Help Center/ Application Service Mesh/ API Reference/ Permissions and Supported Actions/ Actions Supported by Role/Policy-based Authorization
Updated on 2026-06-25 GMT+08:00
View PDF
Share

Actions Supported by Role/Policy-based Authorization

This section describes the actions supported by ASM in policy-based authorization.

Supported Actions

IAM provides system-defined policies that can be directly used. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control. Operations supported by policies are specific to APIs. The common concepts related to policies are listed below.

  • Permissions: statements that allow or deny certain operations in a policy
  • APIs: APIs that can be called in a custom policy
  • Actions: specific operations that are allowed or denied
  • Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.

    The check mark (√) and cross symbol (x) indicate that an action takes effect or does not take effect for the corresponding type of projects.

ASM supports the following actions that can be defined in custom policies:

Table 1 Service mesh permissions and actions

Permission

API

Action

IAM Project

Enterprise Project

Creating a service mesh

POST /v1/{project_id}/meshes

asm:mesh:create

√

√

Deleting a service mesh

DELETE /v1/{project_id}/meshes/{id}

asm:mesh:delete

√

√

Querying the service mesh list

GET /v1/{project_id}/meshes

asm:mesh:get

√

√

Querying the details about a service mesh

GET /v1/{project_id}/meshes/{id}

asm:mesh:list

√

√

Upgrading a service mesh

POST /v1/{project_id}/mesh-upgrade

GET /v1/{project_id}/mesh-upgrade/{id}

PUT /v1/{project_id}/mesh-upgrade/{id}

DELETE /v1/{project_id}/mesh-upgrade/{id}

asm:mesh:upgrade

√

√

Querying a service mesh upgrade task

GET /v1/{project_id}/mesh-job/{id}

asm:mesh:getUpgradeJob

√

√

Updating a service mesh

PUT /v2/projects/:project_id/meshes/:mesh_id

asm:mesh:update

√

√

Obtaining a candidate cluster

GET /v3/projects/:project_id/clusters-to-be-added

asm:mesh:getAvailableClusters

√

×

Querying the Service list of a service mesh

GET /v3/meshes/:mesh_id/namespaces/:namespace/services

asm:mesh:listServices

√

√

Querying the Service of a service mesh

GET /v3/meshes/:mesh_id/namespaces/:namespace/services/:service

asm:mesh:getService

√

√

Validating the Service of a service mesh

POST /v2/meshes/:mesh_id/namespaces/:namespace/services/validate

asm:mesh:getService

√

√

Repairing the Service of a service mesh with just one click

POST /v2/meshes/:mesh_id/namespaces/:namespace/services/format

asm:mesh:updateService

√

√

Querying service access authorization

GET /v3/meshes/:mesh_id/authorizations

asm:mesh:getServiceGovernance

√

√

Creating service access authorization

POST /v3/meshes/:mesh_id/authorizations

asm:mesh:updateServiceGovernance

√

√

Deleting service access authorization

DELETE /v3/meshes/:mesh_id/authorizations

asm:mesh:updateServiceGovernance

√

√

Updating the namespace injection configuration

PUT /v2/meshes/:mesh_id/injection

asm:mesh:updateNamespace

√

√

Obtaining the namespace injection configuration

GET /v2/meshes/:mesh_id/injection

asm:mesh:getNamespace

√

√

Obtaining the namespace list

GET /v2/meshes/:mesh_id/namespaces

asm:mesh:listNamespaces

√

√

Obtaining a grayscale release traffic policy

GET /v2/meshes/:mesh_id/namespaces/:namespace/services/:service/virtualroutes

asm:mesh:getRelease

√

√

Updating a grayscale release traffic policy

PUT /v2/meshes/:mesh_id/namespaces/:namespace/services/:service/virtualroutes

asm:mesh:updateRelease

√

√

Creating a grayscale release task

POST /v2/meshes/:mesh_id/namespaces/:namespace/releases

asm:mesh:createRelease

√

√

Obtaining the details about a grayscale release task

GET /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id

asm:mesh:getRelease

√

√

Obtaining the grayscale release task list

GET /v2/meshes/:mesh_id/releases

asm:mesh:listReleases

√

√

Updating a grayscale release task

PUT /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id

asm:mesh:updateRelease

√

√

Deleting a grayscale release task

DELETE /v2/meshes/:mesh_id/namespaces/:namespace/releases/:release_id

asm:mesh:deleteRelease

√

√

Creating a gateway

POST /v2/meshes/:mesh_id/gateways

asm:mesh:createGateway

√

√

Obtaining the gateway list

GET /v3/meshes/:mesh_id/gateways

asm:mesh:listGateways

√

√

Deleting a gateway

POST /v2/meshes/:mesh_id/gateways/:gateway

asm:mesh:deleteGateway

√

√

Adding a route to a gateway

POST /v3/meshes/:mesh_id/gateways/:gateway/addroute

asm:mesh:createGatewayRoute

√

√

Obtaining the route list of a gateway

POST /v2/meshes/:mesh_id/gateways/:gateway/routes

asm:mesh:listGatewayRoutes

√

√

Removing a route from a gateway

POST /v3/meshes/:mesh_id/gateways/:gateway/removeroute

asm:mesh:deleteGatewayRoute

√

√

Creating a workshop

POST /v2/meshes/:mesh_id/workshops

asm:mesh:createWorkshop

√

√

Deleting a workshop

DELETE /v2/meshes/:mesh_id/workshops/:workshop

asm:mesh:deleteWorkshop

√

√

Obtaining the workshop list

GET /v2/meshes/:mesh_id/workshops

asm:mesh:listWorkshops

√

√

Forwarding an Istio query request

GET /apis/*.istio.io/*

asm:mesh:getServiceGovernance

√

√

Forwarding an Istio creation request

POST /apis/*.istio.io/*

asm:mesh:updateServiceGovernance

√

√

Forwarding an Istio deletion request

DELETE /apis/*.istio.io/*

asm:mesh:updateServiceGovernance

√

√

Forwarding an Istio update request

PUT/apis/*.istio.io/*

asm:mesh:updateServiceGovernance

√

√

Querying resources

POST /v2/:project_id/:resourcetype/resource-instances/filter

asm:mesh:listResourcesByTag

√

×

Querying the number of resource instances

POST /v2/:project_id/:resourcetype/resource-instances/count

asm:mesh:listResourcesByTag

√

×

Creating resource tags in batches

POST /v2/:project_id/:resourcetype/:resourceid/tags/create

asm:mesh:tagResource

√

√

Deleting resource tags in batches

DELETE /v2/:project_id/:resourcetype/:resourceid/tags/delete

asm:mesh:unTagResource

√

√

Querying tags of a resource

GET /v2/:project_id/:resourcetype/:resourceid/tags

asm:mesh:listTagsForResource

√

√

Querying tags by project

GET /v2/:project_id/:resourcetype/tags

asm:mesh:listTags

√

×

Viewing the service topology

GET /api/namespaces/:namespace/services/:service/graph

GET /api/graph

asm:mesh:getTopology

√

√