Actions Supported by Policy-based Authorization

This section describes the actions supported by CDN in policy-based authorization.

Supported Actions

CDN provides system-defined policies that can be directly used in IAM. You can also create custom policies to supplement system-defined policies for more refined access control. Operations supported by policies are specific to APIs. The following are common concepts related to policies:

Permissions: statements in a policy that allow or deny certain operations
APIs: REST APIs that can be called by a user who has been granted specific permissions
Actions: specific operations that are allowed or denied in a custom policy
Dependencies: actions which a specific action depends on. When allowing an action for a user, you also need to allow any existing action dependencies for that user.
IAM projects/Enterprise projects: the authorization scope of a custom policy. A custom policy can be applied to IAM projects or enterprise projects or both. Policies that contain actions for both IAM and enterprise projects can be used and applied for both IAM and Enterprise Management. Policies that contain actions only for IAM projects can be used and applied to IAM only. Administrators can check whether an action supports IAM projects or enterprise projects in the action list. For details about the differences between IAM and enterprise management, see Differences Between IAM and Enterprise Management.

CDN supports the following actions in custom policies:

Cache purge and prefetch actions, including all of the actions supported by CDN cache purge and prefetch APIs, such as the APIs for querying cache purge and prefetch records, creating a cache purge task, and creating a cache prefetch task.
Domain name configuration actions, including all of the actions supported by CDN domain name configuration APIs, such as the APIs for configuring a cache rule, configuring all domain name settings, and querying all domain name settings.
Domain name operation actions, including all of the actions supported by CDN domain name operation APIs, such as the APIs for querying a domain name, creating a domain name, disabling CDN for a domain name, enabling CDN for a domain name, and deleting a domain name.
Analytics actions, including all of the actions supported by CDN Analytics APIs, such as the APIs for querying the basic domain statistics, querying the region/carrier statistics, and querying top 100 URLs.
Log query actions, including all of the actions supported by CDN log query APIs, such as the API for querying logs.
Billing management actions, including all of the actions supported by CDN billing management APIs, such as the APIs for setting a billing option and querying the billing option.
Quota management actions, including all of the actions supported by CDN quota management APIs, such as the API for querying quotas.

Cache Purge and Prefetch

**Table 1** Cache purge and prefetch actions
Permission	API	Action	IAM Project	Enterprise Project
Creating a cache prefetch task	POST /v1.0/cdn/content/preheating-tasks	cdn:configuration:preheatCache	Supported	Supported
Creating a cache prefetch task (old)	POST /v1.0/cdn/preheatingtasks	cdn:configuration:preheatCache	Supported	Supported
Querying a cache purge or prefetch task	GET /v1.0/cdn/historytasks/{history_tasks_id}/detail	cdn:configuration:queryCacheHistoryTask	Supported	Not supported
Querying cache purge or prefetch tasks	GET /v1.0/cdn/historytasks	cdn:configuration:queryCacheHistoryTask	Supported	Not supported
Querying cache purge and prefetch records	GET /v1.0/cdn/contentgateway/url-tasks	cdn:configuration:queryRefreshAndPreheatHistoryTask	Supported	Not supported
Creating a cache purge task	POST /v1.0/cdn/content/refresh-tasks	cdn:configuration:refreshCache	Supported	Supported
Creating a cache purge task (old)	POST /v1.0/cdn/refreshtasks	cdn:configuration:refreshCache	Supported	Supported

Domain Name Configuration

**Table 2** Domain name configuration actions
Permission	API	Action	IAM Project	Enterprise Project
Associating a certificate with multiple domain names	PUT /v1.0/cdn/domains/config-https-info	cdn:configuration:ModifyHttpsConf	Supported	Supported
Exporting the domain name list to an excel file	POST /v1.0/cdn/configuration/domains/export	cdn:configuration:exportBasicConfigs	Supported	Supported
Copying domain configuration	POST /v1.0/cdn/configuration/domains/batch-copy	cdn:configuration:modifyDomainConfigs	Supported	Supported
Checking IP address information	GET /v1.0/cdn/ip-info	cdn:configuration:queryDomains	Supported	Not supported
Listing resource tags	GET /v1.0/cdn/configuration/tags	cdn:configuration:queryTags cdn:configuration:queryDomains	Supported	Supported
Deleting resource tags	POST /v1.0/cdn/configuration/tags/batch-delete	cdn:configuration:deleteTags cdn:configuration:modifyTags	Supported	Supported
Creating a resource tag	POST /v1.0/cdn/configuration/tags	cdn:configuration:modifyTags	Supported	Supported
Querying domain name configuration (new)	GET /v1.0/cdn/configuration/domains	cdn:configuration:queryDomainList cdn:configuration:queryDomains	Supported	Supported
Adding/Modifying response headers	PUT /v1.0/cdn/domains/{domain_id}/response-header	cdn:configuration:createResHeader	Supported	Supported
Configuring cache rules	PUT /v1.0/cdn/domains/{domain_id}/cache	cdn:configuration:modifyCacheRule	Supported	Supported
Querying domain names associated with HTTPS certificates	GET /v1.0/cdn/domains/https-certificate-info	cdn:configuration:queryDomainList cdn:configuration:queryHttpsConf	Supported	Supported
Configuring HTTPS	PUT /v1.0/cdn/domains/{domain_id}/https-info	cdn:configuration:modifyHttpsConf	Supported	Supported
Setting an IP ACL	PUT /v1.0/cdn/domains/{domain_id}/ip-acl	cdn:configuration:modifyIpAcl	Supported	Supported
Modifying the full domain configuration	PUT /v1.1/cdn/configuration/domains/{domain_name}/configs	cdn:configuration:modifyOriginConfInfo	Supported	Supported
Enabling or disabling redirect from origin	PUT /v1.0/cdn/domains/{domain_id}/follow302-switch	cdn:configuration:modifyOriginConfInfo	Supported	Supported
Modifying the host	PUT /v1.0/cdn/domains/{domain_id}/originhost	cdn:configuration:modifyOriginConfInfo	Supported	Supported
Modifying the status of private bucket access	PUT /v1.0/cdn/domains/{domain_id}/private-bucket-access	cdn:configuration:modifyOriginConfInfo	Supported	Supported
Enabling or disabling range requests	PUT /v1.0/cdn/domains/{domain_id}/range-switch	cdn:configuration:modifyOriginConfInfo	Supported	Supported
Modifying origin server information	PUT /v1.0/cdn/domains/{domain_id}/origin	cdn:configuration:modifyOriginServerInfo	Supported	Supported
Configuring referer validation rules	PUT /v1.0/cdn/domains/{domain_id}/referer	cdn:configuration:modifyReferConf	Supported	Supported
Querying cache rules	GET /v1.0/cdn/domains/{domain_id}/cache	cdn:configuration:queryCacheRule	Supported	Supported
Querying the domain name configuration	GET /v1.1/cdn/configuration/domains/{domain_name}/configs	cdn:configuration:queryDomains	Supported	Supported
Querying the HTTPS settings	GET /v1.0/cdn/domains/{domain_id}/https-info	cdn:configuration:queryHttpsConf	Supported	Supported
Querying the IP ACL	GET /v1.0/cdn/domains/{domain_id}/ip-acl	cdn:configuration:queryIpAcl	Supported	Supported
Querying the host	GET /v1.0/cdn/domains/{domain_id}/originhost	cdn:configuration:queryOriginConfInfo	Supported	Supported
Querying referer validation rules	GET /v1.0/cdn/domains/{domain_id}/referer	cdn:configuration:queryReferConf	Supported	Supported
Querying response headers	GET /v1.0/cdn/domains/{domain_id}/response-header	cdn:configuration:queryResponseHeaderList	Supported	Supported

Domain Name Operations

**Table 3** Domain name operations
Permission	API	Action	IAM Project	Enterprise Project
Creating a domain name	POST /v1.0/cdn/domains	cdn:configuration:createDomains	Supported	Supported
Disabling CDN for a domain name	PUT /v1.0/cdn/domains/{domain_id}/disable	cdn:configuration:disableDomains	Supported	Supported
Enabling CDN for a domain name	PUT /v1.0/cdn/domains/{domain_id}/enable	cdn:configuration:enableDomains	Supported	Supported
Deleting domain names	DELETE /v1.0/cdn/domains/{domain_id}	cdn:configuration:deleteDomains	Supported	Supported
Querying domain names	GET /v1.0/cdn/domains	cdn:configuration:queryDomainList cdn:configuration:queryDomain	Supported	Supported
Querying details about a domain name	GET /v1.0/cdn/configuration/domains/{domain_name}	cdn:configuration:queryDomains	Supported	Supported
Querying details about a domain name (old)	GET /v1.0/cdn/domains/{domain_id}/detail	cdn:configuration:queryDomains	Supported	Supported

Analytics

**Table 4** Analytics
Permission	API	Action	IAM Project	Enterprise Project
Querying basic domain name statistics	GET /v1.0/cdn/statistics/domain-stats	cdn:statistics:queryStats	Supported	Supported
Querying domain name statistics by region and carrier	GET /v1.0/cdn/statistics/domain-location-stats	cdn:statistics:queryStats	Supported	Supported
Querying top 100 URLs	GET /v1.0/cdn/statistics/top-url	cdn:statistics:queryTopUrl	Supported	Supported

Log Query

**Table 5** Log query
Permission	API	Action	IAM Project	Enterprise Project
Querying logs	GET /v1.0/cdn/logs	cdn:log:queryLogs	Supported	Supported

Billing Management

**Table 6** Billing management
Permission	API	Action	IAM Project	Enterprise Project
Configuring the billing option	PUT /v1.0/cdn/charge/charge-modes	cdn:charge:modifyChargeMode	Supported	Not supported
Querying the billing option	GET /v1.0/cdn/charge/charge-modes	cdn:charge:queryChargeMode	Supported	Not supported