Cloud Firewall (CFW)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit a custom SCP policy, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of an SCP statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CFW, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by CFW, see Conditions.

The following table lists the actions that you can define in SCP statements for CFW

**Table 1** Actions supported by CFW
Action	Description	Access Level	Resource Type (*: required)	Condition Key
cfw:acl:createAclRule	Grants permission to create an acl rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:deleteAclRule	Grants permission to delete an acl rule.	write	acl *	-
cfw:acl:deleteAclRule	Grants permission to delete an acl rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:deleteHitCount	Grants permission to delete acl rule hit count.	write	acl *	-
cfw:acl:deleteHitCount	Grants permission to delete acl rule hit count.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listDomainParseServers	Grants permission to get domain parse server.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getDomainParseResult	Grants permission to parse domain.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:getExportStatus	Grants permission to get acl export status.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:getImportStatus	Grants permission to get acl import status.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:getImportTemplate	Grants permission to get acl import template.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:listAclRules	Grants permission to list acl rules.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:listAclTags	Grants permission to list acl rule tags.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:updateAclRule	Grants permission to update acl rule.	write	acl *	-
cfw:acl:updateAclRule	Grants permission to update acl rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:updateAclRuleAction	Grants permission to update acl rule action.	write	acl *	-
cfw:acl:updateAclRuleAction	Grants permission to update acl rule action.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateDomainParseServer	Grants permission to update domain parse server.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:acl:setPriority	Grants permission to set acl rule priority.	write	acl *	-
cfw:acl:setPriority	Grants permission to set acl rule priority.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:blackWhiteList:create	Grants permission to create blackwhite list.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:blackWhiteList:delete	Grants permission to delete blackwhite list.	write	blackWhiteList *	-
cfw:blackWhiteList:delete	Grants permission to delete blackwhite list.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:blackWhiteList:list	Grants permission to list blackwhite lists.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:blackWhiteList:update	Grants permission to update blackwhite list.	write	blackWhiteList *	-
cfw:blackWhiteList:update	Grants permission to update blackwhite list.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:domainGroup:update	Grants permission to update domainGroup.	write	domainGroup *	-
cfw:domainGroup:update	Grants permission to update domainGroup.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:domainGroup:create	Grants permission to create domainGroup.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:domainGroup:delete	Grants permission to delete domainGroup.	write	domainGroup *	-
cfw:domainGroup:delete	Grants permission to delete domainGroup.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:domainGroup:list	Grants permission to list domainGroup.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:eip:count	Grants permission to get eip statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:eip:list	Grants permission to list eip.	list	instance *	g:ResourceTag/<tag-key>
cfw:eip:updateProtectStatus	Grants permission to change eip protect status.	write	eip *	-
cfw:eip:updateProtectStatus	Grants permission to change eip protect status.	write	-	g:EnterpriseProjectId
cfw:instance:checkNameRepeat	Grants permission to check if cfw name repeat.	read	-	-
cfw:instance:listAdvanceIpsRules	Grants permission to list cfw advance ips rules.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listUsedEr	Grants permission to list used er.	list	-	-
cfw:instance:listUsedInspectionVpc	Grants permission to list used vpc.	list	-	-
cfw:instance:addLogConfig	Grants permission to add CFW log config.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:addLogConfig	Grants permission to add CFW log config.	write	-	cfw:LogGroupId
cfw:instance:updateCustomRule	Grants permission to update CFW custom ips rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateCustomRuleAction	Grants permission to update CFW custom ips rule action.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateLogConfig	Grants permission to update CFW LTS log config.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateLogConfig	Grants permission to update CFW LTS log config.	write	-	cfw:LogGroupId
cfw:instance:createInstance	Grants permission to create an CFW instance.	write	instance *	-
cfw:instance:createInstance	Grants permission to create an CFW instance.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
cfw:instance:deletePostPaidInstance	Grants permission to delete post paid CFW instance.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:createCaptureTask	Grants permission to create CFW capture task.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:createCustomRule	Grants permission to create CFW custom rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:createTags	Grants permission to create CFW tags.	tagging	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cfw:instance:createTags	Grants permission to create CFW tags.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cfw:instance:deleteInstance	Grants permission to delete CFW instance.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteCaptureTask	Grants permission to delete CFW capture task.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteCustomRule	Grants permission to delete CFW custom ips rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteLogSearchHistory	Grants permission to delete CFW log search history.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteTags	Grants permission to delete CFW tags.	tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteTags	Grants permission to delete CFW tags.	tagging	-	g:TagKeys
cfw:instance:exportLog	Grants permission to export log.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listInstanceByTags	Grants permission to list cfw by tags.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listInstanceByTags	Grants permission to list cfw by tags.	list	-	g:TagKeys
cfw:instance:getBaseVersion	Grants permission to get cfw base version.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getCaptureTaskResult	Grants permission to get cfw capture task result.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getCustomRule	Grants permission to get cfw custom rule.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getDomainParseServerStatus	Grants permission to get cfw domain parse server status.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getIpsMode	Grants permission to get cfw ips mode.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getIpsStatus	Grants permission to get cfw ips status.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getLogConfig	Grants permission to get cfw log config.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getMaxCapturePacketNum	Grants permission to get cfw user max capture packet number.	read	-	-
cfw:instance:getPolicyStatistics	Grants permission to get cfw policy statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listProjectTags	Grants permission to list project tags.	list	-	-
cfw:instance:getRegionDb	Grants permission to get cfw region db.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listInstanceTags	Grants permission to list cfw tags.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listInstance	Grants permission to list CFW instances.	list	instance *	-
cfw:instance:getInstance	Grants permission to get CFW instances detail.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listAccessControlLog	Grants permission to list CFW access control log.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listAttackLog	Grants permission to list CFW attack log.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listCaptureTask	Grants permission to list CFW capture tasks.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listCustomRule	Grants permission to list CFW custom ips rule.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getEw	Grants permission to get cfw east-west firewall.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listFlowLog	Grants permission to list cfw flow log.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listIpsRule	Grants permission to list cfw ips rules.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listProtectedVpc	Grants permission to list cfw protect vpcs.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateIpsMode	Grants permission to update cfw ips mode.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateAdvanceIpsRule	Grants permission to update cfw advance ips rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateIpsRuleAction	Grants permission to update cfw ips rule mode.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateIpsStatus	Grants permission to update cfw ips status.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateEwProtectedStatus	Grants permission to update cfw east-west firewall protect status.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:saveTags	Grants permission to save cfw tags.	tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:saveTags	Grants permission to save cfw tags.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cfw:instance:startBaseVersion	Grants permission to start cfw base version.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:stopBaseVersion	Grants permission to stop cfw base version.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:stopCaptureTask	Grants permission to stop cfw capture task.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateAlarmConfig	Grants permission to update cfw alarm config.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getAlarmConfig	Grants permission to get cfw alarm config.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:upgradeInstance	Grants permission to upgrade cfw.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateName	Grants permission to update cfw name.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getAccessControlLogStatistics	Grants permission to get cfw access control log statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getAttackLogStatistics	Grants permission to get cfw attack log statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getLogSearchHistory	Grants permission to get cfw log search history.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getEngineLogStatistics	Grants permission to get cfw engine log statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getFlowLogStatistics	Grants permission to get cfw flow log statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getIpLogStatistics	Grants permission to get cfw ip log statistics.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:updateIpGroupMember	Grants permission to update cfw ip group member.	write	ipGroup *	-
cfw:ipGroup:updateIpGroupMember	Grants permission to update cfw ip group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:createIpGroup	Grants permission to change cfw ip group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:createIpGroupMember	Grants permission to create cfw ip group member.	write	ipGroup *	-
cfw:ipGroup:createIpGroupMember	Grants permission to create cfw ip group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:deleteIpGroup	Grants permission to delete cfw ip group.	write	ipGroup *	-
cfw:ipGroup:deleteIpGroup	Grants permission to delete cfw ip group.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:deleteIpGroupMember	Grants permission to delete cfw ip group member.	write	ipGroup *	-
cfw:ipGroup:deleteIpGroupMember	Grants permission to delete cfw ip group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:getIpGroup	Grants permission to get cfw ip group.	read	ipGroup *	-
cfw:ipGroup:getIpGroup	Grants permission to get cfw ip group.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:listIpGroups	Grants permission to list cfw ip groups.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:listIpGroupMember	Grants permission to list cfw ip group members.	list	ipGroup *	-
cfw:ipGroup:listIpGroupMember	Grants permission to list cfw ip group members.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:ipGroup:updateIpGroup	Grants permission to update cfw ip group.	write	ipGroup *	-
cfw:ipGroup:updateIpGroup	Grants permission to update cfw ip group.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:updateServiceGroupMember	Grants permission to update cfw service group member.	write	serviceGroup *	-
cfw:serviceGroup:updateServiceGroupMember	Grants permission to update cfw service group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:create	Grants permission to create cfw service group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:createServiceGroupMember	Grants permission to create cfw service group member.	write	serviceGroup *	-
cfw:serviceGroup:createServiceGroupMember	Grants permission to create cfw service group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:delete	Grants permission to delete cfw service group.	write	serviceGroup *	-
cfw:serviceGroup:delete	Grants permission to delete cfw service group.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:deleteServiceGroupMember	Grants permission to delete cfw service group member.	write	serviceGroup *	-
cfw:serviceGroup:deleteServiceGroupMember	Grants permission to delete cfw service group member.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:get	Grants permission to get cfw service group.	read	serviceGroup *	-
cfw:serviceGroup:get	Grants permission to get cfw service group.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:list	Grants permission to list cfw service groups.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:listServiceGroupMember	Grants permission to list cfw service group members.	list	serviceGroup *	-
cfw:serviceGroup:listServiceGroupMember	Grants permission to list cfw service group members.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:serviceGroup:update	Grants permission to update cfw service group.	write	serviceGroup *	-
cfw:serviceGroup:update	Grants permission to update cfw service group.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:enableMultiAccount	Grants permission to enable multi account.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listAccounts	Grants permission to list accounts.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listOrganizationTree	Grants permission to list organization tree.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:addAccount	Grants permission to add account.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteAccount	Grants permission to delete account.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getProtectedVpc	Grants permission to get protected vpc.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteProtectedVpc	Grants permission to delete protected vpc.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:addProtectedVpc	Grants permission to add protected vpc.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateProtectedVpc	Grants permission to update protected vpc.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateAntiVirusStatus	Grants permission to update cfw anti virus status.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getAntiVirusStatus	Grants permission to get cfw anti virus status.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateAntiVirusRule	Grants permission to update cfw anti virus rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getAntiVirusRule	Grants permission to get cfw anti virus rule.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:listReportProfile	Grants permission to list cfw report profile rules.	list	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:createReportProfile	Grants permission to create cfw report profile rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:updateReportProfile	Grants permission to update cfw report profile rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:getReportProfile	Grants permission to show cfw report profile rule.	read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
cfw:instance:deleteReportProfile	Grants permission to delete cfw report profile rule.	write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId

Each API of CFW usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by CFW APIs
API	Action	Dependencies
GET /v1/{project_id}/cfw/logs/flow	cfw:instance:listFlowLog	-
GET /v1/{project_id}/cfw/logs/access-control	cfw:instance:listAccessControlLog	-
GET /v1/{project_id}/cfw/logs/attack	cfw:instance:listAttackLog	-
PUT /v1/{project_id}/cfw/logs/configuration	cfw:instance:updateLogConfig	-
POST /v1/{project_id}/firewall/east-west	cfw:instance:createInstance	er:instances:list er:instances:listVpcAttachments er:attachments:create vpc:vpcs:list vpc:subnets:get vpc:subnets:create vpc:routeTables:list vpc:routeTables:update vpc:quotas:list nat:natGateways:list
DELETE /v2/{project_id}/firewall/{resource_id}	cfw:instance:deleteInstance	-
GET /v1/{project_id}/firewall/east-west	cfw:instance:getEw	er:instances:listVpcAttachments vpc:vpcs:list nat:natGateways:list er:instances:listVpcAttachments er:instances:get
POST /v2/{project_id}/cfw-cfw/{fw_instance_id}/tags/create	cfw:instance:createTags	-
DELETE /v2/{project_id}/cfw-cfw/{fw_instance_id}/tags/delete	cfw:instance:deleteTags	-
GET /v1/{project_id}/capture-task	cfw:instance:listCaptureTask	-
POST /v1/{project_id}/capture-task	cfw:instance:createCaptureTask	-
POST /v1/{project_id}/capture-task/stop	cfw:instance:stopCaptureTask	-
POST /v1/{project_id}/capture-task/batch-delete	cfw:instance:deleteCaptureTask	-
GET /v1/{project_id}/capture-task/capture-result	cfw:instance:getCaptureTaskResult	-
GET /v1/{project_id}/dns/servers	cfw:instance:listDomainParseServers	-
PUT /v1/{project_id}/dns/servers	cfw:instance:updateDomainParseServer	-
PUT /v1/{project_id}/domain-set/{set_id}	cfw:domainGroup:update	-
DELETE /v1/{project_id}/domain-set/{set_id}	cfw:domainGroup:delete	-
GET /v1/{project_id}/domain-sets	cfw:domainGroup:list	-
DELETE /v1/{project_id}/address-items	cfw:ipGroup:deleteIpGroupMember	-
GET /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:getIpGroup	-
GET /v1/{project_id}/address-items	cfw:ipGroup:listIpGroupMember	-
GET /v1/{project_id}/address-sets	cfw:ipGroup:listIpGroups	-
DELETE /v1/{project_id}/domain-set/domains/{set_id}	cfw:domainGroup:delete	-
GET /v1/{project_id}/service-items	cfw:serviceGroup:listServiceGroupMember	-
DELETE /v1/{project_id}/service-items/{item_id}	cfw:serviceGroup:deleteServiceGroupMember	-
POST /v1/{project_id}/black-white-list	cfw:blackWhiteList:create	-
DELETE /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:delete	-
POST /v1/{project_id}/firewalls/list	cfw:instance:listInstance	-
PUT /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:update	-
POST /v1/{project_id}/eip/protect	cfw:eip:updateProtectStatus	-
POST /v1/{project_id}/domain-set	cfw:domainGroup:create	-
GET /v1/{project_id}/firewall/exist	cfw:instance:getInstance	-
DELETE /v1/{project_id}/acl-rule	cfw:acl:deleteAclRule	-
GET /v1/{project_id}/domain/parse/{domain_name}	cfw:instance:listDomainParseServers	-
POST /v1/{project_id}/acl-rule/count	cfw:acl:listAclRules	-
DELETE /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:deleteIpGroup	-
POST /v1/{project_id}/firewall/east-west/protect	cfw:instance:updateEwProtectedStatus	-
POST /v1/{project_id}/domain-set/domains/{set_id}	cfw:domainGroup:create	-
GET /v1/{project_id}/service-sets	cfw:serviceGroup:list	-
GET /v2/{project_id}/cfw-acl/tags	cfw:acl:listAclTags	-
POST /v1/{project_id}/service-set	cfw:serviceGroup:create	-
DELETE /v1/{project_id}/service-items	cfw:serviceGroup:deleteServiceGroupMember	-
POST /v1/{project_id}/ips/switch	cfw:instance:updateIpsStatus	-
POST /v1/{project_id}/ips/protect	cfw:instance:updateIpsMode	-
GET /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:get	-
DELETE /v1/{project_id}/acl-rule/count	cfw:acl:deleteHitCount	-
PUT /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:updateIpGroup	-
DELETE /v1/{project_id}/acl-rule/{acl_rule_id}	cfw:acl:deleteAclRule	-
PUT /v1/{project_id}/acl-rule/action	cfw:acl:updateAclRuleAction	-
POST /v1/{project_id}/address-set	cfw:ipGroup:createIpGroup	-
PUT /v1/{project_id}/black-white-list/{list_id}	cfw:blackWhiteList:update	-
DELETE /v1/{project_id}/address-items/{item_id}	cfw:ipGroup:deleteIpGroupMember	-
GET /v1/{project_id}/ips/switch	cfw:instance:getIpsStatus	-
PUT /v1/{project_id}/acl-rule/{acl_rule_id}	cfw:acl:updateAclRule	-
GET /v1/{project_id}/vpcs/protection	cfw:instance:listProtectedVpc	-
GET /v1/{project_id}/eip-count/{object_id}	cfw:eip:count	-
GET /v1/{project_id}/black-white-lists	cfw:blackWhiteList:list	-
GET /v1/{project_id}/eips/protect	cfw:eip:list	-
DELETE /v1/{project_id}/black-white-list/{list_id}	cfw:blackWhiteList:delete	-
GET /v1/{project_id}/acl-rules	cfw:acl:listAclRules	-
GET /v1/{project_id}/domain-set/domains/{set_id}	cfw:domainGroup:list	-
POST /v1/{project_id}/acl-rule	cfw:acl:createAclRule	-
PUT /v1/{project_id}/acl-rule/order/{acl_rule_id}	cfw:acl:setPriority	-
POST /v1/{project_id}/address-items	cfw:ipGroup:createIpGroupMember	-
GET /v1/{project_id}/ips/protect	cfw:instance:getIpsMode	-
POST /v1/{project_id}/service-items	cfw:serviceGroup:createServiceGroupMember	-
GET /v1/{project_id}/cfw/logs/configuration	cfw:instance:getLogConfig	-
POST /v1/{project_id}/cfw/logs/configuration	cfw:instance:updateLogConfig	-
POST /v2/{project_id}/firewall	cfw:instance:createInstance	-
GET /v3/{project_id}/jobs/{job_id}	cfw:instance:listInstance	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can define in SCP statements for CFW.

**Table 3** Resource types supported by CFW
Resource Type	URN
blackWhiteList	cfw:<region>:<account-id>:blackWhiteList:<blackWhiteList-id>
acl	cfw:<region>:<account-id>:acl:<acl-id>
instance	cfw:<region>:<account-id>:instance:<fwInstance-id>
serviceGroup	cfw:<region>:<account-id>:serviceGroup:<serviceGroup-id>
domainGroup	cfw:<region>:<account-id>:domainGroup:<domainGroup-id>
ipGroup	cfw:<region>:<account-id>:ipGroup:<ipGroup-id>
eip	cfw:<region>:<account-id>:eip:<eip-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cfw) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in SCP for CFW. You can include these condition keys to specify conditions for when your SCP is in effect.