Help Center/ Data Warehouse Service/ API Reference/ Permissions and Supported Actions/ Policy-Based Authorization
Updated on 2026-06-22 GMT+08:00
View PDF
Share

Policy-Based Authorization

This section describes the actions supported by DWS in policy-based authorization.

Supported Actions

DWS provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Actions supported by policies are specific to APIs. The following are common concepts related to policies:

  • Permissions: statements in a policy that allow or deny certain operations
  • APIs: RESTful APIs that can be called in a custom policy.
  • Actions: Added to a custom policy to control permissions for specific operations.
  • Related actions: Actions on which a specific action depends to take effect. When assigning permissions for the action to a user, you also need to assign permissions for the related actions.
  • IAM or enterprise projects: Type of projects for which an action will take effect. Policies that contain actions supporting both IAM and enterprise projects can be assigned to user groups and take effect in both IAM and Enterprise Management. Policies that only contain actions supporting IAM projects can be assigned to user groups and only take effect for IAM. Such policies will not take effect if they are assigned to user groups in Enterprise Management. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise projects, see What Are the Differences Between IAM and Enterprise Management?

DWS supports the following actions in custom policies:

Cluster Management

Permission

API

Action

IAM Project

(Project)

Enterprise Project

(Enterprise Project)

Creating a cluster

POST /v1.0/{project_id}/clusters

dws:openAPICluster:create

√

x

Querying the cluster list

GET /v1.0/{project_id}/clusters

dws:openAPICluster:list

√

x

Querying cluster details

GET /v1.0/{project_id}/clusters/{cluster_id}

dws:openAPICluster:getDetail

√

x

Querying the node type

GET /v2/{project_id}/node-types

dws:openAPIFlavors:get

√

x

Deleting a cluster

DELETE /v1.0/{project_id}/clusters/{cluster_id}

dws:openAPICluster:delete

√

x

Restarting a cluster

POST /v1.0/{project_id}/clusters/{cluster_id}/restart

dws:openAPICluster:restart

√

x

Scaling out a cluster

POST /v1.0/{project_id}/clusters/{cluster_id}/resize

dws:cluster:scaleOutOrOpenAPIResize

√

x

Resetting the password

POST /v1.0/{project_id}/clusters/{cluster_id}/reset-password

dws:openAPICluster:resetPassword

√

x

Snapshot Management

Permission

API

Action

IAM Project

(Project)

Enterprise Project

(Enterprise Project)

Creating a snapshot

POST /v1.0/{project_id}/snapshots

dws:openAPISnapshot:create

√

x

Querying the snapshot list

GET /v1.0/{project_id}/snapshots

dws:openAPISnapshot:list

√

x

Querying snapshot details

GET /v1.0/{project_id}/snapshots/{snapshot_id}

dws:openAPISnapshot:detail

√

x

Deleting a snapshot

DELETE /v1.0/{project_id}/snapshots/{snapshot_id}

dws:openAPISnapshot:delete

√

x

Restoring a cluster

POST /v1.0/{project_id}/snapshots/{snapshot_id}/actions

dws:openAPISnapshot:restore

√

x
Parent Topic: Permissions and Supported Actions