Why Am I Getting a Permission Error Message?
CDN allows you to manage services by using IAM users or enterprise projects. If you encounter errors about missing permissions, follow the guidelines described in this section.
Possible Permission Errors
- An enterprise master account may fail to call cross-service APIs due to missing permissions for the target services. For instance, to use an OBS private bucket as a CDN origin server or to configure an SCM certificate, you must first grant the necessary agency authorizations for OBS or SCM.
Solution: Create an agency by following the instructions in OBS Authorization or SCM Authorization. Alternatively, you can call the API for Modifying the Tenant Configuration to create an agency and then perform related operations.
- An IAM user may fail to perform operations or query information about a domain name due to missing permissions.
Solution: Review the error message to identify which permissions are missing, and then grant the required permissions to the IAM user by referring to Creating a User and Granting CDN Permissions.
- Check the permissions and actions supported by CDN in Permissions Supported by CDN and Actions Supported by CDN.
- An account enabled with the enterprise project function fails to perform some operations due to missing permissions.
Solution: Identify the missing permissions based on the error message and grant the permissions to the enterprise project by referring to Authorizing a User to Manage an Enterprise Project.
- Check the permissions and actions supported by CDN in Permissions Supported by CDN and Actions Supported by CDN.
- Check whether your account has outstanding payments.If your account has outstanding payments and is in the grace period, you cannot change domain settings. If your account has outstanding payments and is in the retention period, the system will disable CDN for your domain names and stop the acceleration service. If your account has outstanding payments and the retention period expires, CDN will delete your domain names.
Role/Policy-based Authorization
CDN supports authorization with roles and policies. New IAM users do not have any permissions assigned by default. You need to first add them to one or more groups and attach policies or roles to these groups. The users then inherit permissions from the groups and can perform specified operations on cloud services based on the permissions they have been assigned.
CDN is a global service deployed and accessed without specifying any physical region. When you set the authorization scope to Global services, users have permission to access CDNs in all regions.
Table 1 lists all the system-defined permissions for CDN. System-defined policies in the two authorization models are not interoperable.
| Role/Policy Name | Description | Type | Dependencies |
|---|---|---|---|
| CDN LogsReadOnlyAccess | Read-only permissions for the CDN log service | System-defined policy | None |
| CDN RefreshAndPreheatAccess | Cache purge and prefetch permissions | System-defined policy | None |
| CDN Administrator | Full permissions for CDN | System-defined role | None |
| CDN ReadOnlyAccess | Read-only permissions for all CDN services | System-defined policy | None |
| CDN FullAccess | Full permissions for CDN | System-defined policy | None |
| CDN StatisticsReadOnlyAccess | Read-only permissions for the CDN statistics service | System-defined policy | None |
| CDN DomainConfiguration | Permissions for configuring domain names | System-defined policy | None |
| CDN DomainReadOnlyAccess | Read-only permissions on domain names | System-defined policy | None |
Table 2 lists the common operations supported by system-defined permissions for CDN.
| Operation | CDN Administrator | CDN ReadOnlyAccess | CDN StatisticsReadOnlyAccess | CDN LogsReadOnlyAccess | CDN DomainConfiguration | CDN RefreshAndPreheatAccess | CDN FullAccess | CDN DomainReadOnlyAccess |
|---|---|---|---|---|---|---|---|---|
| Querying the billing option | Supported | Supported | Supported | Supported | Supported | Supported | Supported | Supported |
| Creating or modifying the billing option | Supported | Not supported | Not supported | Not supported | Not supported | Not supported | Supported | Not supported |
| Querying domain name statistics | Supported | Supported | Supported | Not supported | Not supported | Not supported | Supported | Not supported |
| Querying logs | Supported | Supported | Not supported | Supported | Not supported | Not supported | Supported | Not supported |
| Querying full configuration of a domain name | Supported | Supported | Not supported | Not supported | Supported | Not supported | Supported | Supported |
| Modifying full configuration of a domain name | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Not supported |
| Creating a domain name | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Not supported |
| Querying account information | Supported | Supported | Not supported | Not supported | Supported | Not supported | Supported | Supported |
| Modifying account information | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Supported |
When you want to acquire the CDN DomainConfiguration or CDN RefreshAndPreheatAccess policy, ensure that you also acquire the CDN DomainReadOnlyAccess policy. Otherwise, you cannot view the domain names, and thus cannot configure, or purge or prefetch cache for domain names.
Identity Policy-based Authorization
CDN supports authorization with identity policies. Table 3 lists all the system-defined policies for CDN in identity policy-based authorization. System-defined identity policies and system-defined policies in the two authorization models are not interoperable.
| Policy Name | Description | Type |
|---|---|---|
| CDNAdministratorPolicy | Full permissions for CDN | System-defined identity policy |
| CDNReadOnlyPolicy | Read-only permissions for all CDN services | System-defined identity policy |
| CDNStatisticsReadOnlyPolicy | Read-only permissions for the CDN statistics service | System-defined identity policy |
| CDNLogsReadOnlyPolicy | Read-only permissions for the CDN log service | System-defined identity policy |
| CDNDomainConfigurationPolicy | Permissions for configuring domain names | System-defined identity policy |
| CDNRefreshAndPreheatPolicy | Cache purge and prefetch permissions | System-defined identity policy |
| CDNFullPolicy | Full permissions for CDN | System-defined identity policy |
| CDNDomainReadOnlyPolicy | Read-only permissions on domain names | System-defined identity policy |
| CDNChargeConfigurationPolicy | Permission for enabling CDN billing and modifying and querying the billing option | System-defined identity policy |
Table 4 lists the common operations supported by system-defined identity policies for CDN.
| Operation | CDNAdministratorPolicy | CDNReadOnlyPolicy | CDNStatisticsReadOnlyPolicy | CDNLogsReadOnlyPolicy | CDNDomainConfigurationPolicy | CDNRefreshAndPreheatPolicy | CDNFullPolicy | CDNDomainReadOnlyPolicy | CDNChargeConfigurationPolicy |
|---|---|---|---|---|---|---|---|---|---|
| Querying the billing option | Supported | Supported | Supported | Supported | Supported | Supported | Supported | Supported | Supported |
| Creating or modifying the billing option | Supported | Not supported | Not supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported |
| Querying domain name statistics | Supported | Supported | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Not supported |
| Querying logs | Supported | Supported | Not supported | Supported | Not supported | Not supported | Supported | Not supported | Not supported |
| Querying full configuration of a domain name | Supported | Supported | Not supported | Not supported | Supported | Not supported | Supported | Supported | Supported |
| Modifying full configuration of a domain name | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Not supported | Not supported |
| Creating a domain name | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Not supported | Not supported |
| Querying account information | Supported | Supported | Not supported | Not supported | Supported | Not supported | Supported | Supported | Not supported |
| Modifying account information | Supported | Not supported | Not supported | Not supported | Supported | Not supported | Supported | Supported | Not supported |
When you want to acquire CDN DomainConfigurationPolicy or CDN RefreshAndPreheatPolicy, ensure that you also acquire CDN DomainReadOnlyPolicy. Otherwise, you cannot view the domain names, and thus cannot configure, or purge or prefetch cache for domain names.
CDN Actions Supported by Identity Policy-based Authorization
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Creating a cache prefetch task | POST /v1.0/cdn/content/preheating-tasks | cdn:configuration:preheatCache | Supported | Supported |
| Creating a cache prefetch task (old) | POST /v1.0/cdn/preheatingtasks | cdn:configuration:preheatCache | Supported | Supported |
| Querying a cache purge or prefetch task | GET /v1.0/cdn/historytasks/{history_tasks_id}/detail | cdn:configuration:queryCacheHistoryTask | Supported | Not supported |
| Querying cache purge or prefetch tasks | GET /v1.0/cdn/historytasks | cdn:configuration:queryCacheHistoryTask | Supported | Not supported |
| Querying cache purge and prefetch records | GET /v1.0/cdn/contentgateway/url-tasks | cdn:configuration:queryRefreshAndPreheatHistoryTask | Supported | Not supported |
| Creating a cache purge task | POST /v1.0/cdn/content/refresh-tasks | cdn:configuration:refreshCache | Supported | Supported |
| Creating a cache purge task (old) | POST /v1.0/cdn/refreshtasks | cdn:configuration:refreshCache | Supported | Supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Associating a certificate with multiple domain names | PUT /v1.0/cdn/domains/config-https-info | cdn:configuration:ModifyHttpsConf | Supported | Supported |
| Exporting the domain name list to an excel file | POST /v1.0/cdn/configuration/domains/export | cdn:configuration:exportBasicConfigs | Supported | Supported |
| Copying domain configuration | POST /v1.0/cdn/configuration/domains/batch-copy | cdn:configuration:modifyDomainConfigs | Supported | Supported |
| Checking IP address information | GET /v1.0/cdn/ip-info | cdn:configuration:queryDomains | Supported | Not supported |
| Listing resource tags | GET /v1.0/cdn/configuration/tags | cdn:configuration:queryTags cdn:configuration:queryDomains | Supported | Supported |
| Deleting resource tags | POST /v1.0/cdn/configuration/tags/batch-delete | cdn:configuration:deleteTags cdn:configuration:modifyTags | Supported | Supported |
| Creating a resource tag | POST /v1.0/cdn/configuration/tags | cdn:configuration:modifyTags | Supported | Supported |
| Querying domain name configuration (new) | GET /v1.0/cdn/configuration/domains | cdn:configuration:queryDomainList cdn:configuration:queryDomains | Supported | Supported |
| Adding/Modifying response headers | PUT /v1.0/cdn/domains/{domain_id}/response-header | cdn:configuration:createResHeader | Supported | Supported |
| Configuring cache rules | PUT /v1.0/cdn/domains/{domain_id}/cache | cdn:configuration:modifyCacheRule | Supported | Supported |
| Querying domain names associated with HTTPS certificates | GET /v1.0/cdn/domains/https-certificate-info | cdn:configuration:queryDomainList cdn:configuration:queryHttpsConf | Supported | Supported |
| Configuring HTTPS | PUT /v1.0/cdn/domains/{domain_id}/https-info | cdn:configuration:modifyHttpsConf | Supported | Supported |
| Setting an IP ACL | PUT /v1.0/cdn/domains/{domain_id}/ip-acl | cdn:configuration:modifyIpAcl | Supported | Supported |
| Modifying the full domain configuration | PUT /v1.1/cdn/configuration/domains/{domain_name}/configs | cdn:configuration:modifyOriginConfInfo | Supported | Supported |
| Enabling or disabling redirect from origin | PUT /v1.0/cdn/domains/{domain_id}/follow302-switch | cdn:configuration:modifyOriginConfInfo | Supported | Supported |
| Modifying the host | PUT /v1.0/cdn/domains/{domain_id}/originhost | cdn:configuration:modifyOriginConfInfo | Supported | Supported |
| Modifying the status of private bucket access | PUT /v1.0/cdn/domains/{domain_id}/private-bucket-access | cdn:configuration:modifyOriginConfInfo | Supported | Supported |
| Enabling or disabling range requests | PUT /v1.0/cdn/domains/{domain_id}/range-switch | cdn:configuration:modifyOriginConfInfo | Supported | Supported |
| Modifying origin server information | PUT /v1.0/cdn/domains/{domain_id}/origin | cdn:configuration:modifyOriginServerInfo | Supported | Supported |
| Configuring referer validation rules | PUT /v1.0/cdn/domains/{domain_id}/referer | cdn:configuration:modifyReferConf | Supported | Supported |
| Querying cache rules | GET /v1.0/cdn/domains/{domain_id}/cache | cdn:configuration:queryCacheRule | Supported | Supported |
| Querying the domain name configuration | GET /v1.1/cdn/configuration/domains/{domain_name}/configs | cdn:configuration:queryDomains | Supported | Supported |
| Querying the HTTPS settings | GET /v1.0/cdn/domains/{domain_id}/https-info | cdn:configuration:queryHttpsConf | Supported | Supported |
| Querying the IP ACL | GET /v1.0/cdn/domains/{domain_id}/ip-acl | cdn:configuration:queryIpAcl | Supported | Supported |
| Querying the host | GET /v1.0/cdn/domains/{domain_id}/originhost | cdn:configuration:queryOriginConfInfo | Supported | Supported |
| Querying referer validation rules | GET /v1.0/cdn/domains/{domain_id}/referer | cdn:configuration:queryReferConf | Supported | Supported |
| Querying response headers | GET /v1.0/cdn/domains/{domain_id}/response-header | cdn:configuration:queryResponseHeaderList | Supported | Supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Creating a domain name | POST /v1.0/cdn/domains | cdn:configuration:createDomains | Supported | Supported |
| Disabling CDN for a domain name | PUT /v1.0/cdn/domains/{domain_id}/disable | cdn:configuration:disableDomains | Supported | Supported |
| Enabling CDN for a domain name | PUT /v1.0/cdn/domains/{domain_id}/enable | cdn:configuration:enableDomains | Supported | Supported |
| Deleting domain names | DELETE /v1.0/cdn/domains/{domain_id} | cdn:configuration:deleteDomains | Supported | Supported |
| Querying domain names | GET /v1.0/cdn/domains | cdn:configuration:queryDomainList cdn:configuration:queryDomain | Supported | Supported |
| Querying details about a domain name | GET /v1.0/cdn/configuration/domains/{domain_name} | cdn:configuration:queryDomains | Supported | Supported |
| Querying details about a domain name (old) | GET /v1.0/cdn/domains/{domain_id}/detail | cdn:configuration:queryDomains | Supported | Supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Querying basic domain name statistics | GET /v1.0/cdn/statistics/domain-stats | cdn:statistics:queryStats | Supported | Supported |
| Querying domain name statistics by region and carrier | GET /v1.0/cdn/statistics/domain-location-stats | cdn:statistics:queryStats | Supported | Supported |
| Querying top 100 URLs | GET /v1.0/cdn/statistics/top-url | cdn:statistics:queryTopUrl | Supported | Supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Querying logs | GET /v1.0/cdn/logs | cdn:log:queryLogs | Supported | Supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Configuring the billing option | PUT /v1.0/cdn/charge/charge-modes | cdn:charge:modifyChargeMode | Supported | Not supported |
| Querying the billing option | GET /v1.0/cdn/charge/charge-modes | cdn:charge:queryChargeMode | Supported | Not supported |
| Permission | API | Action | IAM Project | Enterprise Project |
|---|---|---|---|---|
| Querying quotas | GET /v1.0/cdn/quota | cdn:configuration:queryQuota | Supported | Not supported |
CDN Actions Supported by Identity Policy-based Authorization
| Action | Description | Access Level | Resource Type (*: required) | Condition Key | Alias |
|---|---|---|---|---|---|
| cdn:statistics:queryStats | Querying domain name statistics | list | domain * | cdn:statistics:queryTopUrl | |
| cdn:statistics:downloadExcel | Downloading domain name statistics | list | domain * | - | |
| cdn:log:queryLogs | Querying logs | read | domain * | - | |
| cdn:charge:modifyChargeMode | Creating or modifying the billing option | write | - | - | cdn:configuration:modifyChargeMode |
| cdn:charge:queryChargeMode | Querying the billing option | list | - | - | cdn:configuration:queryChargeMode |
| cdn:statistics:querySubscriptionTasks | Listing operations reports | list | - | - | - |
| cdn:statistics:createSubscriptionTasks | Creating an operations report | write | domain * | - | - |
| cdn:statistics:updateSubscriptionTasks | Modifying an operations report | write | domain * | - | - |
| cdn:statistics:deleteSubscriptionTasks | Deleting an operations report | write | - | - | - |
| cdn:configuration:queryDomainList | Listing domain names | list | domain * | cdn:configuration:queryDomains | |
| cdn:configuration:queryDomains | Querying details about a domain name | read | domain * | - | |
| cdn:configuration:modifyDomainConfigs | Modifying domain name configuration | write | domain * | - | |
| cdn:configuration:modifyOriginConfInfo | Modifying the origin server settings | write | domain * | - | |
| cdn:log:queryLogs | Querying logs | read | domain * | - | |
| cdn:statistics:queryStats | Querying domain name statistics | list | domain * | cdn:statistics:queryTopUrl | |
| cdn:configuration:queryDomainList | Listing domain names | list | domain * | cdn:configuration:queryDomains | |
| cdn:configuration:createDomains | Creating a domain name | write | domain * | - | |
| cdn:configuration:queryDomains | Querying details about a domain name | read | domain * | - | |
| cdn:configuration:deleteDomains | Deleting a domain name | write | domain * | - | |
| cdn:configuration:disableDomains | Disabling CDN for a domain name | write | domain * | - | |
| cdn:configuration:enableDomains | Enabling CDN for a domain name | write | domain * | - | |
| cdn:configuration:modifyOriginServerInfo | Modifying the origin server information | write | domain * | - | |
| cdn:configuration:modifyOriginConfInfo | Modifying the origin server settings | write | domain * | - | |
| cdn:configuration:queryOriginConfInfo | Querying the origin server settings | read | domain * | - | |
| cdn:configuration:modifyReferConf | Modifying the referer whitelist | write | domain * | - | |
| cdn:configuration:queryReferConf | Querying the referer whitelist | read | domain * | - | |
| cdn:configuration:queryIpAcl | Querying the IP ACL | list | domain * | - | |
| cdn:configuration:modifyIpAcl | Modifying the IP ACL | write | domain * | - | |
| cdn:configuration:queryCacheRule | Listing cache rules | list | domain * | - | |
| cdn:configuration:modifyCacheRule | Modifying a cache rule | write | domain * | - | |
| cdn:configuration:modifyHttpsConf | Modifying the certificate of a domain name | write | domain * | - | |
| cdn:configuration:queryHttpsConf | Querying the HTTPS settings | read | domain | - | |
| cdn:configuration:queryIpInfo | Querying the IP address information | list | - | - | cdn:configuration:queryDomains |
| cdn:configuration:createResHeader | Creating a response header | write | domain * | - | |
| cdn:configuration:queryResponseHeaderList | Querying response headers | read | domain * | - | |
| cdn:configuration:batchModifyHttpsConf | Modifying certificates of domain names | write | domain * | cdn:configuration:modifyHttpsConf | |
| cdn:configuration:queryTags | Listing domain name tags | list | domain * | cdn:configuration:queryDomains | |
| cdn:configuration:modifyTags | Modifying resource tags | tagging | domain * | - | |
| cdn:configuration:deleteTags | Deleting resource tags | tagging | domain * | cdn:configuration:modifyTags | |
| cdn:configuration:refreshCache | Purging the cache | write | - | - | |
| cdn:configuration:queryRefreshAndPreheatHistoryTask | Querying a cache purge or prefetch task | list | - | - | cdn:configuration:queryCacheHistoryTask |
| cdn:configuration:queryCacheHistoryTask | Querying historical cache tasks | list | - | - | - |
| cdn:configuration:preheatCache | Modifying cache prefetch settings | write | - | - | |
| cdn:configuration:queryQuota | Querying quotas of domain names, cache purge by file, cache purge by directory, and cache prefetch | list | - | - | cdn:configuration:queryDomains |
What is your overall rating for this page?
Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot
