Cloud Connect (CC)

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (such as list, read, or write). This classification helps you understand the level of access that an action grants when you use it in an SCP policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Cloud Connect, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Cloud Connect, see Conditions.

The following table lists the actions that you can define in SCP statements for Cloud Connect.

**Table 1** Actions supported by Cloud Connect
Action	Description	Access Level	Resource Type (*: required)	Condition Key
cc:cloudConnections:create	Grants permission to create a cloud connection.	write	cloudConnection *	-
cc:cloudConnections:create	Grants permission to create a cloud connection.	write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
cc:cloudConnections:delete	Grants permission to delete a cloud connection.	write	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:cloudConnections:update	Grants permission to update a cloud connection.	write	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:cloudConnections:get	Grants permission to query the details of a cloud connection.	read	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:cloudConnections:list	Grants permission to list the cloud connections.	list	cloudConnection *	-
cc:cloudConnections:tag	Grants permission to add tags to a cloud connection.	tagging	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:cloudConnections:tag	Grants permission to add tags to a cloud connection.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:cloudConnections:unTag	Grants permission to delete tags from a cloud connection.	tagging	cloudConnection *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:cloudConnections:unTag	Grants permission to delete tags from a cloud connection.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:cloudConnections:listTags	Grants permission to list the tags added to a cloud connection.	list	cloudConnection *	-
cc:networkInstances:create	Grants permission to load a network instance.	write	networkInstance *	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId
cc:networkInstances:delete	Grants permission to remove a network instance.	write	networkInstance *	cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:update	Grants permission to update a network instance.	write	networkInstance *	cc:VpcId cc:VirtualGatewayId cc:EnterpriseRouterId
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:get	Grants permission to query the details of a network instance.	read	networkInstance *	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:networkInstances:list	Grants permission to list the network instances.	list	networkInstance *	-
cc:bandwidthPackages:create	Grants permission to create a bandwidth package.	write	bandwidthPackage *	-
cc:bandwidthPackages:create	Grants permission to create a bandwidth package.	write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
cc:bandwidthPackages:delete	Grants permission to delete a bandwidth package.	write	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:bandwidthPackages:update	Grants permission to update a bandwidth package.	write	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:bandwidthPackages:get	Grants permission to query the details of a bandwidth package.	read	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:bandwidthPackages:list	Grants permission to list the bandwidth packages.	list	bandwidthPackage *	-
cc:bandwidthPackages:tag	Grants permission to add tags to a bandwidth package.	tagging	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:bandwidthPackages:tag	Grants permission to add tags to a bandwidth package.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:bandwidthPackages:unTag	Grants permission to delete tags from a bandwidth package.	tagging	bandwidthPackage *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:bandwidthPackages:unTag	Grants permission to delete tags from a bandwidth package.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:bandwidthPackages:listTags	Grants permission to list the tags added to a bandwidth package.	list	bandwidthPackage *	-
cc:bandwidthPackages:associate	Grants permission to bind a bandwidth package to a cloud connection.	write	bandwidthPackage *	g:ResourceTag/<tag-key>
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:bandwidthPackages:disassociate	Grants permission to unbind a bandwidth package from a cloud connection.	write	bandwidthPackage *	g:ResourceTag/<tag-key>
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:create	Grants permission to assign an inter-region bandwidth.	write	interRegionBandwidth *	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:BandwidthPackageId
cc:interRegionBandwidths:delete	Grants permission to delete an inter-region bandwidth.	write	interRegionBandwidth *	cc:BandwidthPackageId
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:update	Grants permission to modify an inter-region bandwidth.	write	interRegionBandwidth *	cc:BandwidthPackageId
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:get	Grants permission to query the details of an inter-region bandwidth.	read	interRegionBandwidth *	-
			cloudConnection *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:interRegionBandwidths:list	Grants permission to list the inter-region bandwidths.	list	interRegionBandwidth *	-
cc:cloudConnectionRoutes:get	Grants permission to query the details of a cloud connection route.	read	-	-
cc:cloudConnectionRoutes:list	Grants permission to list the cloud connection routes.	list	-	-
cc:authorisation:create	Grants permission to allow other accounts to load the VPCs in your account to their cloud connections.	write	-	-
cc:authorisation:delete	Grants permission to stop allowing other accounts to load the VPCs in your account to their cloud connections.	write	-	-
cc:authorisation:update	Grants permission to update the authorization that allows other accounts to load the VPCs in your account to their cloud connections.	write	-	-
cc:authorisation:list	Grants permission to list the VPCs that are allowed to be loaded to the cloud connections in other accounts.	list	-	-
cc:authorisation:listPermissions	Grants permission to list the VPCs that other accounts allow you to load to your cloud connection.	list	-	-
cc:centralNetwork:create	Grants permission to create a central network.	write	centralNetwork *	-
cc:centralNetwork:create	Grants permission to create a central network.	write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys cc:MultipleEnterpriseRouterIds
cc:centralNetwork:delete	Grants permission to delete a central network.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:update	Grants permission to update a central network.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:update	Grants permission to update a central network.	write	-	g:RequestTag/<tag-key> g:TagKeys
cc:centralNetwork:get	Grants permission to query the details of a central network.	read	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:list	Grants permission to list the central networks.	list	centralNetwork *	-
cc:centralNetwork:tag	Grants permission to add tags to a central network.	tagging	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:tag	Grants permission to add tags to a central network.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:centralNetwork:unTag	Grants permission to delete tags from a central network.	tagging	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:unTag	Grants permission to delete tags from a central network.	tagging	-	g:RequestTag/<tag-key> g:TagKeys
cc:centralNetwork:listTags	Grants permission to list the tags added to a central network.	list	centralNetwork *	-
cc:centralNetwork:createPolicy	Grants permission to add a policy to a central network.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:createPolicy	Grants permission to add a policy to a central network.	write	-	cc:MultipleEnterpriseRouterIds
cc:centralNetwork:applyPolicy	Grants permission to apply a policy to a central network.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:deletePolicy	Grants permission to delete a policy from a central network.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:listPolicies	Grants permission to list the central network policies.	list	centralNetwork *	-
cc:centralNetwork:listChangeSet	Grants permission to query the changes between the current policy and the applied policy.	list	centralNetwork *	-
cc:centralNetwork:listConnections	Grants permission to list the central network connections.	list	centralNetwork *	-
cc:centralNetwork:updateConnection	Grants permission to update a central network connection.	write	centralNetwork *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
cc:centralNetwork:updateConnection	Grants permission to update a central network connection.	write	-	cc:GlobalConnectionBandwidthId
cc:centralNetworkAttachment:createGdgw	Grants permission to add a global DC gateway to a central network as an attachment.	write	centralNetworkAttachment *	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:EnterpriseRouterId cc:GlobalDcGatewayId
cc:centralNetworkAttachment:updateGdgw	Grants permission to update a global DC gateway on a central network.	write	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:getGdgw	Grants permission to query the details of a global DC gateway on a central network.	read	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:listGdgws	Grants permission to list the global DC gateways on a central network.	list	centralNetworkAttachment *	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:createErRouteTable	Grants permission to add an enterprise router route table to a central network as an attachment.	write	centralNetworkAttachment *	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId cc:MultipleEnterpriseRouterIds
cc:centralNetworkAttachment:updateErRouteTable	Grants permission to update an enterprise router route table on a central network.	write	centralNetworkAttachment *	cc:MultipleEnterpriseRouterIds
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:getErRouteTable	Grants permission to query the details of an enterprise router route table on a central network.	read	centralNetworkAttachment *	cc:MultipleEnterpriseRouterIds
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:listErRouteTables	Grants permission to list the enterprise router route tables on a central network.	list	centralNetworkAttachment *	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:delete	Grants permission to delete an attachment from a central network.	write	centralNetworkAttachment *	cc:GlobalDcGatewayId cc:EnterpriseRouterId cc:MultipleEnterpriseRouterIds
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId
cc:centralNetworkAttachment:list	Grants permission to list the central network attachments.	list	centralNetworkAttachment *	-
			centralNetwork *	g:ResourceTag/<tag-key>
			-	g:EnterpriseProjectId

Each API of Cloud Connect usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by Cloud Connect APIs
API	Action	Dependencies
POST /v3/{domain_id}/ccaas/cloud-connections	cc:cloudConnections:create	-
PUT /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:update	-
DELETE /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:delete	-
GET /v3/{domain_id}/ccaas/cloud-connections/{id}	cc:cloudConnections:get	-
GET /v3/{domain_id}/ccaas/cloud-connections	cc:cloudConnections:list	-
POST /v3/{domain_id}/ccaas/cloud-connections/filter	cc:cloudConnections:list	-
POST /v3/{domain_id}/ccaas/cloud-connections/{id}/tag	cc:cloudConnections:tag	-
POST /v3/{domain_id}/ccaas/cloud-connections/{id}/untag	cc:cloudConnections:unTag	-
GET /v3/{domain_id}/ccaas/cloud-connections/tags	cc:cloudConnections:listTags	-
POST /v3/{domain_id}/ccaas/network-instances	cc:networkInstances:create	-
PUT /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:update	-
DELETE /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:delete	-
GET /v3/{domain_id}/ccaas/network-instances/{id}	cc:networkInstances:get	-
GET /v3/{domain_id}/ccaas/network-instances	cc:networkInstances:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages	cc:bandwidthPackages:create	-
PUT /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:update	-
DELETE /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:delete	-
GET /v3/{domain_id}/ccaas/bandwidth-packages/{id}	cc:bandwidthPackages:get	-
GET /v3/{domain_id}/ccaas/bandwidth-packages	cc:bandwidthPackages:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/filter	cc:bandwidthPackages:list	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/tag	cc:bandwidthPackages:tag	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/untag	cc:bandwidthPackages:unTag	-
GET /v3/{domain_id}/ccaas/bandwidth-packages/tags	cc:bandwidthPackages:listTags	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/associate	cc:bandwidthPackages:associate	-
POST /v3/{domain_id}/ccaas/bandwidth-packages/{id}/disassociate	cc:bandwidthPackages:disassociate	-
POST /v3/{domain_id}/ccaas/inter-region-bandwidths	cc:interRegionBandwidths:create	-
PUT /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:update	-
DELETE /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:delete	-
GET /v3/{domain_id}/ccaas/inter-region-bandwidths/{id}	cc:interRegionBandwidths:get	-
GET /v3/{domain_id}/ccaas/inter-region-bandwidths	cc:interRegionBandwidths:list	-
GET /v3/{domain_id}/ccaas/cloud-connection-routes/{id}	cc:cloudConnectionRoutes:get	-
GET /v3/{domain_id}/ccaas/cloud-connection-routes	cc:cloudConnectionRoutes:list	-
POST /v3/{domain_id}/ccaas/authorisations	cc:authorisation:create	-
DELETE /v3/{domain_id}/ccaas/authorisations/{id}	cc:authorisation:delete	-
PUT /v3/{domain_id}/ccaas/authorisations/{id}	cc:authorisation:update	-
GET /v3/{domain_id}/ccaas/authorisations	cc:authorisation:list	-
GET /v3/{domain_id}/ccaas/permissions	cc:authorisation:listPermissions	-
GET /v3/{domain_id}/ccaas/quotas	cc:quota:list	-
GET /v3/{domain_id}/gcn/quotas	cc:quota:list	-
GET /v3/{domain_id}/ccaas/capabilities	cc:capability:list	-
GET /v3/{domain_id}/gcn/capabilities	cc:capability:list	-
POST /v3/{domain_id}/gcn/central-networks	cc:centralNetwork:create	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
DELETE /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:delete	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:update	-
GET /v3/{domain_id}/gcn/central-networks/{central_network_id}	cc:centralNetwork:get	-
GET /v3/{domain_id}/gcn/central-networks	cc:centralNetwork:list	-
POST /v3/{domain_id}/gcn/central-networks/filter	cc:centralNetwork:list	-
POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/tag	cc:centralNetwork:tag	-
POST /v3/{domain_id}/gcn/central-networks/{central_network_id}/untag	cc:centralNetwork:unTag	-
GET /v3/{domain_id}/gcn/central-networks/tags	cc:centralNetwork:listTags	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies	cc:centralNetwork:createPolicy	er:instances:get er:routeTables:get
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/apply	cc:centralNetwork:applyPolicy	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}	cc:centralNetwork:deletePolicy	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies	cc:centralNetwork:listPolicies	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/policies/{policy_id}/change-set	cc:centralNetwork:listChangeSet	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/connections	cc:centralNetwork:listConnections	-
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/connections/{connection_id}	cc:centralNetwork:updateConnection	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments	cc:centralNetworkAttachment:createGdgw	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}	cc:centralNetworkAttachment:updateGdgw	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments/{gdgw_attachment_id}	cc:centralNetworkAttachment:getGdgw	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/gdgw-attachments	cc:centralNetworkAttachment:listGdgws	-
POST /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments	cc:centralNetworkAttachment:createErRouteTable	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
PUT /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}	cc:centralNetworkAttachment:updateErRouteTable	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments/{er_route_table_attachment_id}	cc:centralNetworkAttachment:getErRouteTable	-
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/er-route-table-attachments	cc:centralNetworkAttachment:listErRouteTables	-
DELETE /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments/{attachment_id}	cc:centralNetworkAttachment:delete	er:instances:get er:routeTables:get er:routeTables:listPropagations er:routeTables:enablePropagation er:routeTables:disablePropagation er:routeTables:listAssociations er:routeTables:associate er:routeTables:disassociate
GET /v3/{domain_id}/gcn/central-network/{central_network_id}/attachments	cc:centralNetworkAttachment:list	-

Resources

A resource type indicates the resources that an SCP policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP policy to define resource types.

The following table lists the resource types that you can define in SCP statements for Cloud Connect.

**Table 3** Resource types supported by Cloud Connect
Resource Type	URN
cloudConnection	cc::<account-id>:cloudConnection:<cloud-connection-id>
interRegionBandwidth	cc::<account-id>:interRegionBandwidth:<inter-region-bandwidth-id>
networkInstance	cc::<account-id>:networkInstance:<network-instance-id>
siteNetwork	cc::<account-id>:siteNetwork:<site-network-id>
bandwidthPackage	cc::<account-id>:bandwidthPackage:<bandwidth-package-id>
centralNetwork	cc::<account-id>:centralNetwork:<central-network-id>
centralNetworkAttachment	cc::<account-id>:centralNetworkAttachment:<central-network-attachment-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

A key in the Condition element of a statement can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cc:) apply only to operations of Cloud Connect. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For details about the supported operators, see operators.

The following table lists the condition keys that you can define in SCPs for Cloud Connect. You can include these condition keys to specify conditions for when your SCP is in effect.

**Table 4** Service-specific condition keys supported by Cloud Connect
Service-specific Condition Key	Type	Single-valued/Multivalued	What To Do
cc:VpcId	string	Single-valued	VPC ID as a filter.
cc:VirtualGatewayId	string	Single-valued	Direct Connect virtual gateway ID as a filter.
cc:EnterpriseRouterId	string	Single-valued	Enterprise router ID as a filter.
cc:MultipleEnterpriseRouterIds	string	Multivalued	Enterprise router IDs as a filter.
cc:BandwidthPackageId	string	Single-valued	Bandwidth package ID as a filter.
cc:GlobalConnectionBandwidthId	string	Single-valued	Global private bandwidth ID as a filter.
cc:GlobalDcGatewayId	string	Single-valued	Global DC gateway ID as a filter.