Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Action

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN for the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined in EdgeSec, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by EdgeSec, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for EdgeSec.

**Table 1** EdgeSec supported actions
Action	Description	Access Level	Resource Type (*: Required)	Condition Key	Alias
edgesec::purchaseProduct	Grants permission to purchase EdgeSec products.	write	-	-	edgesec:product:put
edgesec::changeProduct	Grants permission to change EdgeSec products.	write	-	-	edgesec:product:put
edgesec:domain:create	Grants permission to create a protected domain name for EdgeSec.	write	domain *	g:EnterpriseProjectId	edgesec:wafDomain:create
edgesec:domain:get	Grants permission to query a protected domain name for EdgeSec.	read	domain *	g:EnterpriseProjectId	edgesec:wafDomain:get
edgesec:domain:listEdgeSecDomain	Grants permission to query a protected domain name for EdgeSec.	list	domain *	g:EnterpriseProjectId	edgesec:wafDomain:list
edgesec:domain:listCdnDomain	Grants permission to query a protected domain name for EdgeSec.	list	domain *	g:EnterpriseProjectId	edgesec:cdnDomain:list
edgesec:domain:update	Grants permission to update a protected domain name for EdgeSec.	write	domain *	g:EnterpriseProjectId	edgesec:wafDomain:put
edgesec:domain:delete	Grants permission to delete a protected domain name for EdgeSec.	write	domain *	g:EnterpriseProjectId	edgesec:wafDomain:delete
edgesec::getHttpAttackDistribution	Grants permission to query HTTP attack distribution statistics.	list	-	g:EnterpriseProjectId	edgesec:statistics:get
edgesec::getHttpAttackTimeline	Grants permission to query HTTP attack timeline statistics.	list	-	g:EnterpriseProjectId	edgesec:statistics:get
edgesec::getHttpAttackTop	Grants permission to query HTTP attack top statistics.	list	-	g:EnterpriseProjectId	edgesec:statistics:get
edgesec::getDomainThreatenDistribution	Grants permission to query threat statistics of domain names in three days.	list	-	-	edgesec:statistics:get
edgesec::getBotAttackDistribution	Grants permission to query bot attack distribution statistics.	list	-	g:EnterpriseProjectId	edgesec:statistics:get
edgesec::getBotAttackTimeline	Grants permission to query bot attack timeline statistics.	list	-	g:EnterpriseProjectId	edgesec:statistics:get
edgesec::getDdosAttackTimeline	Grants permission to query DDoS attack timeline statistics.	list	-	-	edgesec:statistics:get
edgesec::getOverviews	Grants permission to query requests.	list	-	-	edgesec:wafOverviewsStatistics:get
edgesec::getOverviewsQpsTimeline	Grants permission to query the QPS statistics.	list	-	-	edgesec:wafOverviewsQpsTimeline:get
edgesec::getOverviewsBandwidthTimeline	Grants permission to query the bandwidth usage statistics.	list	-	-	edgesec:wafOverviewsBandwidthTimeline:get
edgesec::getOverviewsClassification	Grants permission to query the security category information on dashboard.	list	-	-	edgesec:wafOverviewsClassification:get
edgesec::getOverviewsResponseCodeTimeline	Grants permission to query the response code statistics.	list	-	-	edgesec:wafOverviewsResponseCodeTimeline:get
edgesec::getOverviewsAbnormal	Grants permission to query service exception monitoring.	list	-	-	edgesec:wafOverviewsAbnormal:get
edgesec::listDdosLogs	Grants permission to read log data.	list	-	-	edgesec:log:get
edgesec::getLtsConfig	Grants permission to query LTS configurations.	read	-	-	edgesec:ltsconfig:get
edgesec::updateLtsConfig	Grants permission to update LTS configurations.	write	-	-	edgesec:ltsconfig:update
edgesec::getDdosLogs	Grants permission to download DDoS attack logs.	read	-	-	edgesec:log:get
edgesec::listHttpLogs	Grants permission to read HTTP attack logs.	list	-	-	edgesec:log:list
edgesec:protectionRule:createRuleSet	Grants permission to create a built-in rule sets for EdgeSec protection.	write	-	-	edgesec:managedWafRuleset:create
edgesec:protectionRule:listRuleSets	Grants permission to query a built-in rule sets for EdgeSec protection.	list	-	-	edgesec:managedWafRuleset:list
edgesec:protectionRule:deleteRuleSets	Grants permission to delete built-in rule sets for EdgeSec protection in batches.	write	-	-	edgesec:managedWafRuleset:batchDelete
edgesec:protectionRule:getRuleSet	Grants permission to query a built-in rule set for EdgeSec protection.	read	-	-	edgesec:managedWafRuleset:get
edgesec:protectionRule:updateRuleSet	Grants permission to update a built-in rule set for EdgeSec protection.	write	-	-	edgesec:managedWafRuleset:put
edgesec:protectionRule:applyRuleSet	Grants permission to update a built-in rule set for EdgeSec protection.	write	-	-	edgesec:managedWafRuleset:apply
edgesec:protectionRule:deleteRuleSet	Grants permission to delete a built-in rule set for EdgeSec protection.	write	-	-	edgesec:managedWafRuleset:delete
edgesec:protectionRule:copyRuleSet	Grants permission to copy a built-in rule set for EdgeSec protection.	write	-	-	edgesec:managedWafRuleset:copy
edgesec:protectionRule:getBotBehaviorDetectionRule	Grants permission to query EdgeSec bot protection rules.	read	-	-	edgesec:BotBehaviorDetectionRules:get
edgesec:protectionRule:getBotKnownCategoryRule	Grants permission to query EdgeSec bot protection rules.	read	-	-	edgesec:BotKnownCategoryRules:get
edgesec:protectionRule:getBotTransparentDetectionRule	Grants permission to query EdgeSec bot protection rules.	read	-	-	edgesec:BotTransparentDetectionRules:get
edgesec:protectionRule:updateBotBehaviorDetectionRule	Grants permission to update EdgeSec bot protection rules.	write	-	-	edgesec:BotBehaviorDetectionRules:update
edgesec:protectionRule:updateBotKnownCategoryRule	Grants permission to update EdgeSec bot protection rules.	write	-	-	edgesec:BotKnownCategoryRules:batchUpdate
edgesec:protectionRule:updateBotTransparentDetectionRule	Grants permission to update EdgeSec bot protection rules.	write	-	-	edgesec:BotTransparentDetectionRules:batchUpdate
edgesec:protectionRule:listIgnoreRule	Grants permission to query false alarm masking rules.	list	-	-	edgesec:wafIgnoreRule:list
edgesec:protectionRule:createIgnoreRule	Grants permission to create false alarm masking rules.	write	-	-	edgesec:wafIgnoreRule:create
edgesec:protectionRule:getIgnoreRule	Grants permission to query false alarm masking rules.	read	-	-	edgesec:wafIgnoreRule:get
edgesec:protectionRule:updateIgnoreRule	Grants permission to update false alarm masking rules.	write	-	-	edgesec:wafIgnoreRule:put
edgesec:protectionRule:recountIgnoreRule	Grants permission to reset false alarm masking rules.	write	-	-	edgesec:wafIgnoreRule:recount
edgesec:protectionRule:deleteIgnoreRule	Grants permission to delete false alarm masking rules.	write	-	-	edgesec:wafIgnoreRule:delete
edgesec:protectionRule:listPolicy	Grants permission to query protection policies.	list	-	-	edgesec:wafPolicy:list
edgesec:protectionRule:createPolicy	Grants permission to create protection policy rules.	write	-	-	edgesec:wafPolicy:create
edgesec:protectionRule:getPolicy	Grants permission to query protection policy rules.	read	-	-	edgesec:wafPolicy:get
edgesec:protectionRule:updatePolicy	Grants permission to update protection policy rules.	write	-	-	edgesec:wafPolicy:put
edgesec:protectionRule:updatePolicyDomain	Grants permission to apply domain name protection policy rules.	write	-	-	edgesec:wafPolicyDomain:put
edgesec:protectionRule:updateRuleStatus	Grants permission to apply domain name protection policy rules.	write	-	-	edgesec:wafPolicyRuleStatus:put
edgesec:protectionRule:deletePolicy	Grants permission to delete protection policy rules.	write	-	-	edgesec:wafPolicy:delete
edgesec:protectionRule:listPrivacyMaskRule	Grants permission to query privacy masking protection rules.	list	-	-	edgesec:wafPrivacyMaskRule:list
edgesec:protectionRule:createPrivacyMaskRule	Grants permission to create privacy masking protection rules.	write	-	-	edgesec:wafPrivacyMaskRule:create
edgesec:protectionRule:getPrivacyMaskRule	Grants permission to query privacy masking protection rules.	read	-	-	edgesec:wafPrivacyMaskRule:get
edgesec:protectionRule:updatePrivacyMaskRule	Grants permission to update privacy masking protection rules.	write	-	-	edgesec:wafPrivacyMaskRule:put
edgesec:protectionRule:deletePrivacyMaskRule	Grants permission to delete privacy masking protection rules.	write	-	-	edgesec:wafPrivacyMaskRule:delete
edgesec:protectionRule:listPunishmentRule	Grants permission to query known attack rules.	list	-	-	edgesec:wafPunishmentRule:list
edgesec:protectionRule:createPunishmentRule	Grants permission to create known attack rules.	write	-	-	edgesec:wafPunishmentRule:create
edgesec:protectionRule:getPunishmentRule	Grants permission to query known attack rules.	read	-	-	edgesec:wafPunishmentRule:get
edgesec:protectionRule:updatePunishmentRule	Grants permission to update known attack rules.	write	-	-	edgesec:wafPunishmentRule:put
edgesec:protectionRule:deletePunishmentRule	Grants permission to delete known attack rules.	write	-	-	edgesec:wafPunishmentRule:delete
edgesec:protectionRule:listIpGroup	Grants permission to query IP address groups.	list	-	-	edgesec:wafIpGroup:list
edgesec:protectionRule:createIpGroup	Grants permission to create IP address groups.	write	-	-	edgesec:wafIpGroup:create
edgesec:protectionRule:getIpGroup	Grants permission to query IP address groups.	read	-	-	edgesec:wafIpGroup:get
edgesec:protectionRule:updateIpGroup	Grants permission to update IP address groups.	write	-	-	edgesec:wafIpGroup:put
edgesec:protectionRule:deleteIpGroup	Grants permission to delete IP address groups.	write	-	-	edgesec:wafIpGroup:delete
edgesec:protectionRule:listValueList	Grants permission to query the reference table list.	list	-	-	edgesec:wafValueList:list
edgesec:protectionRule:createValueList	Grants the permission to create a reference table.	write	-	-	edgesec:wafValueList:create
edgesec:protectionRule:getValueList	Grants the permission to query the reference table.	read	-	-	edgesec:wafValueList:get
edgesec:protectionRule:updateValueList	Grants the permission to update the reference table.	write	-	-	edgesec:wafValueList:put
edgesec:protectionRule:deleteValueList	Grants the permission to delete the reference table.	write	-	-	edgesec:wafValueList:delete
edgesec:protectionRule:updateThirdBot	Grants the permission to update third-party BOT protection rules.	write	-	-	edgesec:wafThirdBotRule:put
edgesec:protectionRule:deleteThirdBot	Grants the permission to delete third-party BOT protection rules.	write	-	-	edgesec:wafThirdBotRule:delete
edgesec:protectionRule:listAccessControlRule	Grants the permission to query the access control protection rule sets.	list	-	-	edgesec:wafCustomRule:list
edgesec:protectionRule:listAntiCrawlerRule	Grants permission to query the anti-crawler protection rule set list.	list	-	-	edgesec:wafAntiCrawlerRule:list
edgesec:protectionRule:createAccessControlRule	Grants permission to create an access control protection rule set.	write	-	-	edgesec:wafCustomRule:create
edgesec:protectionRule:createAntiCrawlerRule	Grants permission to create an anti-crawler protection rule set.	write	-	-	edgesec:wafAntiCrawlerRule:create
edgesec:protectionRule:updateAccessControlRule	Grants permission to update an access control protection rule set.	write	-	-	edgesec:wafCustomRule:put
edgesec:protectionRule:updateAntiCrawlerRule	Grants permission to update an anti-crawler protection rule set.	write	-	-	edgesec:wafAntiCrawlerRule:put
edgesec:protectionRule:switchAntiCrawlerRule	Grants permission to update the switch of an anti-crawler protection rule set.	write	-	-	edgesec:wafAntiCrawlerRule:switch
edgesec:protectionRule:getAccessControlRule	Grants permission to query the details of an access control protection rule set.	read	-	-	edgesec:wafCustomRule:get
edgesec:protectionRule:getAntiCrawlerRule	Grants permission to query the details of an anti-crawler protection rule set.	read	-	-	edgesec:wafAntiCrawlerRule:get
edgesec:protectionRule:deleteAccessControlRule	Grants permission to delete an access control protection rule set.	write	-	-	edgesec:wafCustomRule:delete
edgesec:protectionRule:deleteAntiCrawlerRule	Grants permission to delete an anti-crawler protection rule set.	write	-	-	edgesec:wafAntiCrawlerRule:delete
edgesec:protectionRule:listGeoIpAreas	Grants permission to query the geographical locations.	list	-	-	edgesec:wafGeoIpMap:list
edgesec:protectionRule:listCcRule	Grants permission to query the CC rule list.	list	-	-	edgesec:wafCcRule:list
edgesec:protectionRule:listBlockTrustIpRule	Grants permission to query the IP address blacklist and whitelist rule list.	list	-	-	edgesec:wafWhiteBlackIpRule:list
edgesec:protectionRule:createBlockTrustIpRule	Grants permission to create an IP address blacklist and whitelist rule.	write	-	-	edgesec:wafWhiteBlackIpRule:create
edgesec:protectionRule:createCcRule	Grants permission to create a CC rule.	write	-	-	edgesec:wafCcRule:create
edgesec:protectionRule:getBlockTrustIpRule	Grants permission to query the IP address blacklist or whitelist rules.	read	-	-	edgesec:wafWhiteBlackIpRule:get
edgesec:protectionRule:getCcRule	Grants permission to query the CC rule.	read	-	-	edgesec:wafCcRule:get
edgesec:protectionRule:deleteBlockTrustIpRule	Grants permission to delete the IP address blacklist or whitelist rules.	write	-	-	edgesec:wafWhiteBlackIpRule:delete
edgesec:protectionRule:deleteCcRule	Grants permission to delete the CC rule.	write	-	-	edgesec:wafCcRule:delete
edgesec:protectionRule:updateBlockTrustIpRule	Grants permission to update the IP address blacklist or whitelist rules.	write	-	-	edgesec:wafWhiteBlackIpRule:put
edgesec:protectionRule:updateCcRule	Grants permission to update the CC rule.	write	-	-	edgesec:wafCcRule:put

Each API of EdgeSec usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by APIs
API	Action	Dependency
GET /v1/edgesec/log/ddos-attack-logs	edgesec::listDdosLogs	-
POST /v1/edgesec/configuration/domains	edgesec:domain:create	-
PUT /v1/edgesec/configuration/domains/{domain_id}	edgesec:domain:update	-
DELETE /v1/edgesec/configuration/domains/{domain_id}	edgesec:domain:delete	-
GET /v1/edgesec/configuration/domains/{domain_id}	edgesec:domain:get	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule	edgesec:protectionRule:listAccessControlRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule	edgesec:protectionRule:createAccessControlRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule/batch-update	edgesec:protectionRule:updateAccessControlRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule/{rule_id}	edgesec:protectionRule:getAccessControlRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule/{rule_id}	edgesec:protectionRule:updateAccessControlRule	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}/access-control-rule/{rule_id}	edgesec:protectionRule:deleteAccessControlRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/blocktrustip-rule	edgesec:protectionRule:listBlockTrustIpRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/blocktrustip-rule	edgesec:protectionRule:createBlockTrustIpRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/blocktrustip-rule/{rule_id}	edgesec:protectionRule:getBlockTrustIpRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/blocktrustip-rule/{rule_id}	edgesec:protectionRule:updateBlockTrustIpRule	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}/blocktrustip-rule/{rule_id}	edgesec:protectionRule:deleteBlockTrustIpRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule	edgesec:protectionRule:listCcRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule	edgesec:protectionRule:createCcRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule/batch-update	edgesec:protectionRule:updateCcRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule/{rule_id}	edgesec:protectionRule:getCcRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule/{rule_id}	edgesec:protectionRule:updateCcRule	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}/cc-rule/{rule_id}	edgesec:protectionRule:deleteCcRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule	edgesec:protectionRule:listIgnoreRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule	edgesec:protectionRule:createIgnoreRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule/{rule_id}	edgesec:protectionRule:getIgnoreRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule/{rule_id}	edgesec:protectionRule:updateIgnoreRule	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule/{rule_id}	edgesec:protectionRule:deleteIgnoreRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/ignore-rule/{rule_id}/recount	edgesec:protectionRule:recountIgnoreRule	-
GET /v1/edgesec/configuration/http/policies	edgesec:protectionRule:listPolicy	-
POST /v1/edgesec/configuration/http/policies	edgesec:protectionRule:createPolicy	-
GET /v1/edgesec/configuration/http/policies/{policy_id}	edgesec:protectionRule:getPolicy	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}	edgesec:protectionRule:updatePolicy	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}	edgesec:protectionRule:deletePolicy	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/hosts	edgesec:protectionRule:updatePolicyDomain	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/{rule_type}/{rule_id}/status	edgesec:protectionRule:updateRuleStatus	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/punishment-rule	edgesec:protectionRule:listPunishmentRule	-
POST /v1/edgesec/configuration/http/policies/{policy_id}/punishment-rule	edgesec:protectionRule:createPunishmentRule	-
GET /v1/edgesec/configuration/http/policies/{policy_id}/punishment-rule/{rule_id}	edgesec:protectionRule:getPunishmentRule	-
PUT /v1/edgesec/configuration/http/policies/{policy_id}/punishment-rule/{rule_id}	edgesec:protectionRule:updatePunishmentRule	-
DELETE /v1/edgesec/configuration/http/policies/{policy_id}/punishment-rule/{rule_id}	edgesec:protectionRule:deletePunishmentRule	-
GET /v1/edgesec/configuration/http/ip-groups	edgesec:protectionRule:listIpGroup	-
POST /v1/edgesec/configuration/http/ip-groups	edgesec:protectionRule:createIpGroup	-
GET /v1/edgesec/configuration/http/ip-groups/{ip_group_id}	edgesec:protectionRule:getIpGroup	-
PUT /v1/edgesec/configuration/http/ip-groups/{ip_group_id}	edgesec:protectionRule:updateIpGroup	-
DELETE /v1/edgesec/configuration/http/ip-groups/{ip_group_id}	edgesec:protectionRule:deleteIpGroup	-
GET /v1/edgesec/configuration/http/reference-table	edgesec:protectionRule:listValueList	-
POST /v1/edgesec/configuration/http/reference-table	edgesec:protectionRule:createValueList	-
GET /v1/edgesec/configuration/http/reference-table/{table_id}	edgesec:protectionRule:getValueList	-
PUT /v1/edgesec/configuration/http/reference-table/{table_id}	edgesec:protectionRule:updateValueList	-
DELETE /v1/edgesec/configuration/http/reference-table/{table_id}	edgesec:protectionRule:deleteValueList	-
GET /v1/edgesec/stat/http-attack-distribution	edgesec::getHttpAttackDistribution	-
GET /v1/edgesec/stat/http-attack-timelines	edgesec::getHttpAttackTimeline	-
GET /v1/edgesec/stat/http-attack-top	edgesec::getHttpAttackTop	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy is applied to all resources. You can also set condition keys in an identity policy to define resource types.

The table below lists the resource types that you can define in identity policy statements for EdgeSec.