template:list	-
POST /v2/{project_id}/config-templates	dcs:template:create	-
GET /v2/{project_id}/config-templates/{template_id}	dcs:template:get	-
DELETE /v2/{project_id}/config-templates/{template_id}	dcs:template:delete	-
PUT /v2/{project_id}/config-templates/{template_id}	dcs:template:modify	-
GET /v2/{project_id}/instances-logical-nodes	dcs:instance:list	-
GET /v2/{project_id}/instances/{instance_id}/config-histories	dcs:instance:get	-
PUT /v2/{project_id}/instances/{instance_id}/bandwidth	dcs:instance:modify	-
PUT /v2/{project_id}/instances/{instance_id}/async-swap	dcs:instance:swap	-
GET /v2/{project_id}/instances/{instance_id}/operations	dcs:instance:get	-
POST /v2/{project_id}/instances/{instance_id}/webcli/auth	dcs:instance:webcli	-
POST /v2/{project_id}/instances/{instance_id}/webcli/command	dcs:instance:webcli	-
POST /v2/{project_id}/instances/{instance_id}/webcli/logout	dcs:instance:webcli	-
PUT /v2/{project_id}/{instance_id}/client-ip-transparent-transmission	dcs:clientIpTrans:modify	-
GET /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}	dcs:instance:getBigKey	-
DELETE /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}	dcs:instance:deleteBigKeyScanTask	-
POST /v2/{project_id}/instances/{instance_id}/clients	dcs:clients:list	-
GET /v2/{project_id}/instances/{instance_id}/clients	dcs:clients:list	-
POST /v2/{project_id}/instances/{instance_id}/clients/kill	dcs:clients:kill	-
POST /v2/{project_id}/instances/{instance_id}/clients/kill-all	dcs:clients:kill	-
GET /v2/{project_id}/instances/{instance_id}/config-histories/{history_id}	dcs:instance:get	-
GET /v2/{project_id}/instances/{instance_id}/deletable-replication	dcs:instance:scale	-
POST /v2/{project_id}/instances/export	dcs:instance:list	-
GET /v2/{project_id}/instance/{instance_id}/groups/{group_id}/group-nodes-state	dcs:instance:get	-
POST /v2/{project_id}/instance/{instance_id}/groups/{group_id}/replications/{node_id}/async-switchover	dcs:instance:swap	-
GET /v2/{project_id}/instances/{instance_id}/ssl	dcs:ssl:get	-
PUT /v2/{project_id}/instances/{instance_id}/ssl	dcs:ssl:modify	-
POST /v2/{project_id}/instances/{instance_id}/ssl-certs/download	dcs:ssl:modify	-
GET /v2/{project_id}/instances/{instance_id}/tasks/{task_id}/progress	dcs:instance:getBackgroundTask	-
GET /v2/{project_id}/instances/export-job	dcs:instance:exportListFile	-
GET /v2/{project_id}/jobs/{job_id}	dcs:job:get	-
PUT /v2/{project_id}/migration-task/{task_id}	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/{task_id}/exchange-ip	dcs:migrationTask:modify	-
-	dcs:instance:scale	-
GET /v2/{project_id}/tasks	dcs:task:list	-
DELETE /v2/{project_id}/tasks/{task_id}	dcs:task:delete	-
GET /v2/{project_id}/migration-task/{task_id}/logs	dcs:migrationTask:get	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for DCS.

**Table 3** Resource types supported by DCS
Resource Type	URN
instance	dcs:<region>:<account-id>:instance:<instance-id>
migrationTask	dcs:<region>:<account-id>:migrationTask:<task-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, dcs) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by DCS

The following table lists the condition keys that you can define in identity policies for DCS. You can include these condition keys to specify conditions for when your identity policy is in effect.