Simple Message Notification (SMN)

The Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU.

This section describes the elements used by Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an SCP.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an SCP.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your SCP statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by SMN, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an SCP statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by SMN, see Conditions.

The following table lists the actions that you can define in SCP statements for SMN.

**Table 1** Actions supported by SMN
Action	Description	Access Level	Resource Type (*: required)	Condition Key
smn:topic:create	Grants permission to create a topic.	write	topic *	N/A
smn:topic:create	Grants permission to create a topic.	write	N/A	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys
smn:topic:listTopic	Grants permission to query topics.	list	topic *	N/A
smn:topic:listTopic	Grants permission to query topics.	list	N/A	g:EnterpriseProjectId
smn:topic:updateTopic	Grants permission to update a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:get	Grants permission to query details of a topic.	read	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:delete	Grants permission to delete a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:listAttributes	Grants permission to query a topic policy.	list	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:deleteAttribute	Grants permission to delete a topic policy.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:updateAttribute	Grants permission to update a topic policy.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:updateAttribute	Grants permission to update a topic policy.	write	N/A	smn:TargetOrgPath smn:TargetOrgId smn:TargetAccountId
smn:topic:subscribe	Grants permission to add a subscription to a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:subscribe	Grants permission to add a subscription to a topic.	write	N/A	smn:Protocol smn:Endpoint
smn:topic:listSubscriptionsByTopic	Grants permission to query subscriptions of a topic.	list	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:listSubscriptions	Grants permission to query subscriptions of all topics.	list	topic *	N/A
smn:topic:deleteSubscription	Grants permission to delete a subscription from a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:updateSubscription	Grants permission to update a subscription of a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:publish	Grants permission to publish a message.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:template:create	Grants permission to create a message template.	write	template *	N/A
smn:template:listTemplates	Grants permission to query message templates.	list	template *	N/A
smn:template:update	Grants permission to modify a message template.	write	template *	N/A
smn:template:get	Grants permission to query details of a message template.	read	template *	N/A
smn:template:delete	Grants permission to delete a message template.	write	template *	N/A
smn:tag:create	Grants permission to add a tag to a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:tag:create	Grants permission to add a tag to a topic.	write	N/A	g:RequestTag/<tag-key> g:TagKeys
smn:tag:delete	Grants permission to delete a tag of a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:tag:delete	Grants permission to delete a tag of a topic.	write	N/A	g:RequestTag/<tag-key> g:TagKeys
smn:tag:batchModify	Grants permission to batch modify tags of a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:tag:batchModify	Grants permission to batch modify tags of a topic.	write	N/A	g:RequestTag/<tag-key> g:TagKeys
smn:tag:list	Grants permission to query tags of a topic.	read	topic *	g:ResourceTag/<tag-key>
smn:topic:createLogTank	Grants permission to associate a topic with a log stream.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:listLogTank	Grants permission to query the log stream associated with a topic.	list	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:updateLogTank	Grants permission to update the log stream associated with a topic.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:deleteLogTank	Grants permission to disassociate a topic from a log stream.	write	topic *	g:EnterpriseProjectId g:ResourceTag/<tag-key>
smn:topic:createNotifyPolicy	Grants permission to create a notification policy.	write	topic *	N/A
smn:topic:updateNotifyPolicy	Grants permission to modify a notification policy.	write	topic *	N/A
smn:topic:getNotifyPolicy	Grants permission to query a notification policy.	read	topic *	N/A
smn:topic:deleteNotifyPolicy	Grants permission to delete a notification policy.	write	topic *	N/A

Each API of SMN usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by SMN APIs
API	Action	Dependencies
POST /v2/{project_id}/notifications/topics	smn:topic:create	N/A
GET /v2/{project_id}/notifications/topics	smn:topic:listTopic	N/A
PUT /v2/{project_id}/notifications/topics/{topic_urn}	smn:topic:updateTopic	N/A
GET /v2/{project_id}/notifications/topics/{topic_urn}	smn:topic:get	N/A
DELETE /v2/{project_id}/notifications/topics/{topic_urn}	smn:topic:delete	N/A
GET /v2/{project_id}/notifications/topics/{topic_urn}/attributes	smn:topic:listAttributes	N/A
DELETE /v2/{project_id}/notifications/topics/{topic_urn}/attributes	smn:topic:deleteAttribute	N/A
PUT /v2/{project_id}/notifications/topics/{topic_urn}/attributes/{name}	smn:topic:updateAttribute	N/A
DELETE /v2/{project_id}/notifications/topics/{topic_urn}/attributes/{name}	smn:topic:deleteAttribute	N/A
POST /v2/{project_id}/notifications/topics/{topic_urn}/subscriptions	smn:topic:subscribe	N/A
GET /v2/{project_id}/notifications/topics/{topic_urn}/subscriptions	smn:topic:listSubscriptionsByTopic	N/A
PUT /v2/{project_id}/notifications/topics/{topic_urn}/subscriptions/{subscription_urn}	smn:topic:updateSubscription	N/A
DELETE /v2/{project_id}/notifications/subscriptions/{subscription_urn}	smn:topic:deleteSubscription	N/A
GET /v2/{project_id}/notifications/subscriptions	smn:topic:listSubscriptions	N/A
POST /v2/{project_id}/notifications/topics/{topic_urn}/publish	smn:topic:publish	N/A
POST /v2/{project_id}/notifications/message_template	smn:template:create	N/A
GET /v2/{project_id}/notifications/message_template	smn:template:listTemplates	N/A
PUT /v2/{project_id}/notifications/message_template/{message_template_id}	smn:template:update	N/A
GET /v2/{project_id}/notifications/message_template/{message_template_id}	smn:template:get	N/A
DELETE /v2/{project_id}/notifications/message_template/{message_template_id}	smn:template:delete	N/A
POST /v2/{project_id}/{resource_type}/{resource_id}/tags	smn:tag:create	N/A
GET /v2/{project_id}/{resource_type}/{resource_id}/tags	smn:tag:list	N/A
POST /v2/{project_id}/{resource_type}/{resource_id}/tags/action	smn:tag:batchModify	smn:tag:create smn:tag:delete
DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/{key}	smn:tag:delete	N/A
GET /v2/{project_id}/{resource_type}/tags	smn:tag:list	N/A
POST /v2/{project_id}/{resource_type}/resource_instances/action	smn:tag:list	N/A
GET /v2/{project_id}/notifications/topics/{topic_urn}/logtanks	smn:topic:listLogTank	N/A
POST /v2/{project_id}/notifications/topics/{topic_urn}/logtanks	smn:topic:createLogTank	N/A
PUT /v2/{project_id}/notifications/topics/{topic_urn}/logtanks/{logtank_id}	smn:topic:updateLogTank	N/A
DELETE /v2/{project_id}/notifications/topics/{topic_urn}/logtanks/{logtank_id}	smn:topic:deleteLogTank	N/A
POST /v2/{project_id}/notifications/subscriptions/filter_polices	smn:topic:updateSubscription	N/A
PUT /v2/{project_id}/notifications/subscriptions/filter_polices	smn:topic:updateSubscription	N/A
DELETE /v2/{project_id}/notifications/subscriptions/filter_polices	smn:topic:updateSubscription	N/A
POST /v2/{project_id}/notifications/topics/{topic_urn}/subscriptions/from-subscription-users	smn:topic:subscribe	N/A
POST /v2/{project_id}/notifications/topics/{topic_urn}/notify-policy	smn:topic:createNotifyPolicy	smn:topic:listSubscriptionsByTopic
PUT /v2/{project_id}/notifications/topics/{topic_urn}/notify-policy/{notify_policy_id}	smn:topic:updateNotifyPolicy	smn:topic:listSubscriptionsByTopic
GET /v2/{project_id}/notifications/topics/{topic_urn}/notify-policy	smn:topic:getNotifyPolicy	N/A
DELETE /v2/{project_id}/notifications/topics/{topic_urn}/notify-policy/{notify_policy_id}	smn:topic:deleteNotifyPolicy	N/A

Resources

A resource type indicates the resources that an SCP applies to. If you specify a resource type for any action in Table 3, a resource URN must be specified in the SCP statements using that action, and the SCP applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the SCP applies to all resources. You can also set condition keys in an SCP to define resource types.

The following table lists the resource types that you can define in SCP statements for SMN.

**Table 3** Resource types supported by SMN
Resource Type	URN
topic	smn:<region>:<account-id>:topic:<topic-id>
template	smn:<region>:<account-id>:template:<template-id>

Conditions

A Condition element lets you specify conditions for when an SCP is in effect. It contains condition keys and condition operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, smn:) apply only to operations of the SMN service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An SCP can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in SCPs for SMN. You can include these condition keys to specify conditions for when your SCP is in effect.

**Table 4** Service-specific condition keys supported by SMN
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
smn:TargetOrgPath	string	Single-valued	The organization path authorized in a topic policy.
smn:TargetOrgId	string	Single-valued	The organization ID authorized in a topic policy.
smn:TargetAccountId	string	Single-valued	The account ID authorized in a topic policy.
smn:Protocol	string	Single-valued	The subscription protocol.
smn:Endpoint	string	Single-valued	The subscription endpoint address.