Identity Policy-based Authorization

IAM provides system-defined identity policies to define common permissions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set permissions boundaries for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Action

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in a policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CSS, see Resource Type.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about condition keys defined by CSS, see Condition.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can control access to APIs that support policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for CSS.

**Table 1** Actions supported by CSS
Action	Description	Access Level	Resource Type (*: Required)	Condition Key	Alias
css:VPCEndpoint:updateWhitelist	Grant the permission to update an existing whitelist of VPC endpoints.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:updateBackupPolicy	Grant the permission to modify or delete log backups.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:setSnapshotPolicy	Grant the permission to set backup policies.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:getSnapshotPolicy	Grant the permission to query backup policies.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:restore	Grant the permission to restore data from a snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:create	Grant the permission to create a snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:associates	Grant the permission to enable or disable public access.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:setAccessControl	Grant the permission to manage whitelists for access control.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:get	Grant the permission to query resource tags.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:modifyBandwidth	Grant the permission to modify the bandwidth size.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:VPCEndpoint:enableOrDisable	Grant the permission to create or delete a VPCEP.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:getBasicConfigurations	Grant the permission to query basic configurations.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:list	Grant the permission to list snapshots.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:list	Grant the permission to view logs.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:setSnapshotContiguration	Grant the permission to set basic snapshot configurations.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listFlavors	Grant the permission to list flavor IDs.	List	-	-	css:cluster:showFlavor
css:cluster:listDiskType	Grant the permission to list available disk types.	List	-	-	-
css:tag:list	Grant the permission to query project tags.	List	cluster *	-	-
css:VPCEndpoint:manageConnection	Grant the permission to configure the connection of the endpoint.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:listJob	Grant the permission to list jobs.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:downloadCert	Grant the permission to obtain the content of a certificate.	Read	-	-	-
css:cluster:get	Grant the permission to query cluster details.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:getInstance
css:snapshot:enableAtomaticSnapsot	Grant the permission to set basic configurations for automatic snapshot backup.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:delete	Grant the permission to delete a specified snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:get	Grant the permission to view the custom word dictionary configuration.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:restart	Grant the permission to restart an Elasticsearch cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifySecurityGroup	Grant the permission to modify the cluster security group.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:list	Grant the permission to query parameter settings.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:delete	Grant the permission to delete a cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifySpecifications	Grant the permission to modify cluster specifications.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:list	Grant the permission to list cluster information.	List	cluster *	-	css:cluster:getInstances
css:cluster:scaleOut	Grant the permission to scale out a cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:load	Grant the permission to load a custom word dictionary.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:modify	Grant the permission to update parameter settings.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:get	Grant the permission to list parameters.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:delete	Grant the permission to delete a word dictionary.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:expand	Grant the permission to scale out the quantity and storage capacity of instances.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:disableSnapshotFuction	Grant the permission to disable the cluster snapshot function.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:upgradeCluster	Grant the permission to upgrade clusters or replace nodes.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:VPCEndpoint:listConnection	Grant the permission to query VPCEP connections.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:scaleIn	Grant the permission to scale in a cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:setBasicConfigurations	Grant the permission to set basic configurations.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:addOrDelete	Grant the permission to add or delete resource tags in batches.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:addOrDelete		Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
css:publicKibana:close	Grant the permission to disable public access.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:edit	Grant the permission to modify cluster tags.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:edit	Grant the permission to modify cluster tags.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
css:cluster:create	Grant the permission to create a cluster.	Write	cluster *	-	-
css:cluster:create	Grant the permission to create a cluster.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
css:cluster:toPeriod	Grant the permission to change the billing mode of a cluster to yearly/monthly.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifyName	Grant the permission to change the cluster name.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:backup	Grant the permission to back up logs.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:closeLogSetting	Grant the permission to disable logging.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:log:enableOrDisableLogFunction
css:cluster:connectivityTest	Grant the permission to test the connectivity.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:openLogSetting	Grant the permission to enable logging.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:log:enableOrDisableLogFunction
css:cluster:modifyPassword	Grant the permission to change the cluster password.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:disassociates	Grant the permission to unbind public networks.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicKibana:open	Grant the permission to bind public networks.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:delete	Grant the permission to delete a tag.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:delete	Grant the permission to delete a tag.	Tagging	-	g:TagKeys	-
css:cluster:shrinkNodes	Grant the permission to scale in a specified node.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:changeMode	Grant the permission to modify the security mode.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:addIndependenceNodes	Grant the permission to add independent master and client nodes.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:rollingReboot	Grant the permission to perform a rolling restart of an Elasticsearch cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:rollingRestart
css:logstash:listActions	Grant the permission to query operation records.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:uploadCerts	Grant the permission to upload certificates.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:deleteCerts	Grant the permission to delete certificates.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listCerts	Grant the permission to list certificates.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:getCertsList
css:cluster:getCertsDetail	Grant the permission to query certificate details.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:deleteConfTemplate	Grant the permission to delete a custom template.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listConfigTemplate	Grant the permission to list templates.	List	-	-	css:logstash:configListTemplate
css:logstash:confStop	Grant the permission to stop or hot-stop pipeline tasks for data migration.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:checkConnection	Grant the permission to test the connectivity.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confDelete	Grant the permission to delete configuration files.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confStart	Grant the permission to start or hot-start pipeline tasks for data migration.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:getConfDetail	Grant the permission to query the content of configuration files.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:azmigrate	Grant the permission to switch AZs.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confUpdate	Grant the permission to update configuration files.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listPipelines	Grant the permission to list pipelines.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:retryAction	Grant the permission to retry a task or terminate the impact of a task.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listConfs	Grant the permission to list configuration files.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:configFavorites	Grant the permission to add items to a custom template.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listUpgradeCluster	Grant the permission to obtain the upgrade image ID and upgrade details.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:submitConf	Grant the permission to create configuration files.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:list	Grant the permission to list cluster plug-ins.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:getOperationRecords	Grant the permission to query the plug-in operation records.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:delete	Grant the permission to delete plug-ins.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:installOrUninstall	Grant the permission to install or uninstall plug-ins.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:upload	Grant the permission to upload plug-ins.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:getDefault	Grant the permission to query default plug-ins.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getAgencies	Grant the permission to obtain agents.	Read	-	-	-
css:cluster:modifyRoute	Grant the permission to modify cluster routes.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getRoutes	Grant the permission to obtain the cluster routes.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:actionList	Grant the permission to list cluster tasks.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:createUserInfo	Grant the permission to query information about a created user.	Write	cluster *	-	-
css:VPCEndpoint:modifyConnections	Grant the permission to modify the connection size.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:queryNeedDeleteInstances	Grant the permission to query the node to be deleted.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:queryKey	Grant the permission to obtain keys.	Read	-	-	-
css:cluster:queryKeys	Grant the permission to list keys.	List	-	-	-
css:cluster:getPubliczonePice	Grant the permission to obtain the bandwidth price.	Read	cluster *	-	-
css:datastore:get	Grant the permission to obtain the data engine.	Read	cluster *	-	-
css:datastore:list	Grant the permission to list data engines.	List	cluster *	-	-
css:publicIPAddress:enableOrDisableIPv6Function	Grant the permission to enable or disable IPv6.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getDiskUsage	Grant the permission to obtain the cluster storage capacity status.	Read	cluster *	-	-
css:snapshot:showDetail	Grant the permission to obtain snapshot details.	Read	cluster *	-	-
css:cluster:getAvailableBuckets	Grant the permission to obtain an available OBS bucket.	List	-	-	-
css:cluster:checkCssName	Grant the permission to check cluster names.	Write	cluster *	-	-
css:snapshot:deleteAllFailedTask	Grant the permission to delete all failed tasks.	Write	-	-	-
css:snapshot:deleteSingleFailedTask	Grant the permission to delete specified failed tasks.	Write	-	-	-
css:snapshot:getAllFailedTask	Grant the permission to view failed backup tasks.	List	-	-	-
css::createServiceAgency	Grant the permission to create agencies.	Write	-	-	css:cluster:createServiceAgency
css:cluster:createAiOps	Grant the permission to create detection tasks.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listAiOps	Grant the permission to list detection tasks.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:deleteAiOps	Grant the permission to delete detection tasks.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listSmnTopics	Grant the permission to list SMN topics.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listElbs	Grant the permission to list available load balancers for the current cluster.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:elbSwitch	Grant the permission to enable or disable load balancing.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:createElbListener	Grant the permission to create listeners for the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:updateElbListener	Grant the permission to modify listeners for the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getElbDetail	Grant the permission to query information about load balancers used by the current cluster.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listElbCerts	Grant the permission to list load balancer certificates.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:changeSubnet	Grant the permission to modify the subnet of the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getAccessPolicy	Grant the permission to obtain the access control policies of the current cluster.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:updateAccessPolicy	Grant the permission to modify the access control policies of the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:updateAiOpsSetting	Grant the permission to update scheduled check settings for intelligent O&M.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:closeAiOpsSetting	Grant the permission to disable scheduled check for intelligent O&M.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:showAiOpsSetting	Grant the permission to check scheduled check settings for intelligent O&M.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:showAiOpsDetector	Grant the permission to check intelligent O&M check items.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:create	Grant the permission to create a cluster.	Write	cluster *	-	-
css:cluster:restart	Grant the permission to restart an Elasticsearch cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:rollingReboot	Grant the permission to perform a rolling restart of an Elasticsearch cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:rollingRestart
css:snapshot:setSnapshotPolicy	Grant the permission to set backup policies.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confDelete	Grant the permission to delete configuration files.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:deleteConfTemplate	Grant the permission to delete a custom template.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getAccessPolicy	Grant the permission to obtain the access control policies of the current cluster.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:updateAccessPolicy	Grant the permission to modify the access control policies of the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-

Each API of CSS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies
API	Action	Dependency
POST /v1.0/{project_id}/clusters	css:cluster:create	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:securityGroups:list vpc:securityGroups:get vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get sfsturbo:shares:getAllShares kms:cmk:listGrants kms:cmk:createGrant kms:cmk:list kms:cmk:get css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v2.0/{project_id}/clusters	css:cluster:create	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:securityGroups:list vpc:securityGroups:get vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get kms:cmk:listGrants kms:cmk:createGrant kms:cmk:list kms:cmk:get css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/sg/change	css:cluster:modifySecurityGroup	vpc:securityGroups:list vpc:ports:update
GET /v1.0/{project_id}/clusters	css:cluster:list	-
GET /v1.0/{project_id}/clusters/{cluster_id}	css:cluster:get	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}	css:cluster:delete	-
POST /v1.0/{project_id}/cluster/{cluster_id}/period	css:cluster:toPeriod	-
POST /v1.0/{project_id}/clusters/{cluster_id}/changename	css:cluster:modifyName	-
POST /v1.0/{project_id}/clusters/{cluster_id}/password/reset	css:cluster:modifyPassword	-
POST /v1.0/{project_id}/clusters/{cluster_id}/restart	css:cluster:restart	-
POST /v2.0/{project_id}/clusters/{cluster_id}/restart	css:cluster:restart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/reboot	css:cluster:restart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/extend	css:cluster:scaleOut	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get kms:cmk:get
POST /v1.0/{project_id}/clusters/{cluster_id}/role_extend	css:cluster:expand	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get kms:cmk:get
POST /v1.0/{project_id}/clusters/{cluster_id}/flavor	css:cluster:modifySpecifications	ecs:cloudServerFlavors:get kms:cmk:get
GET /v1.0/{project_id}/es-flavors	css:cluster:listFlavors	ecs:cloudServerFlavors:get
GET /v1.0/{project_id}/{resource_type}/tags	css:tag:list	-
GET /v1.0/{project_id}/{resource_type}/{cluster_id}/tags	css:tag:get	-
POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags	css:tag:edit	-
DELETE /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/{key}	css:tag:delete	-
POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/action	css:tag:addOrDelete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/{types}/flavor	css:cluster:modifySpecifications	ecs:cloudServerFlavors:get kms:cmk:get
POST /v1.0/extend/{project_id}/clusters/{cluster_id}/role/shrink	css:cluster:scaleIn	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
GET /v1.0/{project_id}/cer/download	css:cluster:downloadCert	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/instance/{instance_id}/replace	css:cluster:upgradeCluster	ecs:cloudServerFlavors:get evs:types:get kms:cmk:get iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/node/offline	css:cluster:shrinkNodes	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/mode/change	css:cluster:changeMode	-
POST /v1.0/{project_id}/clusters/{cluster_id}/type/{type}/independent	css:cluster:addIndependenceNodes	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get
POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/image/upgrade	css:cluster:upgradeCluster	ecs:cloudServerFlavors:get evs:types:get kms:cmk:get iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/azmigrate	css:cluster:azmigrate	ecs:cloudServerFlavors:get evs:types:get kms:cmk:get iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
GET /v1.0/{project_id}/clusters/{cluster_id}/upgrade/detail	css:cluster:listUpgradeCluster	-
GET /v1.0/{project_id}/clusters/{cluster_id}/target/{upgrade_type}/images	css:cluster:listUpgradeCluster	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/upgrade/{action_id}/retry	css:cluster:retryAction	ecs:cloudServerFlavors:get evs:types:get
GET /v1.0/{project_id}/disktypes	css:cluster:listDiskType	evs:types:get
POST /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:load	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy obs:object:getObject
GET /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:get	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:delete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/open	css:publicKibana:open	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/close	css:publicKibana:close	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/bandwidth	css:publicIPAddress:modifyBandwidth	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/update	css:publicIPAddress:setAccessControl	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/close	css:publicIPAddress:setAccessControl	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/open	css:cluster:openLogSetting	iam:agencies:pass obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies
PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/close	css:cluster:closeLogSetting	-
GET /v1.0/{project_id}/clusters/{cluster_id}/logs/records	css:log:listJob	-
GET /v1.0/{project_id}/clusters/{cluster_id}/logs/settings	css:log:getBasicConfigurations	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/settings	css:log:setBasicConfigurations	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/update	css:log:updateBackupPolicy	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/close	css:log:updateBackupPolicy	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/collect	css:log:backup	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/search	css:log:list	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/connectivity	css:cluster:connectivityTest	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/open	css:publicIPAddress:associates	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/public/close	css:publicIPAddress:disassociates	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/bandwidth	css:publicIPAddress:modifyBandwidth	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/update	css:publicIPAddress:setAccessControl	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/close	css:publicIPAddress:setAccessControl	-
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/auto_setting	css:snapshot:enableAtomaticSnapsot	obs:bucket:createBucket obs:bucket:headBucket iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgency
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/setting	css:snapshot:setSnapshotContiguration	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot	css:snapshot:create	iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}/restore	css:snapshot:restore	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}	css:snapshot:delete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy	css:snapshot:setSnapshotPolicy	-
GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy	css:snapshot:getSnapshotPolicy	-
GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots	css:snapshot:list	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots	css:snapshot:disableSnapshotFuction	-
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/open	css:VPCEndpoint:enableOrDisable	vpcep:endpoints:create vpcep:endpoints:list vpcep:endpoints:get vpcep:endpoints:delete vpcep:endpoints:update
PUT /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/close	css:VPCEndpoint:enableOrDisable	vpcep::listQuotas vpcep:endpoints:create vpcep:endpoints:list vpcep:endpoints:get vpcep:endpoints:delete vpcep:endpoints:update
GET /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections	css:VPCEndpoint:listConnection	vpcep:endpoints:get
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections	css:VPCEndpoint:manageConnection	-
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/permissions	css:VPCEndpoint:updateWhitelist	-
POST /v1.0/{project_id}/clusters/{cluster_id}/ymls/update	css:configurations:modify	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/joblists	css:configurations:list	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/template	css:configurations:get	-
POST /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/open	css:snapshot:setSnapshotPolicy	-
PUT /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/close	css:snapshot:setSnapshotPolicy	-
POST /v2.0/{project_id}/clusters/{cluster_id}/rolling_restart	css:cluster:rollingReboot	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listactions	css:logstash:listActions	-
DELETE /v1.0/{project_id}/lgsconf/deletetemplate	css:logstash:deleteConfTemplate	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/stop	css:logstash:confStop	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-stop	css:logstash:confStop	-
POST /v1.0/{project_id}/clusters/{cluster_id}/checkconnection	css:logstash:checkConnection	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/delete	css:logstash:confDelete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/start	css:logstash:confStart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-start	css:logstash:confStart	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/confdetail	css:logstash:getConfDetail	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/update	css:logstash:confUpdate	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listpipelines	css:logstash:listPipelines	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/submit	css:logstash:submitConf	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/favorite	css:logstash:configFavorites	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listconfs	css:logstash:listConfs	-
GET /v1.0/{project_id}/lgsconf/template	css:logstash:listConfigTemplate	-
POST /v1.0/{project_id}/clusters/{cluster_id}/certs/upload	css:cluster:uploadCerts	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}/delete	css:cluster:deleteCerts	-
GET /v1.0/{project_id}/clusters/{cluster_id}/certs	css:cluster:listCerts	-
GET /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}	css:cluster:getCertsDetail	-
POST /v1.0/{project_id}/clusters/{cluster_id}/route	css:cluster:modifyRoute	-
GET /v1.0/{project_id}/clusters/{cluster_id}/route	css:cluster:getRoutes	-
POST /v1.0/{project_id}/agency/create	css::createServiceAgency	iam:agencies:listAgencies iam:agencies:createAgency iam:agencies:getAgency iam:roles:listRoles iam:roles:createRole iam:permissions:grantRoleToAgency iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:permissions:revokeRoleFromAgency iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/ai-ops	css:cluster:createAiOps	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops	css:cluster:listAiOps	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/{aiops_id}	css:cluster:deleteAiOps	-
GET /v1.0/{project_id}/domains/{domain_id}/ai-ops/smn-topics	css:cluster:listSmnTopics	-
GET /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers	css:cluster:listElbs	elb:loadbalancers:list
POST /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers/es-switch	css:cluster:elbSwitch	elb:loadbalancers:list iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/es-listeners	css:cluster:createElbListener	-
GET /v1.0/{project_id}/clusters/{cluster_id}/es-listeners	css:cluster:getElbDetail	-
GET /v1.0/{project_id}/clusters/{cluster_id}/elb/certificates	css:cluster:listElbCerts	-
POST /v1.0/{project_id}/clusters/{cluster_id}/subnet/change	css:cluster:changeSubnet	-
GET /v1.0/{project_id}/clusters/{cluster_id}/volume	css:cluster:getDiskUsage	-
GET /v1.0/{project_id}/resize-flavors	css:cluster:listFlavors	-
GET /v1.0/{project_id}/flavors/{flavor_id}	css:cluster:listFlavors	-
GET /v1.0/{project_id}/datastore/{datastore_id}/flavors	css:cluster:listFlavors	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/detector	css:cluster:showAiOpsDetector	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/setting	css:cluster:showAiOpsSetting	-
POST /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/setting	css:cluster:updateAiOpsSetting	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/close	css:cluster:closeAiOpsSetting	-
POST /v2.0/{project_id}/clusters	css:cluster:create	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:securityGroups:list vpc:securityGroups:get vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get kms:cmk:listGrants kms:cmk:createGrant kms:cmk:list kms:cmk:get css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v2.0/{project_id}/clusters/{cluster_id}/restart	css:cluster:restart	-
POST /v2.0/{project_id}/clusters/{cluster_id}/rolling-restart	css:cluster:rollingReboot	-
POST /v2.0/{project_id}/clusters/{cluster_id}/rolling_restart	css:cluster:rollingReboot	-
POST /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/open	css:snapshot:setSnapshotPolicy	-
PUT /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/close	css:snapshot:setSnapshotPolicy	-
POST /v2.0/{project_id}/clusters/{cluster_id}/lgsconf/delete	css:logstash:confDelete	-
POST /v2.0/{project_id}/lgsconf/deletetemplate	css:logstash:deleteConfTemplate	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/es-listeners/{listener_id}	css:cluster:updateElbListener	-

Resource Type

A resource is used to define the scope of resources to which an identity policy applies. If a specific resource type has been specified for an operation listed in Table 3, then when you select and fill in the corresponding resource URN in an identity policy statement containing that operation, the identity policy will only take effect on that specified resource. If the corresponding resource URN is not filled in, the identity policy will take effect on all resources under the specified resource type. If no resource type is specified, the default value of Resource is *, and the identity policy will apply to all resources. Additionally, you can set conditions in the identity policy to further refine the resource type.

The following table lists the resource types that you can define in identity policy statements for CSS.

**Table 3** Resource types supported by CSS
Resource Type	URN
cluster	css:<region>:<account-id>:cluster:<cluster-id>

Condition

About condition keys

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

Condition keys are the key values in the Condition element of an identity policy statement. Condition keys are classified into global condition keys and service-specific condition keys based on the application scope.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, css:) apply only to operations of the service. For details, see Table 4.
- A condition key is single-valued if an API request provides only one piece of data for it, and multivalued if the request provides a list of multiple values. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, a condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

Service-specific condition keys supported by CSS

The following table lists the condition keys that you can define in custom identity policies for CSS. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by CSS
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
css:AssociatePublicIp	boolean	Single-valued	Filter access permissions based on whether public access is enabled for the instance.

Example condition keys

css:AssociatePublicIp

Example: Disallow the creation of CSS clusters that have an EIP associated with it.

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "css:cluster:create"
      ],
      "Condition": {
        "Bool": {
          "css:AssociatePublicIp": [
            "true"
          ]
        }
      }
    }
  ]
}

Example: Disallow the association of an EIP with a CSS cluster.

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "css:publicIPAddress:associates",
        "css:publicKibana:open"
      ]
    }
  ]
}

Parent topic: Permissions and Supported Actions

Previous topic: Policy-Based Authorization

Next topic: Appendixes

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

For any further questions, feel free to contact us through the chatbot.

Chatbot