Help Center/ SecMaster/ User Guide/ Permissions Management/ SecMaster Permissions and Supported Actions
Updated on 2025-08-11 GMT+08:00

SecMaster Permissions and Supported Actions

This topic describes fine-grained permissions management for your SecMaster. If your account does not need individual IAM users, then you may skip over this section.

By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. Users inherit permissions from the groups to which they are added. After authorization, the user can perform specified operations on cloud services based on the permissions.

You can grant users permissions by using roles and policies. Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions.

Limitations and Constraints

All actions supported by SecMaster support only IAM projects but not enterprise projects.

Supported Actions

SecMaster provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control.

  • Permission: A statement in a policy that allows or denies certain operations.
  • Action: Specific operations that are allowed or denied.
Table 1 Read-only permissions supported

Permission

Action

Querying node task details

secmaster:node:taskQueueDetail

Querying search criteria details

secmaster:searchCondition:get

Obtaining the to-do list details

secmaster:task:get

Querying data pipeline details

secmaster:pipe:get

Obtaining playbook details

secmaster:playbook:get

Obtaining workflow details

secmaster:workflow:get

Obtaining category information

secmaster:mapping:getClassifier

Querying the indicator list

secmaster:indicator:list

Querying policy details

secmaster:policy:get

Obtaining the resource import template

secmaster:resource:getTemplate

Querying workflow instance topology

secmaster:workflow:getInstance

Obtaining page details

secmaster:layout:getWizard

Querying table details

secmaster:table:get

Downloading a baseline check template

secmaster:baseline:downloadTemplate

Querying the usage process

secmaster:guide:get

Obtaining indicator details

secmaster:metric:get

Exporting alerts

secmaster:alert:export

Querying data space details

secmaster:dataspace:get

Viewing indicator results

secmaster:metric:getResult

Viewing the subscribed version

secmaster:subscription:getVersion

Obtaining operation connection details

secmaster:connection:get

Querying the data pipeline index

secmaster:pipe:getIndex

Obtaining playbooks statistics

secmaster:playbook:getStatistics

Obtaining data class details

secmaster:dataclass:list

Exporting resources

secmaster:resource:export

Obtaining a playbook version

secmaster:playbook:getVersion

Obtaining layout field details

secmaster:layout:getField

Obtaining playbooks operation monitoring data

secmaster:playbook:getMonitor

Obtaining mapping information

secmaster:mapping:getMapper

Exporting workflows

secmaster:workflow:export

Exporting playbooks

secmaster:playbook:export

Querying instance details

secmaster:playbook:getInstance

Querying statement results

secmaster:adHocQuery:get

Viewing resource statistics

secmaster:resource:getStatistics

Obtaining indicator details

secmaster:indicator:get

Viewing reports

secmaster:report:get

Download an incident template

secmaster:incident:downloadTemplate

Obtaining incident details

secmaster:incident:get

Viewing the resource synchronization status

secmaster:resource:getSyncStatus

Exporting emergent vulnerabilities

secmaster:emergencyVulnerability:export

Obtaining module details

secmaster:module:get

Obtaining workspace details

secmaster:workspace:get

Querying instance topology details

secmaster:playbook:getInstanceTopology

Obtaining field details

secmaster:dataclass:listFields

Exporting incidents

secmaster:incident:export

Obtaining the category mapping data source

secmaster:mapping:getDatasource

Querying details about a data transfer task

secmaster:dataTransformation:get

Querying analysis script details

secmaster:analysisScript:get

Exporting the baseline check results

secmaster:baseline:export

Obtaining agency permissions

secmaster:shipper:getDelegateAuth

Obtaining vulnerability group details

secmaster:vulnerability:getGroup

Obtaining type details

secmaster:dataclass:getType

Downloading the vulnerability template

secmaster:vulnerability:downloadTemplate

Viewing agencies

secmaster:agency:get

Querying the data pipeline consumption

secmaster:pipe:getConsumption

Exporting indicators

secmaster:indicator:export

Querying alert details

secmaster:alert:get

Downloading an alert template

secmaster:alert:downloadTemplate

Download an indicator template

secmaster:indicator:downloadTemplate

Obtaining resource details

secmaster:resource:get

Querying alert template details

secmaster:alertRuleTemplate:get

Obtaining the resource topology

secmaster:resource:getRelations

Obtaining user preferences

secmaster:preference:get

Querying alert model details

secmaster:alertRule:get

Obtaining delivery rule details

secmaster:shipper:get

Querying the layout

secmaster:layout:get

Querying data transfer task indicators

secmaster:dataTransformation:listMetrics

Querying code snippet details

secmaster:codeSegment:get

Querying retrieval script details

secmaster:retrieveScript:get

Obtaining workflow version details

secmaster:workflow:getVersion

Querying the layout list

secmaster:layout:list

Querying the vulnerability type list

secmaster:vulnerability:listType

Searching for user preferences

secmaster:preference:list

Obtaining the layout field list

secmaster:layout:listFields

Querying the vulnerability group list

secmaster:vulnerability:listGroup

Querying alert models

secmaster:alertRule:list

Exporting the vulnerability group list

secmaster:vulnerability:exportGroup

Querying the data class list

secmaster:dataclass:get

Querying an alert model overview

secmaster:alertRule:listMetrics

Listing emergency vulnerabilities

secmaster:emergencyVulnerability:list

Listing indicator results

secmaster:metric:listResults

Querying the indicator type list

secmaster:indicator:listTypes

Obtaining the incident type list

secmaster:incident:listTypes

Querying the review list

secmaster:playbook:listApproves

Querying the to-do list

secmaster:task:list

Querying an alert template

secmaster:alertRuleTemplate:list

Querying the policy list

secmaster:policy:list

Obtaining the delivery authorization information

secmaster:shipper:listAuthorizations

Listing the indicator hits results

secmaster:metric:listHits

Querying code snippets

secmaster:codeSegment:list

Searching for a category mapping list

secmaster:mapping:list

Querying the mapping list

secmaster:mapping:listMappers

Querying the table overview

secmaster:table:listMetrics

Querying the type list

secmaster:dataclass:listTypes

Querying the search criteria list

secmaster:searchCondition:list

Querying the data distribution histogram

secmaster:search:listHistograms

Obtaining the module list

secmaster:module:list

Searching for an incident list

secmaster:incident:list

Querying the audit log list of an instance

secmaster:playbook:getInstanceAuditlog

Querying the field list

secmaster:dataclass:getField

Obtaining the layout type list

secmaster:layout:listBusinessTypes

Querying the workspace list

secmaster:workspace:list

Converting an alert into an incident

secmaster:alert:batchOrders

Listing resources

secmaster:resource:list

Querying the alert type list

secmaster:alert:listCategories

Querying data

secmaster:search:listLogs

Obtaining a playbook version list

secmaster:playbook:listVersions

Listing reports

secmaster:report:list

Querying the workflow list

secmaster:workflow:list

Querying a table

secmaster:table:list

Searching the object mapping list

secmaster:dataobject:listRelation

Obtaining the playbook list

secmaster:playbook:list

Querying the comment list

secmaster:note:list

Viewing baseline inspection results

secmaster:baseline:list

Querying a retrieval script

secmaster:retrieveScript:list

Querying the incident category list

secmaster:incident:listCategories

Obtaining the indicator list

secmaster:metric:list

Obtaining the category mapping function

secmaster:mapping:listFunctions

Querying the directory list

secmaster:catalogue:list

Querying the alert template overview

secmaster:alertRuleTemplate:listMetrics

Obtaining a page

secmaster:layout:listWizards

Obtaining the delivery information list

secmaster:shipper:list

Obtaining the workflow version list

secmaster:workflow:listVersions

Querying alert types

secmaster:alert:listTypes

Querying data transfer tasks

secmaster:dataTransformation:list

Querying the data space list

secmaster:dataspace:list

Querying the instance list

secmaster:playbook:listInstances

Viewing analysis scripts

secmaster:analysisScript:list

Querying data pipelines

secmaster:pipe:list

Searching for an alert list

secmaster:alert:list

Querying the operation connection list

secmaster:connection:list

Querying the node information list

secmaster:node:list

Obtaining the details of a component

secmaster:component:get

Obtaining the collection parser list

secmaster:collectorParser:list

Obtaining collector connection details

secmaster:collectorConnection:get

Obtaining the component template list

secmaster:component:listTemplates

Obtaining the collection channel node list

secmaster:collectorChannel:listNodes

Querying asset subscription configurations

secmaster:cloudLog:listResourceConfig

Obtaining the collection channel group list

secmaster:collectorChannelGroup:list

Obtaining the collection node list

secmaster:collectorNode:list

Obtaining collection channel details

secmaster:collectorChannel:get

Obtaining table data consumption information

secmaster:table:getConsumption

Obtaining the collection channel instance list

secmaster:collectorChannel:listInstances

Obtaining the component list

secmaster:component:list

Exporting an analysis script

secmaster:analysisScript:export

Obtaining the collection parser details

secmaster:collectorParser:get

Obtaining security log subscription

secmaster:collector:listConfig

Obtaining the list of component nodes

secmaster:component:listRunningNodes

Obtaining the configuration data of historical component versions

secmaster:component:listConfigurationVersions

Obtaining security log subscription

secmaster:cloudLog:list

Exporting a collection parser

secmaster:collectorParser:export

Obtaining the collector connection list

secmaster:collectorConnection:list

Obtaining the collection channel list

secmaster:collectorChannel:list

Obtaining the collection parser template list

secmaster:collectorParser:listTemplates

Obtaining the component configuration list

secmaster:component:listConfigurations

Querying resource tags

secmaster:workspace:listTags

Obtaining security log subscription settings

secmaster:collector:listConfig

Obtaining security log subscription settings

secmaster:cloudLog:list

Querying asset subscription configurations

secmaster:cloudLog:listResourceConfig

Obtaining the collection parser template list

secmaster:collectorParser:listTemplates

Obtaining the collection parser list

secmaster:collectorParser:list

Exporting a collection parser

secmaster:collectorParser:export

Obtaining the collector connection list

secmaster:collectorConnection:list

Obtaining collector connection details

secmaster:collectorConnection:get

Obtaining the collection channel instance list

secmaster:collectorChannel:listInstances

Obtaining the collection channel list

secmaster:collectorChannel:list

Obtaining collection channel details

secmaster:collectorChannel:get

Obtaining the collection channel node list

secmaster:collectorChannel:listNodes

Obtaining the collection channel group list

secmaster:collectorChannelGroup:list

Obtaining the collection node list

secmaster:collectorNode:list

Obtaining the component template list

secmaster:component:listTemplates

Obtaining the component configuration list

secmaster:component:listConfigurations

Obtaining the details of a component

secmaster:component:get

Obtaining the component list

secmaster:component:list

Obtaining the configuration data of historical component versions

secmaster:component:listConfigurationVersions

Obtaining the list of component nodes

secmaster:component:listRunningNodes

Querying the node information list

secmaster:node:list

Obtaining table data consumption information

secmaster:table:getConsumption

Exporting an analysis script

secmaster:analysisScript:export

Table 2 Write permissions supported

Permission

Action

Deleting multiple policies

secmaster:policy:batchDelete

Creating a workflow version

secmaster:workflow:createVersion

Modifying a pipeline field

secmaster:pipe:updateSchema

Updating a layout

secmaster:layout:update

Simulating an alert model

secmaster:alertRule:createSimulation

Importing resources

secmaster:resource:import

Designing a table

secmaster:table:updateSchema

Deleting object relations

secmaster:dataobject:deleteRelation

Importing a playbook

secmaster:playbook:import

Updating an operation connection

secmaster:connection:update

Deleting an operation connection

secmaster:connection:delete

Binding intelligence types to layouts

secmaster:indicator:bindLayout

Deleting an alert

secmaster:alert:delete

Creating a data class

secmaster:dataclass:create

Updating the category mapping status

secmaster:mapping:update

Creating fields

secmaster:dataclass:createField

Analyzing execution

secmaster:search:createAnalysis

Creating an agency

secmaster:agency:create

Creating a playbook

secmaster:playbook:create

Suspending a delivery

secmaster:shipper:pause

Enabling an alert model

secmaster:alertRule:enable

Verifying a workflow version

secmaster:workflow:validate

Updating code snippet

secmaster:codeSegment:update

Updating data transfer tasks

secmaster:dataTransformation:update

Deleting a mapping

secmaster:mapping:deleteMapper

Deleting a retrieval script

secmaster:retrieveScript:delete

Updating the workflow version debugging result

secmaster:workflow:simulate

Importing alerts

secmaster:alert:import

Synchronizing resources

secmaster:resource:sync

Updating a playbook

secmaster:playbook:update

Updating mappings

secmaster:mapping:updateMapper

Creating a module

secmaster:module:create

Creating a mapping

secmaster:mapping:createMapper

Copying a category mapping

secmaster:mapping:copy

Creating a to-do task

secmaster:task:create

Enabling a data type

secmaster:dataclass:enableType

Creating a table

secmaster:table:create

Creating a report

secmaster:report:create

Importing incidents

secmaster:incident:import

Deleting a data space

secmaster:dataspace:delete

Creating object relations

secmaster:dataobject:createRelation

Creating an incident

secmaster:incident:create

Binding incident types to layouts

secmaster:incident:bindLayout

Deleting data pipelines

secmaster:pipe:delete

Creating code snippets

secmaster:codeSegment:create

Creating a workspace

secmaster:workspace:create

Binding vulnerability types to layouts

secmaster:vulnerability:bindLayout

Updating a report

secmaster:report:update

Updating the security score

secmaster:secureScore:update

Deleting user preferences

secmaster:preference:delete

Disabling the query operation

secmaster:adHocQuery:delete

Batch deleting resources

secmaster:resource:batchDelete

Updating a playbook version

secmaster:playbook:updateVersion

Creating a page

secmaster:layout:createWizard

Updating user preferences

secmaster:preference:update

Updating search criteria

secmaster:searchCondition:update

Deleting a workspace

secmaster:workspace:delete

Creating a data delivery

secmaster:shipper:create

Deleting a data transfer task

secmaster:dataTransformation:delete

Updating a module

secmaster:module:update

Modifying an alert type

secmaster:alert:updateType

Deleting layout fields

secmaster:layout:deleteField

Modifying an alert model

secmaster:alertRule:update

Updating a to-do task

secmaster:task:update

Creating a usage process

secmaster:guide:create

Deleting an alert model

secmaster:alertRule:delete

Creating a playbook version

secmaster:playbook:createVersion

Updating a data space

secmaster:dataspace:update

Deleting a page

secmaster:layout:deleteWizard

Updating a page

secmaster:layout:updateWizard

Deleting the data pipeline consumption

secmaster:pipe:deleteConsumption

Monitoring nodes

secmaster:node:monitor

Creating a retrieval script

secmaster:retrieveScript:create

Authorizing a delivery

secmaster:shipper:createAuthorization

Setting the emergency vulnerability read status

secmaster:emergencyVulnerability:updateReadStatus

Deleting a workflow version

secmaster:workflow:deleteVersion

Creating an analysis script

secmaster:analysisScript:create

Locking a table

secmaster:table:createLock

Cloning a playbook version

secmaster:playbook:copyVersion

Operating a workflow instance

secmaster:workflow:operateInstance

Binding data class types to layouts

secmaster:dataclass:bindLayout

Creating a node

secmaster:node:create

Deleting a comment

secmaster:note:delete

Deleting a module

secmaster:module:delete

Deleting a workflow

secmaster:workflow:delete

Deleting an indicator

secmaster:metric:delete

Modifying a table

secmaster:table:update

Updating a policy

secmaster:policy:update

Deleting a report

secmaster:report:delete

Creating a metric

secmaster:metric:create

Deleting fields

secmaster:dataclass:deleteField

Modifying an incident type

secmaster:incident:updateType

Updating layout fields

secmaster:layout:updateField

Creating a policy

secmaster:policy:create

Deleting a vulnerability type

secmaster:vulnerability:deleteType

Review playbooks

secmaster:playbook:approve

Saving as template

secmaster:layout:createTemplate

Creating a custom data type

secmaster:dataclass:createType

Deleting an analysis script

secmaster:analysisScript:delete

Enabling or disabling an alert type

secmaster:alert:enableType

Creating an incident type

secmaster:incident:createType

Updating a data class

secmaster:dataclass:update

Updating a workflow

secmaster:workflow:update

Deleting an alert type

secmaster:alert:deleteType

Starting a delivery

secmaster:shipper:resume

Deleting a category mapping

secmaster:mapping:delete

Creating the data pipeline consumption

secmaster:pipe:createConsumption

Updating the data pipeline index

secmaster:pipe:updateIndex

Creating an agency

secmaster:shipper:createDelegateAuth

Enabling a data transfer

secmaster:dataTransformation:enable

Deleting search criteria

secmaster:searchCondition:delete

Updating indicators

secmaster:indicator:update

Updating categories

secmaster:mapping:updateClassifier

Running the analysis statement

secmaster:adHocQuery:create

Deleting a data class

secmaster:dataclass:delete

Reviewing a workflow version

secmaster:workflow:approveVersion

Importing a workflow

secmaster:workflow:import

Modifying a vulnerability type

secmaster:vulnerability:updateType

Updating the retrieval script

secmaster:retrieveScript:update

Associating alert types with layouts

secmaster:alert:bindLayout

Deleting a playbook version

secmaster:playbook:deleteVersion

Updating data pipelines

secmaster:pipe:update

Updating a custom data type

secmaster:dataclass:updateType

Creating indicators

secmaster:indicator:create

Disabling a data transfer

secmaster:dataTransformation:disable

Modifying the task status of a node

secmaster:node:updateTaskNodeStatus

Creating a pipeline

secmaster:pipe:create

Creating a layout

secmaster:layout:create

Deleting a pay-per-use order

secmaster:subscription:deletePostPaidOrder

Deleting categories

secmaster:mapping:deleteClassifier

Updating a workflow version

secmaster:workflow:updateVersion

Deleting a policy

secmaster:policy:delete

Creating a category

secmaster:mapping:createClassifier

Creating an alert model

secmaster:alertRule:create

Creating a vulnerability type

secmaster:vulnerability:createType

Creating data spaces

secmaster:dataspace:create

Unlocking a table

secmaster:table:deleteLock

Batch updating resources

secmaster:resource:batchUpdate

Creating a pay-per-use order

secmaster:subscription:createPostPaidOrder

Updating an incident

secmaster:incident:update

Deleting delivery information

secmaster:shipper:delete

Updating metrics

secmaster:metric:update

Updating a directory

secmaster:catalogue:update

Creating a workflow

secmaster:workflow:create

Delivering data again

secmaster:shipper:retry

Deleting a layout

secmaster:layout:delete

Setting user preferences

secmaster:preference:create

Updating resources

secmaster:resource:update

Updating a Workspace

secmaster:workspace:update

Importing an Indicator

secmaster:indicator:import

Creating a comment

secmaster:note:create

Deleting a data table

secmaster:table:delete

Creating an alert

secmaster:alert:create

Updating the analysis script

secmaster:analysisScript:update

Operating a playbook instance

secmaster:playbook:operateInstance

Updating an alert

secmaster:alert:update

Updating fields

secmaster:dataclass:updateField

Enabling/Disabling a vulnerability type

secmaster:vulnerability:enableType

Deleting an incident type

secmaster:incident:deleteType

Enabling or disabling an incident type

secmaster:incident:enableType

Creating a layout field

secmaster:layout:createField

Creating an alert type

secmaster:alert:createType

Disabling an alert model

secmaster:alertRule:disable

Deleting an indicator

secmaster:indicator:delete

Deleting a custom data type

secmaster:dataclass:deleteType

Handling authorization requests

secmaster:shipper:handleAuthorization

Importing the baseline check results

secmaster:baseline:import

Creating a yearly/monthly order

secmaster:subscription:createPrePaidOrder

Importing the vulnerability data

secmaster:vulnerability:import

Performing authorization again

secmaster:shipper:retryAuthorization

Creating search criteria

secmaster:searchCondition:create

Deleting an incident

secmaster:incident:delete

Creating a data transfer task

secmaster:dataTransformation:create

Deleting a code snippet

secmaster:codeSegment:delete

Creating an operation connection

secmaster:connection:create

Deleting a playbook

secmaster:playbook:delete

Deleting a collector connection

secmaster:collectorConnection:delete

Deleting table data consumption

secmaster:table:deleteConsumption

Creating a collector connection

secmaster:collectorConnection:create

Creating a collection parser

secmaster:collectorParser:create

Controlling collection channels

secmaster:collectorChannel:createOperation

Creating a collection channel

secmaster:collectorChannel:create

Saving security log subscription settings

secmaster:collector:createConfig

Importing an analysis script

secmaster:analysisScript:import

Creating a table data consumption

secmaster:table:createConsumption

Deleting node Information

secmaster:node:delete

Updating component configurations

secmaster:component:updateConfigurations

Deleting security log subscription settings

secmaster:cloudLog:delete

Deleting a collection channel

secmaster:collectorChannel:delete

Updating node information

secmaster:node:update

Deleting a collection channel group

secmaster:collectorChannelGroup:delete

Creating a collection channel group

secmaster:collectorChannelGroup:create

Deleting a collection parser

secmaster:collectorParser:delete

Updating a collection channel

secmaster:collectorChannel:update

Saving security log subscription settings

secmaster:cloudLog:create

Updating a collector connection

secmaster:collectorConnection:update

Updating the collection channel group list

secmaster:collectorChannelGroup:update

Designing a table

secmaster:table:updateSchema

Updating a tag value

secmaster:workspace:updateTag

Batch deleting resource tags

secmaster:workspace:deleteTags

Batch adding resource tags

secmaster:workspace:createTags

Saving security log subscription settings

secmaster:collector:createConfig

Saving security log subscription settings

secmaster:cloudLog:create

Deleting security log subscription settings

secmaster:cloudLog:delete

Creating a collection parser

secmaster:collectorParser:create

Obtaining the collection parser details

secmaster:collectorParser:get

Deleting a collection parser

secmaster:collectorParser:delete

Creating a collector connection

secmaster:collectorConnection:create

Updating a collector connection

secmaster:collectorConnection:update

Deleting a collector connection

secmaster:collectorConnection:delete

Creating a collection channel

secmaster:collectorChannel:create

Deleting a collection channel

secmaster:collectorChannel:delete

Updating a collection channel

secmaster:collectorChannel:update

Controlling collection channels

secmaster:collectorChannel:createOperation

Deleting a collection channel group

secmaster:collectorChannelGroup:delete

Updating the collection channel group list

secmaster:collectorChannelGroup:update

Creating a collection channel group

secmaster:collectorChannelGroup:create

Updating component configurations

secmaster:component:updateConfigurations

Deleting node Information

secmaster:node:delete

Updating node information

secmaster:node:update

Creating a table data consumption task

secmaster:table:createConsumption

Deleting a table data consumption task

secmaster:table:deleteConsumption

Importing an analysis script

secmaster:analysisScript:import