Domain Name Service (DNS)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This topic describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (such as list, read, or write). This classification helps you understand the level of access that an action grants when you use it in an SCP policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DNS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DNS, see Conditions.

The following table lists the actions that you can define in SCP statements for DNS.

**Table 1** Actions supported by DNS
Action	Description	Access Level	Resource Type (*: required)	Condition Key
dns:zone:list	Grants permission to list the zones.	list	zone *	-
dns:zone:list	Grants permission to list the zones.	list	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dns:zone:create	Grants permission to create a zone.	write	zone *	-
dns:zone:create	Grants permission to create a zone.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dns:zone:createBatchPublicZonesByName	Grants permission to create zones in batches.	write	zone *	-
dns:zone:createBatchPublicZonesByName	Grants permission to create zones in batches.	write	-	g:EnterpriseProjectId
dns:zone:get	Grants permission to query a zone.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:update	Grants permission to update a zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:delete	Grants permission to delete a zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:associaterouter	Grants permission to associate VPCs with a private zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:disassociaterouter	Grants permission to disassociate VPCs from a private zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:setProxyPattern	Grants permission to set the recursive resolution proxy for a private zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:transfer	Grants permission to transfer a public zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:list	Grants permission to list the record sets.	list	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:create	Grants permission to create a record set.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:create	Grants permission to create a record set.	write	-	dns:RecordSetNames dns:RecordSetTypes
dns:recordset:get	Grants permission to query a record set.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:update	Grants permission to update a record set.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:update	Grants permission to update a record set.	write	-	dns:RecordSetNames dns:RecordSetTypes
dns:recordset:delete	Grants permission to delete a record set.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:delete	Grants permission to delete a record set.	write	-	dns:RecordSetNames dns:RecordSetTypes
dns:zone:setStatus	Grants permission to set the zone status.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:setStatus	Grants permission to set the status of a record set.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:setStatus	Grants permission to set the status of a record set.	write	-	dns:RecordSetNames dns:RecordSetTypes
dns:ptr:list	Grants permission to list the PTR records.	list	ptr *	-
dns:ptr:list	Grants permission to list the PTR records.	list	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dns:ptr:get	Grants permission to query a PTR record.	read	ptr *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:ptr:create	Grants permission to create a PTR record.	write	ptr *	-
dns:ptr:create	Grants permission to create a PTR record.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dns:ptr:update	Grants permission to update a PTR record.	write	ptr *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:ptr:delete	Grants permission to delete a PTR record.	write	ptr *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:tag:get	Grants permission to query tags of a zone.	read	zone	-
dns:tag:get	Grants permission to query tags of a zone.	read	ptr	-
dns:tag:set	Grants permission to add a tag to a zone.	tagging	zone	g:ResourceTag/<tag-key>
dns:tag:set	Grants permission to add a tag to a zone.	tagging	ptr	g:ResourceTag/<tag-key>
dns:zone:createRetrieval	Grants permission to retrieve a domain name.	write	-	-
dns:zone:getRetrieval	Grants permission to query the domain name retrieval status.	read	-	-
dns:customLine:create	Grants permission to create a custom line.	write	customLine *	-
dns:customLine:list	Grants permission to list the custom lines.	list	customLine *	-
dns:customLine:delete	Grants permission to delete a custom line.	write	customLine *	-
dns:customLine:update	Grants permission to update a custom line.	write	customLine *	-
dns:nameserver:list	Grants permission to list name servers.	list	-	-
dns:nameserver:getZoneNameServer	Grants permission to query DNS servers for public zones.	read	-	-
dns:quota:list	Grants permission to list quotas.	list	-	-
dns:recordset:getPrivateRecordSetImport	Grants permission to query private zone record set import.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:getPrivateRecordSetImportTemplate	Grants permission to download the template for importing private zone record sets.	read	-	-
dns:recordset:createPrivateRecordSetImport	Grants permission to create a private zone record set import task.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:deletePrivateRecordSetImportTask	Grants permission to delete a private zone record set import task.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:createPublicRecordSetImport	Grants permission to create a public zone record set import task.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:getPublicRecordSetImport	Grants permission to query public zone record set import.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:recordset:getPublicRecordSetImportTemplate	Grants permission to download the template for importing public zone record sets.	read	-	-
dns:recordset:deletePublicRecordSetImportTask	Grants permission to delete a public zone record set import task.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:getExport	Grants permission to export zones.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:lineGroup:create	Grants permission to create a line group.	write	lineGroup *	-
dns:lineGroup:list	Grants permission to list the line groups.	list	lineGroup *	-
dns:lineGroup:get	Grants permission to query a line group.	read	lineGroup *	-
dns:lineGroup:delete	Grants permission to delete a line group.	write	lineGroup *	-
dns:lineGroup:update	Grants permission to update a line group.	write	lineGroup *	-
dns:endpoint:create	Grants permission to create an endpoint.	write	endpoint *	-
dns:endpoint:list	Grants permission to list the endpoints.	list	endpoint *	-
dns:endpoint:get	Grants permission to query an endpoint.	read	endpoint *	-
dns:endpoint:update	Grants permission to update an endpoint.	write	endpoint *	-
dns:endpoint:delete	Grants permission to delete an endpoint.	write	endpoint *	-
dns:endpoint:createIpaddress	Grants permission to bind an IP address to an endpoint.	write	endpoint *	-
dns:endpoint:deleteIpaddress	Grants permission to unbind an IP address from an endpoint.	write	endpoint *	-
dns:endpoint:listIpaddresses	Grants permission to list IP addresses bound to an endpoint.	list	endpoint *	-
dns:endpoint:listVpcs	Grants permission to list the VPCs associated with an endpoint.	list	endpoint *	-
dns:resolverRule:create	Grants permission to create an endpoint rule to route queries originating from your VPC out of the VPC.	write	resolverRule *	-
dns:resolverRule:list	Grants permissions to list endpoint rules.	list	resolverRule *	-
dns:resolverRule:get	Grants permission to query an endpoint rule.	read	resolverRule *	-
dns:resolverRule:update	Grants permissions to update an endpoint rule.	write	resolverRule *	-
dns:resolverRule:delete	Grants permissions to delete an endpoint rule.	write	resolverRule *	-
dns:resolverRule:associaterouter	Grants permission to associate a VPC with an endpoint rule.	write	resolverRule *	-
dns:resolverRule:disassociaterouter	Grants permission to disassociate a VPC from an endpoint rule.	write	resolverRule *	-
dns:zone:enableDnssecConfig	Grants permission to enable DNSSEC for a zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:disableDnssecConfig	Grants permission to disable DNSSEC for a zone.	write	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:getDnssecConfig	Grants permission to query DNSSEC for a zone.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dns:zone:listPublicZoneBatchOperationRecords	Grants permission to list batch operation records of public zones.	list	-	-
dns:zone:getPublicZoneBatchOperationResult	Grants permission to download failed batch operations on public zones.	read	-	-
dns:recordset:batchImportPublicRecordSet	Grants permission to import public zone record sets in batches.	write	-	-
dns:zone:createAuthorizeTxtRecord	Grant permissions to authorize a domain name.	write	-	-
dns:zone:getAuthorizeTxtRecord	Grants permission to query the authorization status of a domain name.	read	-	-
dns:zone:getDomainDetection	Grants permission to query public domain name resolution diagnosis results.	read	zone *	g:ResourceTag/<tag-key> g:EnterpriseProjectId

Each API of DNS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by DNS APIs
API	Action	Dependencies
GET /v2/zones	dns:zone:list	-
POST /v2/zones	dns:zone:create	dns:tag:set dns:quota:list
GET /v2/zones/{zone_id}	dns:zone:get	-
PATCH /v2/zones/{zone_id}	dns:zone:update	-
DELETE /v2/zones/{zone_id}	dns:zone:delete	-
GET /v2/zones/{zone_id}/nameservers	dns:zone:get	-
GET /v2/zones	dns:zone:list	-
POST /v2/zones	dns:zone:create	vpc:vpcs:get dns:tag:set dns:quota:list
GET /v2/zones/{zone_id}	dns:zone:get	-
PATCH /v2/zones/{zone_id}	dns:zone:update	-
DELETE /v2/zones/{zone_id}	dns:zone:delete	-
GET /v2/zones/{zone_id}/nameservers	dns:zone:get	-
POST /v2/zones/{zone_id}/associaterouter	dns:zone:associaterouter	vpc:vpcs:get
POST /v2/zones/{zone_id}/disassociaterouter	dns:zone:disassociaterouter	vpc:vpcs:get
GET /v2/zones/{zone_id}/recordsets	dns:recordset:list	-
POST /v2/zones/{zone_id}/recordsets	dns:recordset:create	dns:quota:list
GET /v2/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:get	-
PUT /v2/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:update	-
DELETE /v2/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:delete	-
GET /v2/recordsets	dns:recordset:list	-
PUT /v2/zones/{zone_id}/statuses	dns:zone:setStatus	-
GET /v2.1/recordsets	dns:recordset:list	-
POST /v2.1/zones/{zone_id}/recordsets	dns:recordset:create	dns:quota:list
GET /v2.1/zones/{zone_id}/recordsets	dns:recordset:list	-
GET /v2.1/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:get	-
PUT /v2.1/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:update	-
DELETE /v2.1/zones/{zone_id}/recordsets/{recordset_id}	dns:recordset:delete	-
PUT /v2.1/recordsets/{recordset_id}/statuses/set	dns:recordset:setStatus	-
POST /v2.1/zones/{zone_id}/recordsets/batch/lines	dns:recordset:create	dns:quota:list
PUT /v2.1/zones/{zone_id}/recordsets	dns:recordset:update	-
DELETE /v2.1/zones/{zone_id}/recordsets	dns:recordset:delete	-
GET /v2/reverse/floatingips	dns:ptr:list	-
GET /v2/reverse/floatingips/{region}:{floatingip_id}	dns:ptr:get	-
PATCH /v2/reverse/floatingips/{region}:{floatingip_id}	dns:ptr:create	eip:publicIps:get dns:tag:set dns:quota:list
PATCH /v2/reverse/floatingips/{region}:{floatingip_id}	dns:ptr:update	-
PATCH /v2/reverse/floatingips/{region}:{floatingip_id}	dns:ptr:delete	-
GET /v2/{project_id}/{resource_type}/tags	dns:tag:get	-
GET /v2/{project_id}/{resource_type}/{resource_id}/tags	dns:tag:get	-
POST /v2/{project_id}/{resource_type}/{resource_id}/tags	dns:tag:set	-
DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/{key}	dns:tag:set	-
POST /v2/{project_id}/{resource_type}/{resource_id}/tags/action	dns:tag:set	-
POST /v2/{project_id}/{resource_type}/resource_instances/action	dns:tag:get	-
POST /v2.1/customlines	dns:customLine:create	dns:quota:list
GET /v2.1/customlines	dns:customLine:list	-
DELETE /v2.1/customlines/{line_id}	dns:customLine:delete	-
PUT /v2.1/customlines/{line_id}	dns:customLine:update	-
GET /v2/nameservers	dns:nameserver:list	-
GET /v2/quotamg/dns/quotas	dns:quota:list	-
POST /v2.1/linegroups	dns:lineGroup:create	dns:quota:list
GET /v2.1/linegroups	dns:lineGroup:list	-
GET /v2.1/linegroups/{linegroup_id}	dns:lineGroup:get	-
PUT /v2.1/linegroups/{linegroup_id}	dns:lineGroup:update	-
DELETE /v2.1/linegroups/{linegroup_id}	dns:lineGroup:delete	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can define in SCP statements for DNS.

**Table 3** Resource types supported by DNS
Resource Type	URN
resolverRule	dns:<region>:<account-id>:resolverRule:<resolver-rule-id>
lineGroup	dns::<account-id>:lineGroup:<line-group-id>
customLine	dns::<account-id>:customLine:<custom-line-id>
zone	dns::<account-id>:zone:<zone-id>
endpoint	dns:<region>:<account-id>:endpoint:<endpoint-id>
ptr	dns:<region>:<account-id>:ptr:<ptr-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

A key in the Condition element of a statement Condition keys are classified into global condition keys and service-specific condition keys based on the application scope.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, dns:) only apply to operations of the DNS service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in SCPs for DNS. You can include these condition keys to specify conditions for when your SCP is in effect.

**Table 4** Service-specific condition keys supported by DNS
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
dns:RecordSetNames	string	Multivalued	Filters access by record set name. All letters in the record set name must be lowercase and cannot contain a period at the end.
dns:RecordSetTypes	string	Multivalued	Filters access by record set type. The value can be A, AAAA, MX, CNAME, TXT, NS, CAA, or SRV.