Actions Supported by Policy-based Authorization

This section describes the actions supported policy-based authorization for AAD.

Supported Actions

AAD provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. The following are related concepts:

Permissions: statements in a policy that allow or deny certain operations APIs: REST APIs that can be called by a user who has been granted specific permissions.
Actions: Specific operations that are allowed or denied in a custom policy.
Related actions: Actions on which a specific action depends to take effect. When assigning permissions for the action to a user, you also need to assign permissions for the dependent actions.
IAM or enterprise projects: Type of projects for which an action will take effect. For example, if you set the authorization scope of a custom policy to both IAM projects and enterprise projects, the policy takes effect for user groups in either IAM or enterprise projects. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. "√" indicates that the action supports the project and "×" indicates that the action does not support the project. For details about the differences between IAM and enterprise management, see What Are the Differences Between IAM and Enterprise Management?

Table 1 lists the API actions supported by AAD.

**Table 1** Supported actions
Permission	API	Action	IAM Project	Enterprise Project
Querying the peak traffic rate and attack statistics.	GET /v1/aad/instances/{instance_id}/{ip}/ddos-statistics	aad:domain:get	√	√
Querying the AAD instance list	GET /v1/aad/instances	aad:instance:list	√	√
Querying the forwarding rules of an AAD IP address	GET /v1/aad/instances/{instance_id}/{ip}/rules	aad:forwardingRule:get	√	√
Changing the origin server IP address in the forwarding configuration of an AAD instance	PUT /v1/aad/instances/{instance_id}/{ip}/rules/{rule_id}	aad:forwardingRule:put	√	√
Creating forwarding rules for AAD IP addresses in batches	POST /v1/aad/instances/{instance_id}/{ip}/rules/batch-create	aad:forwardingRule:create	√	√
Deleting forwarding rules for AAD IP addresses in batches	POST /v1/aad/instances/{instance_id}/{ip}/rules/batch-delete	aad:forwardingRule:delete	√	√
Viewing the domain name list	GET /v1/aad/protected-domains	aad:domain:list	√	√
Querying the protected domain name	GET /v1/aad/protected-domains/{domain_id}	aad:instance:get	√	√
Updating a domain name	PUT /v1/aad/protected-domains/{domain_id}	aad:domain:put	√	√