Configuring an Access Control Policy

Overview

Access control allows you to control the IP addresses and accounts used to access APIs, protecting backend services. You can create an access control policy to allow or deny the access of certain IP addresses or accounts to an API.

An access control policy and an API are independent of each other. An access control policy takes effect for an API only after it is bound to the API.

An API can be bound to only one access control policy in an environment, but each access control policy can be bound to multiple APIs.

Creating an Access Control Policy

1. Log in to the ROMA Connect console. On the Instances page, click View Console next to a specific instance.
2. In the navigation pane on the left, choose API Connect > API Management. On the Access Control Policies tab page, click Create.
3. In the Create Access Control Policy dialog box, configure policy information.

   Table 1 Parameters for creating an access control policy

   Parameter	Description
   Name	Enter an access control policy name. It is recommended that you enter a name based on naming rules to facilitate search.
   Restriction Type	Select the restriction type of the access control policy. IP address: API calling is restricted based on IP addresses. Account name: API calling is restricted based on account names. This option applies only to APIs that use the IAM authentication mode. The restriction also applies to the IAM users under the specified accounts. IAM users cannot be specified separately.
   Effect	Select the action of access control. This parameter is used along with Restriction Type. Allow: Only specified IP addresses or accounts are allowed to call APIs. Deny: Specified IP addresses or accounts are not allowed to call APIs.
   IP Address	This parameter is mandatory only if Restriction Type is set to IP address. Click Add IP Address to add the IP addresses or IP address segments that are allowed or forbidden to call an API.
   Account Names	This parameter is mandatory only if Restriction Type is set to Account name. Enter the account names that are allowed or forbidden to call an API. Use commas (,) to separate multiple account names. You can click the username in the upper right corner of the console and choose My Credentials to obtain the account name of the user on the My Credentials page.

4. Click OK.

   After the access control policy is created, you also need to perform the operations described in Binding an Access Control Policy to an API to make the policy take effect for the API.

Binding an Access Control Policy to an API

1. Log in to the ROMA Connect console. On the Instances page, click View Console next to a specific instance.
2. In the navigation pane on the left, choose API Connect > API Management. On the Access Control Policies tab page, click Bind to API.
3. On the Bind to API page, click Select API.
4. In the Select API dialog box, select the APIs to which the access control policy is to be bound in the specified environment.

   You can filter the required APIs by API group, environment, and API name.

5. Click OK.