Configuring an Access Control Policy

Overview

Access control allows you to control the IP addresses and accounts used to access APIs, protecting backend services. You can create an access control policy to allow or deny the access of certain IP addresses or accounts to an API.

An access control policy and an API are independent of each other. An access control policy takes effect for an API only after it is bound to the API.

An API can be bound only to one access control policy of the same restriction type in an environment, but each access control policy can be bound to multiple APIs.

Creating an Access Control Policy

1. Log in to the ROMA Connect console. On the Instances page, click View Console of an instance.
2. In the navigation pane on the left, choose API Connect > API Management. On the Access Control Policies tab page, click Create.
3. In the Create Access Control Policy dialog box, configure policy information.

   Table 1 Parameters for creating an access control policy

   Parameter	Description
   Name	Enter an access control policy name. It is recommended that you enter a name based on naming rules to facilitate search.
   Restriction Type	Select the restriction type of the access control policy. IP address: restricts API calling by IP address. Account name: restricts API calling by account name. This option is available only to APIs using IAM authentication. The restriction also applies to the IAM users under the specified accounts. IAM users cannot be specified separately.
   Effect	Select the access control type. This parameter is used along with Restriction Type. Allow: Only specified IP addresses or accounts are allowed to call APIs. Deny: Specified IP addresses or accounts are not allowed to call APIs.
   IP Address	This parameter is mandatory only if Restriction Type is set to IP address. Click Add IP Address to add the IP addresses or IP address segments that are allowed or forbidden to call an API.
   Account Name	This parameter is mandatory only if Restriction Type is set to Account name. Enter the account names that are allowed or forbidden to call an API. Use commas (,) to separate multiple account names. You can click the username in the upper right corner of the console and choose My Credentials to obtain the account name of the user on the My Credentials page.

4. Click OK.

   After the access control policy is created, you also need to perform the operations described in Binding an Access Control Policy to an API to make the policy take effect for the API.

Binding an Access Control Policy to an API

1. Log in to the ROMA Connect console. On the Instances page, click View Console of an instance.
2. In the navigation pane on the left, choose API Connect > API Management. On the Access Control Policies tab page, click Bind to API.
3. On the Bind to API page, click Select API.
4. In the Select API dialog box, select the APIs to which the access control policy is to be bound in the specified environment.

   APIs can be filtered by API group, environment, and API name.

5. Click OK.