Distributed Cache Service (DCS)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DCS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DCS, see Conditions.

The following table lists the actions that you can define in SCP statements for DCS.

**Table 1** Actions supported by DCS
Action	Description	Access Level	Resource Type (* required)	Condition Key
dcs:instance:create	Grants permission to create DCS instances.	write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys dcs:backupEnabled
dcs:instance:list	Grants permission to list DCS instances.	list	-	g:EnterpriseProjectId
dcs:instance:exportListFile	Grants permission to download the exported DCS instance list file.	list	-	-
dcs:instance:delete	Grants permission to delete DCS instances.	write	instance	g:EnterpriseProjectId
dcs:instance:get	Grants permission to query DCS instances.	read	instance *	g:EnterpriseProjectId
dcs:instance:modify	Grants permission to modify DCS instances.	write	instance *	g:EnterpriseProjectId dcs:backupEnabled
dcs:instance:scale	Grants permission to increase DCS instance specifications.	write	instance *	g:EnterpriseProjectId
dcs:instance:swap	Grants permission to perform master/replica switchovers on DCS instances.	write	instance *	g:EnterpriseProjectId
dcs:instance:modifyAuthInfo	Grants permission to modify the passwords of DCS instances.	write	instance *	g:EnterpriseProjectId
dcs:instance:modifyStatus	Grants permission to restart DCS instances or clear their data.	write	instance *	g:EnterpriseProjectId
dcs:instance:getConfiguration	Grants permission to query DCS instance configuration parameters.	read	instance *	g:EnterpriseProjectId
dcs:instance:modifyConfiguration	Grants permission to modify DCS instance configuration parameters.	write	instance *	g:EnterpriseProjectId
dcs:instance:deleteDataBackupFile	Grants permission to delete DCS instance backup data.	write	instance *	g:EnterpriseProjectId
dcs:instance:restoreData	Grants permission to restore DCS instance data.	write	instance *	g:EnterpriseProjectId
dcs:instance:getDataRestoreLog	Grants permission to query DCS instance restoration records.	read	instance *	g:EnterpriseProjectId
dcs:instance:downloadBackupData	Grants permission to obtain backup file URLs.	read	instance *	g:EnterpriseProjectId
dcs:instance:backupData	Grants permission to back up DCS instance data.	write	instance *	g:EnterpriseProjectId
dcs:instance:getDataBackupLog	Grants permission to query DCS instance backup records.	read	instance *	g:EnterpriseProjectId
dcs:migrationTask:create	Grants permission to create data migration tasks.	write	-	-
dcs:migrationTask:list	Grants permission to list data migration tasks.	list	-	-
dcs:migrationTask:delete	Grants permission to delete data migration tasks.	write	migrationTask	-
dcs:migrationTask:get	Grants permission to query data migration tasks.	read	migrationTask *	-
dcs:migrationTask:modify	Grants permission to configure and stop data migration tasks.	write	migrationTask *	-
dcs:instance:listBigKey	Grants permission to query big keys.	list	instance *	g:EnterpriseProjectId
dcs:instance:getBigKey	Grants permission to query big key details.	read	instance *	g:EnterpriseProjectId
dcs:instance:deleteBigKeyScanTask	Grants permission to delete big key scan tasks.	write	instance	g:EnterpriseProjectId
dcs:instance:updateBigKeyAutoScanConfig	Grants permission to reconfigure big key scan tasks.	write	instance *	g:EnterpriseProjectId
dcs:instance:getBigKeyAutoScanConfig	Grants permission to query configurations of big key scan tasks.	read	instance *	g:EnterpriseProjectId
dcs:instance:analyzeHotKey	Grants permission to perform hot key analysis.	write	instance *	g:EnterpriseProjectId
dcs:instance:listHotKey	Grants permission to list hot keys.	list	instance *	g:EnterpriseProjectId
dcs:instance:getHotKey	Grants permission to query hot key details.	read	instance *	g:EnterpriseProjectId
dcs:instance:deleteHotKeyScanTask	Grants permission to delete hot key scan tasks.	write	instance	g:EnterpriseProjectId
dcs:instance:updateHotKeyAutoScanConfig	Grants permission to reconfigure hot key scan tasks.	write	instance *	g:EnterpriseProjectId
dcs:instance:getHotKeyAutoScanConfig	Grants permission to query configurations of hot key scan tasks.	read	instance *	g:EnterpriseProjectId
dcs:instance:analyzeExpiredKey	Grants permission to perform expired key analysis.	write	instance *	g:EnterpriseProjectId
dcs:instance:getAutoExpiredKeyScanTask	Grants permission to query expired key scan tasks.	read	instance *	-
dcs:instance:updateExpiredKeyScanConfig	Grants permission to reconfigure expired key scan tasks.	write	instance *	g:EnterpriseProjectId
dcs:instance:getExpiredKeyScanConfig	Grants permission to query configurations of expired key scan tasks.	read	instance *	g:EnterpriseProjectId
dcs:slowlog:list	Grants permission to query slow query logs.	list	instance *	g:EnterpriseProjectId
dcs:aclaccount:create	Grants permission to create ACL accounts.	write	instance *	-
dcs:aclaccount:list	Grants permission to query ACL accounts.	list	instance *	-
dcs:aclaccount:modify	Grants permission to modify the passwords of ACL accounts.	write	instance *	-
dcs:aclaccount:delete	Grants permission to delete ACL accounts.	write	instance *	-
dcs:whitelist:modify	Grants permission to configure IP address whitelist groups.	write	instance *	-
dcs:whitelist:list	Grants permission to query the IP address whitelist of instances.	list	instance *	-
dcs:instance:getBackgroundTask	Grants permission to query background tasks.	read	instance *	g:EnterpriseProjectId
dcs:instance:deleteBackgroundTask	Grants permission to delete background tasks.	write	instance *	g:EnterpriseProjectId
dcs:instance:createDiagnosisTask	Grants permission to diagnose instances.	write	instance *	g:EnterpriseProjectId
dcs:instance:listDiagnosisTask	Grants permission to query diagnosis tasks.	list	instance *	g:EnterpriseProjectId
dcs:instance:getDiagnosisTask	Grants permission to query diagnosis details.	read	instance *	g:EnterpriseProjectId
dcs:instance:deleteDiagnosisTask	Grants permission to delete diagnosis records.	write	instance *	g:EnterpriseProjectId
dcs:template:list	Grants permission to list parameter templates.	list	-	-
dcs:template:create	Grants permission to customize templates.	write	-	-
dcs:template:get	Grants permission to query parameter templates.	read	-	-
dcs:template:modify	Grants permission to modify custom templates.	write	-	-
dcs:template:delete	Grants permission to delete custom templates.	write	-	-
dcs:tag:list	Grants permission to query all tags in your tenant account.	list	-	-
dcs:tag:modify	Grants permission to add or delete tags in batches.	write	instance *	-
dcs:tag:modify	Grants permission to add or delete tags in batches.	write	-	g:RequestTag/<tag-key> g:TagKeys
dcs:tag:get	Grants permission to query tags of an instance.	read	instance *	-
dcs:tag:get	Grants permission to query tags of an instance.	read	-	g:RequestTag/<tag-key> g:TagKeys
dcs:redisLog:get	Grants permission to obtain log download URLs.	read	instance *	-
dcs:quota:get	Grants permission to query tenant quotas.	read	-	-
dcs:instance:webcli	Grants permission to connect to DCS Redis instances using Web CLI.	write	instance *	-
dcs:clientIpTrans:modify	Grants permission to enable or disable client IP pass-through.	write	instance *	-
dcs:clients:list	Grants permission to list Redis sessions.	read	instance *	-
dcs:clients:kill	Grants permission to kill Redis sessions.	write	instance *	-
dcs:ssl:get	Grants permissions to obtain SSL certificate information.	read	instance *	-
dcs:ssl:modify	Grants permissions to modify the SSL setting.	write	instance *	-
dcs:job:get	Grants permission to obtain the pre-check result.	read	-	-
dcs:task:list	Grants permission to list background tasks.	list	-	-
dcs:task:delete	Grants permission to delete background tasks.	write	-	-

Each API of DCS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by DCS APIs
API	Action	Dependencies
GET /v2/{project_id}/instances	dcs:instance:list	-
DELETE /v2/{project_id}/instances	dcs:instance:delete	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get
GET /v2/{project_id}/instances/{instance_id}	dcs:instance:get	-
DELETE /v2/{project_id}/instances/{instance_id}	dcs:instance:delete	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get
PUT /v2/{project_id}/instances/{instance_id}	dcs:instance:modify	vpc:ports:get vpc:ports:update
POST /v2/{project_id}/instances/{instance_id}/resize	dcs:instance:scale	vpc:ports:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:subnets:get vpc:securityGroupRules:get vpc:securityGroups:get
POST /v2/{project_id}/instances/{instance_id}/resize/check-job	dcs:instance:scale	-
POST /v2/{project_id}/instances/{instance_id}/swap	dcs:instance:swap	-
PUT /v2/{project_id}/instances/{instance_id}/password	dcs:instance:modifyAuthInfo	-
POST /v2/{project_id}/instances/{instance_id}/password/reset	dcs:instance:modifyAuthInfo	-
GET /v2/{project_id}/instances/status	dcs:instance:list	-
PUT /v2/{project_id}/instances/status	dcs:instance:modifyStatus	-
GET /v2/{project_id}/instances/statistic	dcs:instance:list	-
POST /v2/{project_id}/instances/{instance_id}/groups/{group_id}/replications/{node_id}/slave-priority	dcs:instance:modify	-
DELETE /v2/{project_id}/instances/{instance_id}/groups/{group_id}/replications/{node_id}/remove-ip	dcs:instance:delete	-
GET /v2/{project_id}/instance/{instance_id}/groups	dcs:instance:get	-
GET /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:getConfiguration	-
PUT /v2/{project_id}/instances/{instance_id}/configs	dcs:instance:modifyConfiguration	-
PUT /v2/{project_id}/instances/{instance_id}/async-configs	dcs:instance:modifyConfiguration	-
DELETE /v2/{project_id}/instances/{instance_id}/backups/{backup_id}	dcs:instance:deleteDataBackupFile	-
POST /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:restoreData	-
GET /v2/{project_id}/instances/{instance_id}/restores	dcs:instance:getDataRestoreLog	-
POST /v2/{project_id}/instances/{instance_id}/backups/{backup_id}/links	dcs:instance:downloadBackupData	-
POST /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:backupData	-
GET /v2/{project_id}/instances/{instance_id}/backups	dcs:instance:getDataBackupLog	-
POST /v2/{project_id}/migration-task	dcs:migrationTask:create	-
GET /v2/{project_id}/migration-tasks	dcs:migrationTask:list	-
DELETE /v2/{project_id}/migration-tasks/delete	dcs:migrationTask:delete	-
GET /v2/{project_id}/migration-task/{task_id}	dcs:migrationTask:get	-
POST /v2/{project_id}/migration-task/{task_id}/stop	dcs:migrationTask:modify	-
GET /v2/{project_id}/migration-task/{task_id}/stats	dcs:migrationTask:get	-
POST /v2/{project_id}/migration/instance	dcs:migrationTask:create	-
POST /v2/{project_id}/migration/{task_id}/task	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/batch-stop	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/{task_id}/sync-stop	dcs:migrationTask:modify	-
GET /v2/{project_id}/dcs/tags	dcs:tag:list	-
POST /v2/{project_id}/dcs/{instance_id}/tags/action	dcs:tag:modify	-
GET /v2/{project_id}/instances/{instance_id}/tags	dcs:tag:get	-
GET /v2/{project_id}/instances/{instance_id}/bigkey-tasks	dcs:instance:listBigKey	-
PUT /v2/{project_id}/instances/{instance_id}/bigkey/autoscan	dcs:instance:updateBigKeyAutoScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/bigkey/autoscan	dcs:instance:getBigKeyAutoScanConfig	-
POST /v2/{project_id}/instances/{instance_id}/hotkey-task	dcs:instance:analyzeHotKey	-
GET /v2/{project_id}/instances/{instance_id}/hotkey-tasks	dcs:instance:listHotKey	-
GET /v2/{project_id}/instances/{instance_id}/hotkey-task/{hotkey_id}	dcs:instance:getHotKey	-
DELETE /v2/{project_id}/instances/{instance_id}/hotkey-task/{hotkey_id}	dcs:instance:deleteHotKeyScanTask	-
PUT /v2/{project_id}/instances/{instance_id}/hotkey/autoscan	dcs:instance:updateHotKeyAutoScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/hotkey/autoscan	dcs:instance:getHotKeyAutoScanConfig	-
POST /v2/{project_id}/instances/{instance_id}/scan-expire-keys-task	dcs:instance:analyzeExpiredKey	-
GET /v2/{project_id}/instances/{instance_id}/auto-expire/histories	dcs:instance:getAutoExpiredKeyScanTask	-
POST /v2/{project_id}/instances/{instance_id}/auto-expire/scan	dcs:instance:analyzeExpiredKey	-
GET /v2/{project_id}/instances/{instance_id}/scan-expire-keys/autoscan-config	dcs:instance:getExpiredKeyScanConfig	-
PUT /v2/{project_id}/instances/{instance_id}/scan-expire-keys/autoscan-config	dcs:instance:updateExpiredKeyScanConfig	-
GET /v2/{project_id}/instances/{instance_id}/slowlog	dcs:slowlog:list	-
GET /v2/{project_id}/instances/{instance_id}/redislog	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/redislog	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/redislog/{id}/links	dcs:redisLog:get	-
POST /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:create	-
GET /v2/{project_id}/instances/{instance_id}/accounts	dcs:aclaccount:list	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/password/modify	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/password/reset	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:modify	-
PUT /v2/{project_id}/instances/{instance_id}/accounts/{account_id}/role	dcs:aclaccount:modify	-
DELETE /v2/{project_id}/instances/{instance_id}/accounts/{account_id}	dcs:aclaccount:delete	-
PUT /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:modify	-
GET /v2/{project_id}/instance/{instance_id}/whitelist	dcs:whitelist:list	-
GET /v2/{project_id}/instances/{instance_id}/tasks	dcs:instance:getBackgroundTask	-
DELETE /v2/{project_id}/instances/{instance_id}/tasks/{task_id}	dcs:instance:deleteBackgroundTask	-
GET /v2/{project_id}/quota	dcs:quota:get	-
GET /v2/{project_id}/dims/monitored-objects/{instance_id}	dcs:instance:get	-
GET /v2/{project_id}/dims/monitored-objects	dcs:instance:list	-
POST /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:createDiagnosisTask	-
GET /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:listDiagnosisTask	-
GET /v2/{project_id}/diagnosis/{report_id}	dcs:instance:getDiagnosisTask	-
DELETE /v2/{project_id}/instances/{instance_id}/diagnosis	dcs:instance:deleteDiagnosisTask	-
GET /v2/{project_id}/config-templates	dcs:template:list	-
POST /v2/{project_id}/config-templates	dcs:template:create	-
GET /v2/{project_id}/config-templates/{template_id}	dcs:template:get	-
DELETE /v2/{project_id}/config-templates/{template_id}	dcs:template:delete	-
PUT /v2/{project_id}/config-templates/{template_id}	dcs:template:modify	-
GET /v2/{project_id}/instances-logical-nodes	dcs:instance:list	-
GET /v2/{project_id}/instances/{instance_id}/config-histories	dcs:instance:get	-
PUT /v2/{project_id}/instances/{instance_id}/bandwidth	dcs:instance:modify	-
PUT /v2/{project_id}/instances/{instance_id}/async-swap	dcs:instance:swap	-
GET /v2/{project_id}/instances/{instance_id}/operations	dcs:instance:get	-
POST /v2/{project_id}/instances/{instance_id}/webcli/auth	dcs:instance:webcli	-
POST /v2/{project_id}/instances/{instance_id}/webcli/command	dcs:instance:webcli	-
POST /v2/{project_id}/instances/{instance_id}/webcli/logout	dcs:instance:webcli	-
PUT /v2/{project_id}/{instance_id}/client-ip-transparent-transmission	dcs:clientIpTrans:modify	-
GET /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}	dcs:instance:getBigKey	-
DELETE /v2/{project_id}/instances/{instance_id}/bigkey-task/{bigkey_id}	dcs:instance:deleteBigKeyScanTask	-
POST /v2/{project_id}/instances/{instance_id}/clients	dcs:clients:list	-
GET /v2/{project_id}/instances/{instance_id}/clients	dcs:clients:list	-
POST /v2/{project_id}/instances/{instance_id}/clients/kill	dcs:clients:kill	-
POST /v2/{project_id}/instances/{instance_id}/clients/kill-all	dcs:clients:kill	-
GET /v2/{project_id}/instances/{instance_id}/config-histories/{history_id}	dcs:instance:get	-
GET /v2/{project_id}/instances/{instance_id}/deletable-replication	dcs:instance:scale	-
POST /v2/{project_id}/instances/export	dcs:instance:list	-
GET /v2/{project_id}/instance/{instance_id}/groups/{group_id}/group-nodes-state	dcs:instance:get	-
POST /v2/{project_id}/instance/{instance_id}/groups/{group_id}/replications/{node_id}/async-switchover	dcs:instance:swap	-
GET /v2/{project_id}/instances/{instance_id}/ssl	dcs:ssl:get	-
PUT /v2/{project_id}/instances/{instance_id}/ssl	dcs:ssl:modify	-
POST /v2/{project_id}/instances/{instance_id}/ssl-certs/download	dcs:ssl:modify	-
GET /v2/{project_id}/instances/{instance_id}/tasks/{task_id}/progress	dcs:instance:getBackgroundTask	-
GET /v2/{project_id}/instances/export-job	dcs:instance:exportListFile	-
GET /v2/{project_id}/jobs/{job_id}	dcs:job:get	-
PUT /v2/{project_id}/migration-task/{task_id}	dcs:migrationTask:modify	-
POST /v2/{project_id}/migration-task/{task_id}/exchange-ip	dcs:migrationTask:modify	-
GET /v2/{project_id}/tasks	dcs:task:list	-
DELETE /v2/{project_id}/tasks/{task_id}	dcs:task:delete	-
GET /v2/{project_id}/migration-task/{task_id}/logs	dcs:migrationTask:get	-

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can define in SCP statements for DCS.

**Table 3** Resource types supported by DCS
Resource Type	URN
instance	dcs:<region>:<account-id>:instance:<instance-id>
migrationTask	dcs:<region>:<account-id>:migrationTask:<task-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, dcs:) only apply to operations of the DCS service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in SCPs for DCS. You can include these condition keys to specify conditions for when your SCP is in effect.