Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Cloud Eye, see Resources.
Condition Key contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Cloud Eye, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for identity policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for Cloud Eye.

**Table 1** Actions supported by Cloud Eye
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
ces:alarms:create	Grants permission to create an alarm rule.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys ces:namespace	-
ces:alarms:put	Grants permission to update an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarmsonoff:put
ces:alarms:put	Grants permission to update an alarm rule.	Write	-	g:RequestTag/<tag-key> g:TagKeys	ces:alarmsonoff:put
ces:alarms:get	Grants permission to query an alarm rule.	Read	alarm *	g:EnterpriseProjectId	ces:alarms:list
ces:alarmHistory:list	Grants permission to list historical alarms.	List	-	g:EnterpriseProjectId	-
ces:events:post	Grants permission to report events.	Write	-	N/A	N/A
ces:events:list	Grants permission to query events.	List	-	N/A	-
ces:events:get	Grants permission to query details of an event.	Read	-	N/A	N/A
ces:metrics:list	Grants permission to query metrics.	List	-	N/A	N/A
ces:metricData:list	Grants permission to batch query metric data.	List	-	N/A	N/A
ces:eventData:get	Grants permission to query the server configuration.	Read	-	N/A	ces:sapEventData:list
ces:metricData:get	Grants permission to query a metric.	Read	-	N/A	ces:metricData:list
ces:metricData:create	Grants permission to report metrics.	Write	-	N/A	-
ces:quotas:get	Grants permission to query quotas.	Read	-	N/A	-
ces:alarms:create	Grants permission to create an alarm rule.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys ces:namespace	-
ces:alarms:delete	Grants permission to delete an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
ces:alarms:putAction	Grants permission to enable or disable an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:put
ces:alarms:list	Grants permission to query alarm rules.	List	-	g:EnterpriseProjectId	-
ces:alarms:addResources	Grants permission to batch add resources to an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:put
ces:alarms:deleteResources	Grants permission to batch delete resources from an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:put
ces:alarms:getResources	Grants permission to query monitored resources in an alarm rule.	Read	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:list
ces:alarms:updatePolicies	Grants permission to update policies of an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:put
ces:alarms:getPolicies	Grants permission to query policies in an alarm rule.	Read	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:get
ces:alarms:putAlarmNotifications	Grants permission to modify alarm notification information in an alarm rule.	Write	alarm *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	ces:alarms:put
ces:alarmHistory:list	Grants permission to list historical alarms.	List	-	g:EnterpriseProjectId	-
ces:customAlarmTemplates:create	Grants permission to create a custom alarm template.	Write	-	g:EnterpriseProjectId	-
ces:customAlarmTemplates:delete	Grants permission to delete a custom alarm template.	Write	-	g:EnterpriseProjectId	-
ces:customAlarmTemplates:put	Grants permission to update a custom alarm template.	Write	-	g:EnterpriseProjectId	-
ces:customAlarmTemplates:list	Grants permission to query custom alarm templates.	List	-	g:EnterpriseProjectId	-
ces:customAlarmTemplates:get	Grants permission to query a custom alarm template.	Read	-	g:EnterpriseProjectId	ces:customAlarmTemplates:list
ces:customAlarmTemplates:listAssociatedAlarms	Grants permission to query alarm rules associated with a custom alarm template.	List	-	g:EnterpriseProjectId	-
ces:resourceGroups:create	Grants permission to create a resource group.	Write	-	g:EnterpriseProjectId	-
ces:resourceGroups:delete	Grants permission to delete a resource group.	Write	-	g:EnterpriseProjectId	-
ces:resourceGroups:put	Grants permission to update a resource group.	Write	-	g:EnterpriseProjectId	-
ces:resourceGroups:get	Grants permission to query a resource group.	Read	-	g:EnterpriseProjectId	-
ces:resourceGroups:list	Grants permission to query all resource groups.	List	-	g:EnterpriseProjectId	ces:resourceGroups:get
ces:resourceGroups:putAssociationAlarmTemplate	Grants permission to modify the configurations for associating an alarm template with resource groups.	Write	-	g:EnterpriseProjectId	ces:resourceGroups:put
ces:resourceGroups:addResources	Grants permission to batch add resources to a resource group.	Write	-	g:EnterpriseProjectId	ces:resourceGroups:put
ces:resourceGroups:deleteResources	Grants permission to batch delete resources from a resource group.	Write	-	g:EnterpriseProjectId	ces:resourceGroups:put
ces:resourceGroups:getServiceResources	Grants permission to query resources of a specified dimension and a specified service type in a resource group.	Read	-	g:EnterpriseProjectId	ces:resourceGroups:get
ces:alarms:createOneClickAlarms	Grants permission to enable one-click monitoring.	Write	-	g:EnterpriseProjectId	ces:oneClickAlarms:post
ces:alarms:listOneClickAlarms	Grants permission to query services and resources that support one-click monitoring.	List	-	g:EnterpriseProjectId	ces:oneClickAlarms:list
ces:alarms:putOneClickAlarms	Grants permission to batch enable or disable one-click monitoring.	Write	-	g:EnterpriseProjectId	ces:oneClickAlarms:put
ces:alarms:deleteOneClickAlarms	Grants permission to batch disable one-click monitoring.	Write	-	g:EnterpriseProjectId	ces:oneClickAlarms:delete
ces:alarms:putOneClickAlarmNotifications	Grants permission to batch modify alarm notifications for one service in one-click monitoring.	Write	-	g:EnterpriseProjectId	ces:oneClickAlarms:updateNotifications
ces:alarms:putOneClickAlarmPolicies	Grants permission to batch enable or disable alarm policies in alarm rules for one service that has one-click monitoring enabled.	Write	-	g:EnterpriseProjectId	ces:oneClickAlarms:put
ces:alarms:putNotificationMaskRules	Grants permission to configure alarm masking rules.	Write	-	g:EnterpriseProjectId	ces:notificationMasks:update
ces:alarms:deleteNotificationMaskRules	Grants permission to batch delete alarm masking rules.	Write	-	g:EnterpriseProjectId	ces:notificationMasks:delete
ces:alarms:listNotificationMaskRules	Grants permission to batch query alarm masking rules.	List	-	g:EnterpriseProjectId	ces:notificationMasks:list
ces:alarms:listNotificationMaskResources	Grants permission to query resources for which alarm notifications have been masked.	List	-	g:EnterpriseProjectId	ces:notificationMasks:list
ces:dashboards:create	Grants permission to create a dashboard.	Write	dashboard *	-	N/A
ces:dashboards:create	Grants permission to create a dashboard.	Write	-	g:EnterpriseProjectId	N/A
ces:dashboards:list	Grants permission to query dashboards.	List	dashboard *	-	N/A
ces:dashboards:list	Grants permission to query dashboards.	List	-	g:EnterpriseProjectId	N/A
ces:dashboards:put	Grants permission to update a dashboard.	Write	dashboard *	g:EnterpriseProjectId	-
ces:dashboards:delete	Grants permission to batch delete dashboards.	Write	dashboard *	g:EnterpriseProjectId	-
ces:widgets:create	Grants permission to create a graph.	Write	-	ces:namespace	-
ces:widgets:list	Grants permission to query graphs added to a dashboard.	List	-	N/A	-
ces:widgets:get	Grants permission to query a graph.	Read	-	N/A	N/A
ces:widgets:delete	Grants permission to delete a graph.	Write	-	N/A	N/A
ces:widgets:put	Grants permission to batch update graphs.	Write	-	ces:namespace	-
ces:tags:list	Grants permission to batch query Cloud Eye tags.	List	-	-	ces:projecttags:list
ces:namespacesDimensions:listAgentDimensions	Grants permission to query Agent-related metrics of a server.	List	-	N/A	ces:namespacesDimensions:list
ces:metricData:list	Grants permission to batch query metric data.	List	-	N/A	-
ces:agent:listStatuses	Grants permission to batch query the Agent status of all instances.	List	-	N/A	ces:agentStatus:get ces:agentStatus:list
ces:agent:listTaskInvocations	Grants permission to batch query Agent tasks of a server.	List	-	N/A	ces:taskInvocation:get
ces:agent:createAgentInvocations	Grants permission to batch create Agent tasks.	Write	-	N/A	ces:taskInvocation:post

Each API of Cloud Eye usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by Cloud Eye APIs
API	Action	Dependencies
POST /V1.0/{project_id}/alarms	ces:alarms:create	-
PUT /V1.0/{project_id}/alarms/{alarm_id}	ces:alarms:put	-
PUT /V1.0/{project_id}/alarms/{alarm_id}/action	ces:alarms:putAction	-
DELETE /V1.0/{project_id}/alarms/{alarm_id}	ces:alarms:delete	N/A
GET /V1.0/{project_id}/alarms/{alarm_id}	ces:alarms:get	-
GET /V1.0/{project_id}/alarms	ces:alarms:list	-
GET /V1.0/{project_id}/alarm-histories	ces:alarmHistory:list	-
POST /V1.0/{project_id}/events	ces:events:post	-
GET /V1.0/{project_id}/events	ces:events:list	-
GET /V1.0/{project_id}/event/{event_name}	ces:events:get	-
GET /V1.0/{project_id}/metrics	ces:metrics:list	-
POST /V1.0/{project_id}/batch-query-metric-data	ces:metricData:list	-
GET /V1.0/{project_id}/event-data	ces:eventData:get	-
GET /V1.0/{project_id}/metric-data	ces:metricData:get	-
POST /V1.0/{project_id}/metric-data	ces:metricData:create	-
GET /V1.0/{project_id}/quotas	ces:quotas:get	-
GET /V1.0/{project_id}/resource-groups/{group_id}	ces:resourceGroups:get	-
PUT /V1.0/{project_id}/resource-groups/{group_id}	ces:resourceGroups:put	-
DELETE /V1.0/{project_id}/resource-groups/{group_id}	ces:resourceGroups:delete	-
POST /V1.0/{project_id}/resource-groups	ces:resourceGroups:create	-
GET /V1.0/{project_id}/resource-groups	ces:resourceGroups:list	-
POST /V1.0/{project_id}/alarm-template	ces:customAlarmTemplates:create	-
PUT /V1.0/{project_id}/alarm-template/{template_id}	ces:customAlarmTemplates:put	-
DELETE /V1.0/{project_id}/alarm-template/{template_id}	ces:customAlarmTemplates:delete	-
GET /V1.0/{project_id}/alarm-template	ces:customAlarmTemplates:list	-
POST /v2/{project_id}/alarms	ces:alarms:create	-
POST /v2/{project_id}/alarms/batch-delete	ces:alarms:delete	-
POST /v2/{project_id}/alarms/action	ces:alarms:putAction	-
GET /v2/{project_id}/alarms	ces:alarms:list	-
POST /v2/{project_id}/alarms/{alarm_id}/resources/batch-create	ces:alarms:addResources	-
POST /v2/{project_id}/alarms/{alarm_id}/resources/batch-delete	ces:alarms:deleteResources	-
GET /v2/{project_id}/alarms/{alarm_id}/resources	ces:alarms:getResources	-
PUT /v2/{project_id}/alarms/{alarm_id}/policies	ces:alarms:updatePolicies	-
GET /v2/{project_id}/alarms/{alarm_id}/policies	ces:alarms:getPolicies	-
PUT /v2/{project_id}/alarms/{alarm_id}/notifications	ces:alarms:putAlarmNotifications	-
GET /v2/{project_id}/alarm-histories	ces:alarmHistory:list	-
POST /v2/{project_id}/alarm-templates	ces:customAlarmTemplates:create	-
POST /v2/{project_id}/alarm-templates/batch-delete	ces:customAlarmTemplates:delete	-
PUT /v2/{project_id}/alarm-templates/{template_id}	ces:customAlarmTemplates:put	-
GET /v2/{project_id}/alarm-templates	ces:customAlarmTemplates:list	-
GET /v2/{project_id}/alarm-templates/{template_id}	ces:customAlarmTemplates:get	-
GET /v2/{project_id}/alarm-templates/{template_id}/association-alarms	ces:customAlarmTemplates:listAssociatedAlarms	-
POST /v2/{project_id}/resource-groups	ces:resourceGroups:create	-
POST /v2/{project_id}/resource-groups/batch-delete	ces:resourceGroups:delete	-
PUT /v2/{project_id}/resource-groups/{group_id}	ces:resourceGroups:put	-
GET /v2/{project_id}/resource-groups/{group_id}	ces:resourceGroups:get	-
GET /v2/{project_id}/resource-groups	ces:resourceGroups:list	-
PUT /v2/{project_id}/resource-groups/{group_id}/alarm-templates/async-association	ces:resourceGroups:putAssociationAlarmTemplate	-
POST /v2/{project_id}/resource-groups/{group_id}/resources/batch-create	ces:resourceGroups:addResources	-
POST /v2/{project_id}/resource-groups/{group_id}/resources/batch-delete	ces:resourceGroups:deleteResources	-
GET /v2/{project_id}/resource-groups/{group_id}/services/{service}/resources	ces:resourceGroups:getServiceResources	-
POST /v2/{project_id}/one-click-alarms	ces:alarms:createOneClickAlarms	-
GET /v2/{project_id}/one-click-alarms	ces:alarms:listOneClickAlarms	-
GET /v2/{project_id}/one-click-alarms/{one_click_alarm_id}/alarms	ces:alarms:listOneClickAlarms	-
PUT /v2/{project_id}/one-click-alarms/{one_click_alarm_id}/alarm-rules/action	ces:alarms:putOneClickAlarms	-
POST /v2/{project_id}/one-click-alarms/batch-delete	ces:alarms:deleteOneClickAlarms	-
PUT /v2/{project_id}/one-click-alarms/{one_click_alarm_id}/notifications	ces:alarms:putOneClickAlarmNotifications	-
PUT /v2/{project_id}/one-click-alarms/{one_click_alarm_id}/alarms/{alarm_id}/policies/action	ces:alarms:putOneClickAlarmPolicies	-
PUT /v2/{project_id}/notification-masks	ces:alarms:putNotificationMaskRules	-
POST /v2/{project_id}/notification-masks/batch-update	ces:alarms:putNotificationMaskRules	-
PUT /v2/{project_id}/notification-masks/{notification_mask_id}	ces:alarms:putNotificationMaskRules	-
POST /v2/{project_id}/notification-masks/batch-delete	ces:alarms:deleteNotificationMaskRules	-
POST /v2/{project_id}/notification-masks/batch-query	ces:alarms:listNotificationMaskRules	-
GET /v2/{project_id}/notification-masks/{notification_mask_id}/resources	ces:alarms:listNotificationMaskResources	-
POST /v2/{project_id}/dashboards	ces:dashboards:create	N/A
GET /v2/{project_id}/dashboards	ces:dashboards:list	N/A
PUT /v2/{project_id}/dashboards/{dashboard_id}	ces:dashboards:put	-
POST /v2/{project_id}/dashboards/batch-delete	ces:dashboards:delete	-
POST /v2/{project_id}/dashboards/{dashboard_id}/widgets	ces:widgets:create	-
GET /v2/{project_id}/dashboards/{dashboard_id}/widgets	ces:widgets:list	-
GET /v2/{project_id}/widgets/{widget_id}	ces:widgets:get	N/A
DELETE /v2/{project_id}/widgets/{widget_id}	ces:widgets:delete	N/A
POST /v2/{project_id}/widgets/batch-update	ces:widgets:put	-
GET /v2/{project_id}/{resource_type}/tags	ces:tags:list	-
GET /v2/{project_id}/instances/{instance_id}/agent-dimensions	ces:namespacesDimensions:listAgentDimensions	-
POST /v2/{project_id}/batch-query-metric-data	ces:metricData:list	-
POST /v3/{project_id}/agent-status/batch-query	ces:agent:listStatuses	-
GET /v3/{project_id}/agent-invocations	ces:agent:listTaskInvocations	-
POST /v3/{project_id}/agent-invocations/batch-create	ces:agent:createAgentInvocations	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in 3, a resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to the resource. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for Cloud Eye.

**Table 3** Resource types supported by Cloud Eye
Resource Type	URN
alarm	ces:<region>:<account-id>:alarm:<alarm-id>
dashboard	ces:<region>:<account-id>:dashboard:<dashboard-id>

Conditions

About condition keys

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. It uses global condition keys applicable to all services but excludes g:requetedRegion. For details, see Global Condition Keys.
  
  Cloud Eye provides global capabilities (such as Alarm Notifications and Task Center). As a result, it functions as a global-level service and does not support the global condition key g:RequestedRegion.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, ces:) apply only to operations of EVS. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

Service-specific condition keys supported by Cloud Eye

The following table lists the condition keys that you can define in custom identity policies for Cloud Eye. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by Cloud Eye
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
ces:namespace	string	Multi-value	Filters access requests based on the namespace specified in the request parameter. For details, see section "Granting Permissions by Cloud Service" in the Cloud Eye User Guide.