Server Migration Service (SMS)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This topic describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by SMS, see Resources.

The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by SMS, see Conditions.

The following table lists the actions that you can define in SCP statements for SMS.

**Table 1** Actions supported by SMS
Action	Description	Access Level	Resource Type (*: required)	Condition Key
sms:template:list	Grants permission to list templates.	list	template	-
sms:template:create	Grants permission to create a template.	write	template	-
sms:template:batchDelete	Grants permission to batch delete templates.	write	template	-
sms:template:get	Grants permission to query the information about a template.	read	template	-
sms:template:update	Grants permission to modify a template.	write	template	-
sms:template:getTargetPassword	Grants permission to query the target server password in a template.	read	template	-
sms:template:delete	Grants permission to delete a template.	write	template	-
sms:server:listErrors	Grants permission to list failed source servers.	list	server	-
sms:server:list	Grants permission to list source servers.	list	server	g:EnterpriseProjectId
sms:server:register	Grants permission to register a source server with SMS.	write	server	g:EnterpriseProjectId
sms:server:batchDelete	Grants permission to batch delete source server records.	write	server	g:EnterpriseProjectId
sms:server:get	Grants permission to query the details about a source server.	read	server	g:EnterpriseProjectId
sms:server:update	Grants permission to modify a source server name.	write	server	g:EnterpriseProjectId
sms:server:delete	Grants permission to delete a source server record.	write	server	g:EnterpriseProjectId
sms:server:updateDiskInfo	Grants permission to update disk information.	write	server	g:EnterpriseProjectId
sms:server:overview	Grants permission to obtain the overview of source servers.	read	server	-
sms:server:updateState	Grants permission to update the migration task status for a source server.	write	server	g:EnterpriseProjectId
sms:server:listTask	Grants permission to list migration tasks.	list	server	g:EnterpriseProjectId
sms:server:createTask	Grants permission to create a migration task.	write	server	g:EnterpriseProjectId
sms:server:batchDeleteTask	Grants permission to batch delete migration tasks.	write	server	g:EnterpriseProjectId
sms:server:getTask	Grants permission to query the details about a migration task.	read	server	g:EnterpriseProjectId
sms:server:updateTask	Grants permission to update a migration task.	write	server	g:EnterpriseProjectId
sms:server:deleteTask	Grants permission to delete a migration task.	write	server	g:EnterpriseProjectId
sms:server:manageTask	Grants permission to manage migration tasks.	write	server	g:EnterpriseProjectId
sms:server:updateTaskProgress	Grants permission to report the migration progress and rate.	write	server	g:EnterpriseProjectId
sms:server:unlock	Grants permission to unlock a target server.	write	server	g:EnterpriseProjectId
sms:server:collectLog	Grants permission to upload migration task logs.	write	server	g:EnterpriseProjectId
sms:server:getTaskPassphrase	Grants permission to query a certificate passphrase.	read	server	g:EnterpriseProjectId
sms:server:checkNetwork	Grants permission to check NICs and security groups.	read	server	-
sms:server:getTaskSpeedLimit	Grants permission to query the traffic limiting rules of a migration task.	read	server	g:EnterpriseProjectId
sms:server:updateTaskSpeedLimit	Grants permission to set traffic limiting rules for a migration task.	write	server	g:EnterpriseProjectId
sms:server:getCommand	Grants permission to obtain commands from SMS.	read	server	g:EnterpriseProjectId
sms:server:updateCommandResult	Grants permission to report command execution results to SMS.	write	server	g:EnterpriseProjectId
sms:server:getCert	Grants permission to obtain an SSL certificate and private key.	read	server	g:EnterpriseProjectId
sms:migproject:list	Grants permission to list migration projects.	list	migproject	-
sms:migproject:create	Grants permission to create a migration project.	write	migproject	-
sms:migproject:get	Grants permission to query details about a migration project.	read	migproject	-
sms:migproject:update	Grants permission to update a migration project.	write	migproject	-
sms:migproject:delete	Grants permission to delete a migration project.	write	migproject	-
sms:migproject:update	Grants permission to change the default migration project.	write	migproject	-
sms::getConfig	Grants permission to obtain Agent configuration information.	read	-	-
sms:server:updateNetworkCheckInfo	Grants permission to update network measurement information.	write	task	g:EnterpriseProjectId
sms:server:getTaskConfig	Grants permission to query the settings of advanced migration options of a task.	read	task	g:EnterpriseProjectId
sms:server:updateTaskConfig	Grants permission to set advanced migration options for a task.	write	task	g:EnterpriseProjectId

Each API of SMS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by SMS APIs
API	Action	Dependencies
GET /v3/vm/templates	sms:template:list	-
POST /v3/vm/templates	sms:template:create	-
POST /v3/vm/templates/delete	sms:template:batchDelete	-
GET /v3/vm/templates/{id}	sms:template:get	-
PUT /v3/vm/templates/{id}	sms:template:update	-
GET /v3/vm/templates/{id}/target-password	sms:template:getTargetPassword	-
DELETE /v3/vm/templates/{id}	sms:template:delete	-
GET /v3/errors	sms:server:listErrors	-
GET /v3/sources	sms:server:list	-
POST /v3/sources	sms:server:register	-
POST /v3/sources/delete	sms:server:batchDelete	ecs:cloudServers:showServer ecs:cloudServers:attach evs:volumes:use ecs:cloudServers:stop ecs:cloudServers:start ecs:cloudServers:detachVolume evs:volumes:delete evs:snapshots:delete evs:volumes:get
GET /v3/sources/{source_id}	sms:server:get	-
PUT /v3/sources/{source_id}	sms:server:update	-
DELETE /v3/sources/{source_id}	sms:server:delete	ecs:cloudServers:showServer ecs:cloudServers:attach evs:volumes:use ecs:cloudServers:stop ecs:cloudServers:start ecs:cloudServers:detachVolume evs:volumes:delete evs:snapshots:delete evs:volumes:get
PUT /v3/sources/{source_id}/diskinfo	sms:server:updateDiskInfo	-
GET /v3/sources/overview	sms:server:overview	-
PUT /v3/sources/{source_id}/changestate	sms:server:updateState	-
GET /v3/tasks	sms:server:listTask	-
POST /v3/tasks	sms:server:createTask	-
POST /v3/tasks/delete	sms:server:batchDeleteTask	ecs:cloudServers:showServer ecs:cloudServers:attach evs:volumes:use ecs:cloudServers:stop ecs:cloudServers:start ecs:cloudServers:detachVolume evs:volumes:delete evs:snapshots:delete evs:volumes:get
GET /v3/tasks/{task_id}	sms:server:getTask	-
PUT /v3/tasks/{task_id}	sms:server:updateTask	-
DELETE /v3/tasks/{task_id}	sms:server:deleteTask	ecs:cloudServers:showServer ecs:cloudServers:attach evs:volumes:use ecs:cloudServers:stop ecs:cloudServers:start ecs:cloudServers:detachVolume evs:volumes:delete evs:snapshots:delete evs:volumes:get
POST /v3/tasks/{task_id}/action	sms:server:manageTask	-
PUT /v3/tasks/{task_id}/progress	sms:server:updateTaskProgress	-
POST /v3/tasks/{task_id}/unlock	sms:server:unlock	-
POST /v3/tasks/{task_id}/log	sms:server:collectLog	-
GET /v3/tasks/{task_id}/passphrase	sms:server:getTaskPassphrase	-
GET /v3/tasks/{t_project_id}/networkacl/{t_network_id}/check	sms:server:checkNetwork	-
GET /v3/tasks/{task_id}/speed-limit	sms:server:getTaskSpeedLimit	-
POST /v3/tasks/{task_id}/speed-limit	sms:server:updateTaskSpeedLimit	-
GET /v3/sources/{server_id}/command	sms:server:getCommand	-
POST /v3/sources/{server_id}/command_result	sms:server:updateCommandResult	-
GET /v3/tasks/{task_id}/certkey	sms:server:getCert	-
GET /v3/migprojects	sms:migproject:list	-
POST /v3/migprojects	sms:migproject:create	-
GET /v3/migprojects/{mig_project_id}	sms:migproject:get	-
PUT /v3/migprojects/{mig_project_id}	sms:migproject:update	-
DELETE /v3/migprojects/{mig_project_id}	sms:migproject:delete	-
PUT /v3/migprojects/{mig_project_id}/default	sms:migproject:update	-
GET /v3/config	sms::getConfig	-
POST /v3/{task_id}/update-network-check-info	sms:server:updateNetworkCheckInfo	-
POST /v3/tasks/{task_id}/configuration-setting	sms:server:updateTaskConfig	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can specify in SCP statements for SMS.

**Table 3** Resource types supported by SMS
Resource Type	URN
server	sms::<account-id>:server:*
server	sms::<account-id>:server:<server-id>
Task	sms::<account-id>:task:*
Task	sms::<account-id>:task:<task-id>
template	sms::<account-id>:template:*
template	sms::<account-id>:template:<template-id>
migproject	sms::<account-id>:migproject:*
migproject	sms::<account-id>:migproject:<migproject-id>