Actions Supported by Policy-based Authorization

This section describes the actions supported policy-based authorization for Anti-DDoS.

Supported Actions

Anti-DDoS provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements in a policy that allow or deny certain operations APIs: REST APIs that can be called by a user who has been granted specific permissions.
Actions: Specific operations that are allowed or denied in a custom policy.
Dependencies: Actions which a specific action depends on. When allowing an action for a user, you also need to allow its dependent actions for that user.
IAM or enterprise projects: Type of projects for which an action will take effect. For example, if you set the authorization scope of a custom policy to both IAM projects and enterprise projects, the policy takes effect for user groups in either IAM or enterprise projects. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise management, see What Are the Differences Between IAM and Enterprise Management?

Table 1 lists the API actions supported by Anti-DDoS.

**Table 1** Supported actions
Permission	API	Action	IAM Project	Enterprise Project
Querying Anti-DDoS tasks	GET /v2/{project_id}/query-task-status	anti-ddos:task:list	√	√
Querying the list of defense statuses of EIPs	GET /v1/{project_id}/antiddos	anti-ddos:ip:listDefenseStatuses	√	√
Querying Anti-DDoS specification range	GET /v2/{project_id}/antiddos/query-config-list	anti-ddos:optionalDefensePolicy:list	√	√
Querying weekly defense statistics	GET /v1/{project_id}/antiddos/weekly	anti-ddos:ip:getWeeklyReport	√	√
Querying configured Anti-DDoS policies	GET /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:getDefensePolicy	√	√
Updating Anti-DDoS policies	PUT /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:updateDefensePolicy	√	√
Querying the traffic of a specified EIP	GET /v1/{project_id}/antiddos/{floating_ip_id}/daily	anti-ddos:ip:getDailyTrafficReport	√	√
Querying events of a specified EIP	GET /v1/{project_id}/antiddos/{floating_ip_id}/logs	anti-ddos:ip:getDailyEventReport	√	√
Querying the defense status of a specified EIP	GET /v1/{project_id}/antiddos/{floating_ip_id}/status	anti-ddos:ip:getDefenseStatus	√	√
Querying the list of defense statuses of EIPs	GET /v2/{project_id}/antiddos	anti-ddos:ip:listDefenseStatuses	√	√
Enabling Anti-DDoS	POST /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:enableDefensePolicy	√	√
Querying the user quota	GET /v1/{project_id}/antiddos/quotas	anti-ddos:quota:list	√	√
Updating all user log settings	PUT /v1/{project_id}/antiddos/lts-config	anti-ddos:logConfig:update	√	√
Querying all log settings	GET /v1/{project_id}/antiddos/lts-config	anti-ddos:logConfig:get	√	√
Querying the alarm configuration	GET /v2/{project_id}/warnalert/alertconfig/query	anti-ddos:alertConfig:get	√	√
Updating the alarm configuration	POST /v2/{project_id}/warnalert/alertconfig/update	anti-ddos:alertConfig:update	√	√
Configuring the default Anti-DDoS protection policy	POST /v1/{project_id}/antiddos/default-config	anti-ddos:defaultDefensePolicy:create	√	√
Querying the default Anti-DDoS protection policy	GET /v1/{project_id}/antiddos/default-config	anti-ddos:defaultDefensePolicy:get	√	√
Deleting the default Anti-DDoS policy	DELETE /v1/{project_id}/antiddos/default-config	anti-ddos:defaultDefensePolicy:delete	√	√