IoT Device Access (IoTDA)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by IoTDA, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about condition keys defined by IoTDA, see Conditions.

The following table lists the actions that you can define in SCP statements for IoTDA.

**Table 1** Actions supported by IoTDA
Action	Description	Access Level	Resource Type	Condition Key
iotda:products:create	Creating a product	write	app	g:EnterpriseProjectId
iotda:products:queryList	Querying the product list	list	app	g:EnterpriseProjectId
iotda:products:query	Querying a product	read	app	g:EnterpriseProjectId
iotda:products:modify	Modifying a product	write	app	g:EnterpriseProjectId
iotda:products:delete	Deleting a product	write	app	g:EnterpriseProjectId
iotda:devices:register	Creating a device	write	app	g:EnterpriseProjectId
iotda:devices:queryList	Querying the device list	list	app	g:EnterpriseProjectId
iotda:devices:query	Querying a device	read	app	g:EnterpriseProjectId
iotda:devices:modify	Modifying a device	write	app	g:EnterpriseProjectId
iotda:devices:delete	Deleting a device	write	app	g:EnterpriseProjectId
iotda:devices:resetSecret	Resetting a device secret	write	app	g:EnterpriseProjectId
iotda:devices:freeze	Freezing a device	write	app	g:EnterpriseProjectId
iotda:devices:unfreeze	Unfreezing a device	write	app	g:EnterpriseProjectId
iotda:devices:resetFingerprint	Resetting a device fingerprint	write	app	g:EnterpriseProjectId
iotda:devices:queryList	Querying device list flexibly	list	app	g:EnterpriseProjectId
iotda:messages:send	Delivering a device message	write	app	g:EnterpriseProjectId
iotda:messages:queryList	Querying device messages	list	app	g:EnterpriseProjectId
iotda:messages:query	Querying a message by message ID	read	app	g:EnterpriseProjectId
iotda:message:broadcast	Broadcasting a message	write	app	g:EnterpriseProjectId
iotda:commands:send	Delivering a device command	write	app	g:EnterpriseProjectId
iotda:asynccommands:send	Delivering an asynchronous command	write	app	g:EnterpriseProjectId
iotda:asynccommands:query	Querying a command with a specific ID	read	app	g:EnterpriseProjectId
iotda:properties:modify	Modifying device properties	write	app	g:EnterpriseProjectId
iotda:properties:query	Querying device properties	read	app	g:EnterpriseProjectId
iotda:shadow:query	Querying device shadow data	read	app	g:EnterpriseProjectId
iotda:shadow:config	Configuring desired device shadow data	write	app	g:EnterpriseProjectId
iotda:amqpqueue:create	Creating an AMQP queue	write	-	g:EnterpriseProjectId
iotda:amqpqueue:queryList	Querying the AMQP list	list	-	g:EnterpriseProjectId
iotda:amqpqueue:query	Querying an AMQP queue	read	-	g:EnterpriseProjectId
iotda:amqpqueue:delete	Deleting an AMQP queue	write	-	g:EnterpriseProjectId
iotda:accesscode:create	Generating an access credential	write	-	g:EnterpriseProjectId
iotda:routingrules:create	Creating a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingrules:queryList	Querying the rule triggering condition list	list	app	g:EnterpriseProjectId
iotda:routingrules:query	Querying a rule triggering condition	read	app	g:EnterpriseProjectId
iotda:routingrules:modify	Modifying a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingrules:delete	Deleting a rule triggering condition	write	app	g:EnterpriseProjectId
iotda:routingactions:create	Creating a rule action	write	app	g:EnterpriseProjectId iotda:HttpForwardingEnableSSL iotda:HttpForwardingEnableAuthentication iotda:DMSKafkaForwardingEnableAuthentication iotda:DMSKafkaForwardingEnableSSL iotda:MysqlForwardingEnableSSL iotda:MRSKafkaForwardingEnableAuthentication iotda:DMSRocketMQForwardingEnableSSL iotda:MongoDBForwardingEnableSSL
iotda:routingactions:queryList	Querying the rule action list	list	app	g:EnterpriseProjectId
iotda:routingactions:query	Querying a rule action	read	app	g:EnterpriseProjectId
iotda:routingactions:modify	Modifying a rule action	write	app	g:EnterpriseProjectId iotda:HttpForwardingEnableSSL iotda:HttpForwardingEnableAuthentication iotda:DMSKafkaForwardingEnableAuthentication iotda:DMSKafkaForwardingEnableSSL iotda:MysqlForwardingEnableSSL iotda:MRSKafkaForwardingEnableAuthentication iotda:DMSRocketMQForwardingEnableSSL iotda:MongoDBForwardingEnableSSL
iotda:routingactions:delete	Deleting a rule action	write	app	g:EnterpriseProjectId
iotda:rules:create	Creating a rule	write	-	g:EnterpriseProjectId
iotda:rules:queryList	Querying the rule list	list	-	g:EnterpriseProjectId
iotda:rules:modify	Modifying a rule	write	-	g:EnterpriseProjectId
iotda:rules:query	Querying a rule	read	-	g:EnterpriseProjectId
iotda:rules:delete	Deleting a rule	write	-	g:EnterpriseProjectId
iotda:rules:modifyStatus	Modifying the rule status	write	-	g:EnterpriseProjectId
iotda:group:create	Adding a device group	write	app	g:EnterpriseProjectId
iotda:group:queryList	Querying the device group list	list	app	g:EnterpriseProjectId
iotda:group:query	Querying a device group	read	app	g:EnterpriseProjectId
iotda:group:modify	Modifying a device group	write	app	g:EnterpriseProjectId
iotda:group:delete	Deleting a device group	write	app	g:EnterpriseProjectId
iotda:group:addDevice	Managing devices in a device group	write	app	g:EnterpriseProjectId
iotda:group:queryDeviceList	Querying devices in a device group	list	app	g:EnterpriseProjectId
iotda:tags:bind	Binding a tag	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:tags:unbind	Unbinding a tag	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:tags:queryResourceList	Querying resources by tag	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
iotda:apps:queryList	Querying the resource space list	list	app	g:EnterpriseProjectId
iotda:app:create	Creating a resource space	write	app	g:EnterpriseProjectId
iotda:apps:query	Querying a resource space	read	app	g:EnterpriseProjectId
iotda:apps:delete	Deleting a resource space	write	app	g:EnterpriseProjectId
iotda:batchtasks:create	Creating a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:queryList	Querying the batch task list	list	-	g:EnterpriseProjectId
iotda:batchtasks:query	Querying a batch task	read	-	g:EnterpriseProjectId
iotda:batchtasks:retry	Retrying a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:stop	Stopping a batch task	write	-	g:EnterpriseProjectId
iotda:batchtasks:delete	Deleting a batch task	write	-	g:EnterpriseProjectId
iotda:batchtaskfiles:create	Uploading a batch task file	write	-	g:EnterpriseProjectId
iotda:batchtaskfiles:queryList	Querying the list of batch task files	list	-	g:EnterpriseProjectId
iotda:batchtaskfiles:delete	Deleting a batch task file	write	-	g:EnterpriseProjectId
iotda:certificates:upload	Uploading a device CA certificate	write	app	g:EnterpriseProjectId
iotda:certificates:queryList	Obtaining the device CA certificate list	list	app	g:EnterpriseProjectId
iotda:certificates:delete	Deleting a device CA certificate	write	app	g:EnterpriseProjectId
iotda:certificates:check	Verifying a device CA certificate	write	app	g:EnterpriseProjectId
iotda:otapackages:create	Creating an OTA upgrade package	write	-	g:EnterpriseProjectId
iotda:otapackages:queryList	Querying the OTA upgrade package list	list	-	g:EnterpriseProjectId
iotda:otapackages:query	Obtaining OTA upgrade package details	read	-	g:EnterpriseProjectId
iotda:otapackages:delete	Deleting an OTA upgrade package	write	-	g:EnterpriseProjectId
iotda:tunnel:queryList	Querying the tunnel list	list	-	g:EnterpriseProjectId
iotda:tunnel:create	Creating a device tunnel	write	-	g:EnterpriseProjectId iotda:DeviceGroupId
iotda:tunnel:delete	Deleting a device tunnel	write	-	g:EnterpriseProjectId
iotda:tunnel:query	Querying tunnel details	read	-	g:EnterpriseProjectId
iotda:tunnel:update	Modifying a device tunnel	write	-	g:EnterpriseProjectId
iotda:instance:create	Creating an instance	write	-	g:EnterpriseProjectId g:TagKeys g:RequestTag/<tag-key>
iotda:instance:update	Modifying an Instance	write	-	g:EnterpriseProjectId g:ResourceTag/<tag-key> iotda:AllowPublicAccess iotda:AllowPublicForwarding iotda:DomainConfiguration
iotda:instance:query	Querying instance details	read	instance	g:EnterpriseProjectId g:ResourceTag/<tag-key>
iotda:instance:queryList	Querying the instance list	read	-	-
iotda:instance:delete	Deleting an instance	write	instance	g:EnterpriseProjectId g:ResourceTag/<tag-key>
iotda:instance:operateTag	Performing operations on instance tags	write	instance	g:EnterpriseProjectId g:TagKeys g:RequestTag/<tag-key>

Each API of IoTDA usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by IoTDA APIs
API	Action	Dependencies
POST /v5/iot/{project_id}/products	iotda:products:create	-
GET /v5/iot/{project_id}/products	iotda:products:queryList	-
GET /v5/iot/{project_id}/products/{product_id}	iotda:products:query	-
PUT /v5/iot/{project_id}/products/{product_id}	iotda:products:modify	-
DELETE /v5/iot/{project_id}/products/{product_id}	iotda:products:delete	-
POST /v5/iot/{project_id}/devices	iotda:devices:register	-
GET /v5/iot/{project_id}/devices	iotda:devices:queryList	-
GET /v5/iot/{project_id}/devices/{device_id}	iotda:devices:query	-
PUT /v5/iot/{project_id}/devices/{device_id}	iotda:devices:modify	-
DELETE /v5/iot/{project_id}/devices/{device_id}	iotda:devices:delete	-
POST /v5/iot/{project_id}/devices/{device_id}/action	iotda:devices:resetSecret	-
POST /v5/iot/{project_id}/devices/{device_id}/freeze	iotda:devices:freeze	-
POST /v5/iot/{project_id}/devices/{device_id}/unfreeze	iotda:devices:unfreeze	-
POST /v5/iot/{project_id}/devices/{device_id}/reset-fingerprint	iotda:devices:resetFingerprint	-
POST /v5/iot/{project_id}/search/query-devices	iotda:devices:queryList	-
POST /v5/iot/{project_id}/devices/{device_id}/messages	iotda:messages:send	-
GET /v5/iot/{project_id}/devices/{device_id}/messages	iotda:messages:queryList	-
GET /v5/iot/{project_id}/devices/{device_id}/messages/{message_id}	iotda:messages:query	-
POST /v5/iot/{project_id}/broadcast-messages	iotda:message:broadcast	-
POST /v5/iot/{project_id}/devices/{device_id}/commands	iotda:commands:send	-
POST /v5/iot/{project_id}/devices/{device_id}/async-commands	iotda:asynccommands:send	-
GET /v5/iot/{project_id}/devices/{device_id}/async-commands/{command_id}	iotda:asynccommands:query	-
PUT /v5/iot/{project_id}/devices/{device_id}/properties	iotda:properties:modify	-
GET /v5/iot/{project_id}/devices/{device_id}/properties	iotda:properties:query	-
GET /v5/iot/{project_id}/devices/{device_id}/shadow	iotda:shadow:query	-
PUT /v5/iot/{project_id}/devices/{device_id}/shadow	iotda:shadow:config	-
POST /v5/iot/{project_id}/amqp-queues	iotda:amqpqueue:create	-
GET /v5/iot/{project_id}/amqp-queues	iotda:amqpqueue:queryList	-
GET /v5/iot/{project_id}/amqp-queues/{queue_id}	iotda:amqpqueue:query	-
DELETE /v5/iot/{project_id}/amqp-queues/{queue_id}	iotda:amqpqueue:delete	-
POST /v5/iot/{project_id}/auth/accesscode	iotda:accesscode:create	-
POST /v5/iot/{project_id}/routing-rule/rules	iotda:routingrules:create	-
GET /v5/iot/{project_id}/routing-rule/rules	iotda:routingrules:queryList	-
GET /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:query	-
PUT /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:modify	-
DELETE /v5/iot/{project_id}/routing-rule/rules/{rule_id}	iotda:routingrules:delete	-
POST /v5/iot/{project_id}/routing-rule/actions	iotda:routingactions:create	-
GET /v5/iot/{project_id}/routing-rule/actions	iotda:routingactions:queryList	-
GET /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:query	-
PUT /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:modify	-
DELETE /v5/iot/{project_id}/routing-rule/actions/{action_id}	iotda:routingactions:delete	-
POST /v5/iot/{project_id}/rules	iotda:rules:create	-
GET /v5/iot/{project_id}/rules	iotda:rules:queryList	-
PUT /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:modify	-
GET /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:query	-
DELETE /v5/iot/{project_id}/rules/{rule_id}	iotda:rules:delete	-
PUT /v5/iot/{project_id}/rules/{rule_id}/status	iotda:rules:modifyStatus	-
POST /v5/iot/{project_id}/device-group	iotda:group:create	-
GET /v5/iot/{project_id}/device-group	iotda:group:queryList	-
GET /v5/iot/{project_id}/device-group/{group_id}	iotda:group:query	-
PUT /v5/iot/{project_id}/device-group/{group_id}	iotda:group:modify	-
DELETE /v5/iot/{project_id}/device-group/{group_id}	iotda:group:delete	-
POST /v5/iot/{project_id}/device-group/{group_id}/action	iotda:group:addDevice	-
GET /v5/iot/{project_id}/device-group/{group_id}/devices	iotda:group:queryDeviceList	-
POST /v5/iot/{project_id}/tags/bind-resource	iotda:tags:bind	-
POST /v5/iot/{project_id}/tags/unbind-resource	iotda:tags:unbind	-
POST /v5/iot/{project_id}/tags/query-resources	iotda:tags:queryResourceList	-
GET /v5/iot/{project_id}/apps	iotda:apps:queryList	-
POST /v5/iot/{project_id}/apps	iotda:app:create	-
GET /v5/iot/{project_id}/apps/{app_id}	iotda:apps:query	-
DELETE /v5/iot/{project_id}/apps/{app_id}	iotda:apps:delete	-
POST /v5/iot/{project_id}/batchtasks	iotda:batchtasks:create	-
GET /v5/iot/{project_id}/batchtasks	iotda:batchtasks:queryList	-
GET /v5/iot/{project_id}/batchtasks/{task_id}	iotda:batchtasks:query	-
POST /v5/iot/{project_id}/batchtasks/{task_id}/retry	iotda:batchtasks:retry	-
POST /v5/iot/{project_id}/batchtasks/{task_id}/stop	iotda:batchtasks:stop	-
DELETE /v5/iot/{project_id}/batchtasks/{task_id}	iotda:batchtasks:delete	-
POST /v5/iot/{project_id}/batchtask-files	iotda:batchtaskfiles:create	-
GET /v5/iot/{project_id}/batchtask-files	iotda:batchtaskfiles:queryList	-
DELETE /v5/iot/{project_id}/batchtask-files/{file_id}	iotda:batchtaskfiles:delete	-
POST /v5/iot/{project_id}/certificates	iotda:certificates:upload	-
GET /v5/iot/{project_id}/certificates	iotda:certificates:queryList	-
DELETE /v5/iot/{project_id}/certificates/{certificate_id}	iotda:certificates:delete	-
POST /v5/iot/{project_id}/certificates/{certificate_id}/action	iotda:certificates:check	-
POST /v5/iot/{project_id}/ota-upgrades/packages	iotda:otapackages:create	-
GET /v5/iot/{project_id}/ota-upgrades/packages	iotda:otapackages:queryList	-
GET /v5/iot/{project_id}/ota-upgrades/packages/{package_id}	iotda:otapackages:query	-
DELETE /v5/iot/{project_id}/ota-upgrades/packages/{package_id}	iotda:otapackages:delete	-
GET /v5/iot/{project_id}/tunnels	iotda:tunnel:queryList	-
POST /v5/iot/{project_id}/tunnels	iotda:tunnel:create	-
DELETE /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:delete	-
GET /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:query	-
PUT /v5/iot/{project_id}/tunnels/{id}	iotda:tunnel:update	-
POST /v5/iot/{project_id}/iotda-instances	iotda:instance:create	-
PUT /v5/iot/{project_id}/iotda-instances/{instance_id}	iotda:instance:update	-
GET /v5/iot/{project_id}/iotda-instances/{instance_id}	iotda:instance:query	-
GET /v5/iot/{project_id}/iotda-instances	iotda:instance:queryList	-
DELETE /v5/iot/{project_id}/iotda-instances/{instance_id}	iotda:instance:delete	-
POST /v5/iot/{project_id}/iotda-instances/{instance_id}/bind-tags	iotda:instance:operateTag	-
POST /v5/iot/{project_id}/iotda-instances/{instance_id}/unbind-tags	iotda:instance:operateTag	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

**Table 3** Resource types supported by IoTDA
Resource Type	URN
app	iotda:<region>:<account-id>:app:<app-id>
instance	iotda:<region>:<account-id>:instance:<instance-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, IoTDA:) apply only to operations of the service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in SCPs for IoTDA. You can include these condition keys to specify conditions for when your SCP is in effect.

**Table 4** Condition keys supported by IoTDA
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
iotda:AllowPublicAccess	Boolean	Single-valued	Filters requests based on the configuration that is set during instance modification. Condition: allowing public network access.
iotda:AllowPublicForwarding	Boolean	Single-valued	Filters requests based on the configuration that is set during instance modification. Condition: allowing public network forwarding.
iotda:DomainConfiguration	Boolean	Single-valued	Filters requests based on the configuration that is set during instance modification. Condition: domain names.
iotda:DeviceGroupId	String	Single-valued	Filters requests based on the configuration that is set during tunnel creation. Condition: device associated groups.
iotda:HttpForwardingEnableSSL	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling the TLS protocol for HTTP channels.
iotda:HttpForwardingEnableAuthentication	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling token authentication for HTTP channels.
iotda:DMSKafkaForwardingEnableAuthentication	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling SCRAM-SHA-512 mechanism for DMS Kafka channels.
iotda:DMSKafkaForwardingEnableSSL	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling the TLS protocol for DMS Kafka channels.
iotda:MysqlForwardingEnableSSL	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling the TLS protocol for MySQL channels.
iotda:MRSKafkaForwardingEnableAuthentication	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling Kerberos authentication for MRS Kafka channels.
iotda:DMSRocketMQForwardingEnableSSL	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling the TLS protocol for RocketMQ channels.
iotda:MongoDBForwardingEnableSSL	Boolean	Single-valued	Filters requests based on the configuration that is set during rule action creation/modification. Condition: enabling the TLS protocol for MongoDB channels.