Actions Supported by Identity Policy-based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CSS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by CSS, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for CSS.

**Table 1** Actions supported by CSS
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
css:VPCEndpoint:updateWhitelist	Grants permission to update the existing VPC endpoint trustlist.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:updateBackupPolicy	Grants permission to modify or delete log backups.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:setSnapshotPolicy	Grants permission to operate the backup policy.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:getSnapshotPolicy	Grants permission to query backup policies.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:restore	Grants permission to restore the snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:create	Grants permission to create a snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:associates	Grants permission to enable or disable public network access.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:setAccessControl	Grants permission to perform operations on the trustlist.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:get	Grants permission to query resource tags.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:modifyBandwidth	Grants permission to change the bandwidth.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:VPCEndpoint:enableOrDisable	Grants permission to create or delete a VPCEP.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:getBasicConfigurations	Grants permission to query basic log configurations.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:list	Grants permission to view the snapshot list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:list	Grants permission to view logs.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:setSnapshotContiguration	Grants permission to set basic snapshot configurations.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listFlavors	Grants permission to query the specification ID list.	List	-	-	css:cluster:showFlavor
css:cluster:listDiskType	Grants permission to list available disk types.	List	-	-	-
css:tag:list	Grants permission to query project tags.	List	cluster *	-	-
css:VPCEndpoint:manageConnection	Grants permission to the connection to the VPC endpoint.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:listJob	Grants permission to query the job list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:downloadCert	Grants permission to obtain the certificate content.	Read	-	-	-
css:cluster:get	Grants permission to query cluster details.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:getInstance
css:snapshot:enableAtomaticSnapsot	Grants permission to set basic configurations for automatic snapshot backup.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:delete	Grants permission to delete a specified snapshot.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:get	Grants permission to view the customized word dictionary configuration.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:restart	Grants permission to restart the ElasticSearch cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifySecurityGroup	Grants permission to modify the cluster security group.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:list	Grants permission to query the task operation list for obtaining parameter settings.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:delete	Grants permission to delete a cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifySpecifications	Grants permission to modify the cluster specifications.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:list	Grants permission to list cluster information.	List	cluster *	-	css:cluster:getInstances
css:cluster:scaleOut	Grants permission to expand the cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:load	Grants permission to load a custom word dictionary.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:modify	Grants permission to update the number of entries.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:configurations:get	Grants permission to list parameters.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:IKThesaurus:delete	Grants permission to delete the word dictionary.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:expand	Grants permission to expand the number of instances and storage capacity.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:snapshot:disableSnapshotFuction	Grants permission to disable the cluster snapshot function.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:upgradeCluster	Grants permission to upgrade cluster and replace nodes.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:VPCEndpoint:listConnection	Grants permission to query the VPCEP connection.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:scaleIn	Grants permission to cluster scale-in.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:setBasicConfigurations	Grants permission to basic log configuration settings.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:addOrDelete	Grants permission to add or delete resource tags in batches.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:addOrDelete		Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
css:publicKibana:close	Grants permission to disable public network access.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:edit	Grants permission to modify a cluster tag.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:edit	Grants permission to modify a cluster tag.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	-
css:cluster:create	Grants permission to create a cluster.	Write	cluster *	-	-
css:cluster:create	Grants permission to create a cluster.	Write	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
css:cluster:toPeriod	Grants permission to change cluster to period.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:modifyName	Grants permission to change the cluster name.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:log:backup	Grants permission to back up logs.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:closeLogSetting	Grants permission to enable the log function.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:log:enableOrDisableLogFunction
css:cluster:openLogSetting	Grants permission to open the log function.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:log:enableOrDisableLogFunction
css:cluster:modifyPassword	Grants permission to change the cluster password.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicIPAddress:disassociates	Grants permission to unbind the public network.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:publicKibana:open	Grants permission to the public network.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:delete	Grants permission to delete a tag.	Tagging	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:tag:delete	Grants permission to delete a tag.	Tagging	-	g:TagKeys	-
css:cluster:shrinkNodes	Grants permission to a specified node to be scaled in.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:changeMode	Grants permission to modify the security mode.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:addIndependenceNodes	Grants permission to add independent master and client.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:rollingReboot	Grants permission to restart the ElasticSearch cluster in rolling mode.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:rollingRestart
css:logstash:listActions	Grants permission to query operation records.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:uploadCerts	Grants permission to upload crets.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:deleteCerts	Grants permission to delete crets.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listCerts	Grants permission to query certs list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	css:cluster:getCertsList
css:cluster:getCertsDetail	Grants permission to query cert file information.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:deleteConfTemplate	Grants permission to delete a user-defined template.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listConfigTemplate	Grants permission to query the template list.	List	-	-	css:logstash:configListTemplate
css:logstash:confStop	Grants permission to stop or hot stop the pipeline from migrating data.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:checkConnection	Grants permission to test connectivity.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confDelete	Grants permission to delete the configuration file.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confStart	Grants permission to start or hot start the pipeline to migrate data.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:getConfDetail	Grants permission to command is used to query the content of a configuration file.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:azmigrate	Grants permission to switch the AZs.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:confUpdate	Grants permission to update the configuration file.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listPipelines	Grants permission to query the pipeline list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:retryAction	Grants permission to retry the task or terminate the impact of the task.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:listConfs	Grants permission to query the configuration file list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:configFavorites	Grants permission to add to the custom template.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listUpgradeCluster	Grants permission to obtain the upgrade image ID and upgrade details.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:submitConf	Grants permission to create a configuration file.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:list	Grants permission to query the cluster plug-in list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:getOperationRecords	Grants permission to query the operation records of the plug-in.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:delete	Grants permission to delete a plug-in.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:installOrUninstall	Grants permission to install or uninstall the plug-in.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:upload	Grants permission to upload the plug-in.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:plugin:getDefault	Grants permission to query the default plug-in.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getAgencies	Grants permission to obtain the proxy.	Read	-	-	-
css:cluster:modifyRoute	Grants permission to modify the cluster route.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getRoutes	Grants permission to obtain the cluster route.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:logstash:actionList	Grants permission to query the cluster task list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:createUserInfo	Grants permission to create user information.	Write	cluster *	-	-
css:VPCEndpoint:modifyConnections	Grants permission to modify the connection size.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:queryNeedDeleteInstances	Grants permission to obtain the node to be deleted.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:queryKey	Grants permission to obtain the key.	Read	-	-	-
css:cluster:queryKeys	Grants permission to obtain the key list.	List	-	-	-
css:cluster:getPubliczonePice	Grants permission to obtain the bandwidth price.	Read	cluster *	-	-
css:datastore:get	Grants permission to obtain the data engine.	Read	cluster *	-	-
css:datastore:list	Grants permission to obtain the data engine list.	List	cluster *	-	-
css:publicIPAddress:enableOrDisableIPv6Function	Grants permission to enable or disable IPv6.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getDiskUsage	Grants permission to obtain the cluster storage capacity status.	Read	cluster *	-	-
css:snapshot:showDetail	Grants permission to obtain snapshot details.	Read	cluster *	-	-
css:cluster:getAvailableBuckets	Grants permission to obtain available OBS buckets.	List	-	-	-
css:cluster:checkCssName	Grants permission to check the cluster name.	Write	cluster *	-	-
css:snapshot:deleteAllFailedTask	Grants permission to delete all failed tasks.	Write	-	-	-
css:snapshot:deleteSingleFailedTask	Grants permission to delete a specified failed task.	Write	-	-	-
css:snapshot:getAllFailedTask	Grants permission to obtain failed backup tasks.	List	-	-	-
css::createServiceAgency	Grants permission to create an agency.	Write	-	-	-
css:repository:create	Grants permission to create a log repository.	Write	repository *	-	-
css:cluster:createAiOps	Grants permission to create detection tasks.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listAiOps	Grants permission to obtain the detection task list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:deleteAiOps	Grants permission to delete a detection task.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listSmnTopics	Grants permission to obtain the SMN Topic list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listElbs	Grants permission to obtain the list of available ELB in the current cluster.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:elbSwitch	Grants permission to enable or disable the ELB function .	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:createElbListener	Grants permission to create listeners for the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:updateElbListener	Grants permission to modify the listener of the current cluster.	Write	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:getElbDetail	Grants permission to query the ELB information used by the current cluster.	Read	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:cluster:listElbCerts	Grants permission to obtain the load balancer certificate list.	List	cluster *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
css:repository:list	Grants permission to query the log repository list.	List	repository *	-	-
css:repository:get	Grants permission to query the log repository.	Read	repository *	-	-
css:repository:update	Grants permission to update the log repository configuration.	Write	repository *	-	-
css:repository:delete	Grants permission to delete the log repository.	Write	repository *	-	-
css:logstream:create	Grants permission to create a logstream.	Write	repository *	-	-
css:logstream:create	Grants permission to create a logstream.	Write	logstream *	-	-
css:logstream:list	Grants permission to query the logstream List.	List	repository *	-	-
css:logstream:list	Grants permission to query the logstream List.	List	logstream *	-	-
css:logstream:get	Grants permission to query the logstream details.	Read	logstream *	-	-
css:logstream:get	Grants permission to query the logstream details.	Read	repository *	-	-
css:logstream:update	Grants permission to update the logstream.	Write	logstream *	-	-
css:logstream:update	Grants permission to update the logstream.	Write	repository *	-	-
css:logstream:delete	Grants permission to delete a logstream.	Write	logstream *	-	-
css:logstream:delete	Grants permission to delete a logstream.	Write	repository *	-	-
css:logstream:read	Grants permission to read logstream.	Read	logstream *	-	-
css:logstream:read	Grants permission to read logstream.	Read	repository *	-	-
css:logstream:write	Grants permission to write to logstream.	Write	logstream *	-	-
css:logstream:write	Grants permission to write to logstream.	Write	repository *	-	-
css:logstream:createImportTask	Grants permission to create a log import task.	Write	logstream *	-	-
css:logstream:createImportTask	Grants permission to create a log import task.	Write	repository *	-	-
css:logstream:updateImportTask	Grants permission to update the log import task.	Write	logstream *	-	-
css:logstream:updateImportTask	Grants permission to update the log import task.	Write	repository *	-	-
css:logstream:showImportTask	Grants permission to get the log import task details.	Read	logstream *	-	-
css:logstream:showImportTask	Grants permission to get the log import task details.	Read	repository *	-	-
css:logstream:listImportTask	Grants permission to query log import task list.	List	logstream *	-	-
css:logstream:listImportTask	Grants permission to query log import task list.	List	repository *	-	-
css:logstream:deleteImportTask	Grants permission to delete the log import task.	Write	logstream *	-	-
css:logstream:deleteImportTask	Grants permission to delete the log import task.	Write	repository *	-	-
css:logstream:stopImportTask	Grants permission to stop the log import task.	Write	logstream *	-	-
css:logstream:stopImportTask	Grants permission to stop the log import task.	Write	repository *	-	-
css:logstream:startImportTask	Grants permission to start the log import task.	Write	logstream *	-	-
css:logstream:startImportTask	Grants permission to start the log import task.	Write	repository *	-	-
css:logstream:updateLogImportTaskCreation	Grants permission to modify the creation status of a log import task.	Write	logstream *	-	-
css:logstream:updateLogImportTaskCreation		Write	repository *	-	-
css:logstream:showLogImportTaskConnection	Grants permission to show the connectivity of the log import task.	Read	logstream *	-	-
css:logstream:showLogImportTaskConnection		Read	repository *	-	-
css:logstream:getConsumeLogs	Grants permission to consumption log.	Read	logstream *	-	-
css:logstream:getConsumeLogs	Grants permission to consumption log.	Read	repository *	-	-
css:logstream:flushLogs	Grants permission to flush log.	Write	logstream *	-	-
css:logstream:flushLogs	Grants permission to flush log.	Write	repository *	-	-
css:logstream:pushLogs	Grants permission to write log.	Write	logstream *	-	-
css:logstream:pushLogs	Grants permission to write log.	Write	repository *	-	-
css:logstream:showCursors	Grants permission to obtains cursors.	Read	logstream *	-	-
css:logstream:showCursors	Grants permission to obtains cursors.	Read	repository *	-	-
css:logstream:showCursorTime	Grants permission to obtains the timestamp of the log consumption cursor.	Read	logstream *	-	-
css:logstream:showCursorTime		Read	repository *	-	-
css:logstream:listLogs	Grants permission to list logs.	List	logstream *	-	-
css:logstream:listLogs	Grants permission to list logs.	List	repository *	-	-
css:logstream:showLogsHistogram	Grants permission to querying log distribution.	Read	logstream *	-	-
css:logstream:showLogsHistogram	Grants permission to querying log distribution.	Read	repository *	-	-
css:logstream:listLogContext	Grants permission to list log context.	List	logstream *	-	-
css:logstream:listLogContext	Grants permission to list log context.	List	repository *	-	-
css:logstream:showLogsAnalytics	Grants permission to obtaining logs for analysis.	Read	logstream *	-	-
css:logstream:showLogsAnalytics	Grants permission to obtaining logs for analysis.	Read	repository *	-	-
css:logstream:createShipper	Grants permission to create a shipper.	Write	logstream *	-	-
css:logstream:createShipper	Grants permission to create a shipper.	Write	repository *	-	-
css:logstream:updateShipper	Grants permission to update a shipper.	Write	logstream *	-	-
css:logstream:updateShipper	Grants permission to update a shipper.	Write	repository *	-	-
css:logstream:deleteShipper	Grants permission to delete a shipper.	Write	logstream *	-	-
css:logstream:deleteShipper	Grants permission to delete a shipper.	Write	repository *	-	-
css:logstream:listShipper	Grants permission to list shippers.	List	logstream *	-	-
css:logstream:listShipper	Grants permission to list shippers.	List	repository *	-	-
css:logstream:showShipper	Grants permission to obtain shipper details.	Read	logstream *	-	-
css:logstream:showShipper	Grants permission to obtain shipper details.	Read	repository *	-	-
css:logstream:stopShipper	Grants permission to stop a shipper.	Write	logstream *	-	-
css:logstream:stopShipper	Grants permission to stop a shipper.	Write	repository *	-	-
css:logstream:startShipper	Grants permission to start a shipper.	Write	logstream *	-	-
css:logstream:startShipper	Grants permission to start a shipper.	Write	repository *	-	-
css:logstream:listLogByCursor	Grants permission to obtain logs based on cursor.	Read	logstream *	-	-
css:logstream:listLogByCursor	Grants permission to obtain logs based on cursor.	Read	repository *	-	-

Each API of CSS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by CSS APIs
API	Action	Dependencies
POST /v1.0/{project_id}/clusters	css:cluster:create	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:securityGroups:list vpc:securityGroups:get vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v2.0/{project_id}/clusters	css:cluster:create	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:securityGroups:list vpc:securityGroups:get vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/sg/change	css:cluster:modifySecurityGroup	vpc:securityGroups:list vpc:ports:update
GET /v1.0/{project_id}/clusters	css:cluster:list	-
GET /v1.0/{project_id}/clusters/{cluster_id}	css:cluster:get	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}	css:cluster:delete	-
POST /v1.0/{project_id}/cluster/{cluster_id}/period	css:cluster:toPeriod	-
POST /v1.0/{project_id}/clusters/{cluster_id}/changename	css:cluster:modifyName	-
POST /v1.0/{project_id}/clusters/{cluster_id}/password/reset	css:cluster:modifyPassword	-
POST /v1.0/{project_id}/clusters/{cluster_id}/restart	css:cluster:restart	-
POST /v2.0/{project_id}/clusters/{cluster_id}/restart	css:cluster:restart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/reboot	css:cluster:restart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/extend	css:cluster:scaleOut	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get
POST /v1.0/{project_id}/clusters/{cluster_id}/role_extend	css:cluster:expand	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get
POST /v1.0/{project_id}/clusters/{cluster_id}/flavor	css:cluster:modifySpecifications	ecs:cloudServerFlavors:get
GET /v1.0/{project_id}/es-flavors	css:cluster:listFlavors	ecs:cloudServerFlavors:get
GET /v1.0/{project_id}/{resource_type}/tags	css:tag:list	-
GET /v1.0/{project_id}/{resource_type}/{cluster_id}/tags	css:tag:get	-
POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags	css:tag:edit	-
DELETE /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/{key}	css:tag:delete	-
POST /v1.0/{project_id}/{resource_type}/{cluster_id}/tags/action	css:tag:addOrDelete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/{types}/flavor	css:cluster:modifySpecifications	ecs:cloudServerFlavors:get
POST /v1.0/extend/{project_id}/clusters/{cluster_id}/role/shrink	css:cluster:scaleIn	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
GET /v1.0/{project_id}/cer/download	css:cluster:downloadCert	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/instance/{instance_id}/replace	css:cluster:upgradeCluster	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
POST /v1.0/{project_id}/clusters/{cluster_id}/node/offline	css:cluster:shrinkNodes	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
POST /v1.0/{project_id}/clusters/{cluster_id}/mode/change	css:cluster:changeMode	-
POST /v1.0/{project_id}/clusters/{cluster_id}/type/{type}/independent	css:cluster:addIndependenceNodes	ecs:cloudServerFlavors:get evs:types:get vpc:vpcs:list vpc:subnets:list vpc:subnets:get vpc:ports:create vpc:ports:update vpc:ports:delete vpc:ports:get
POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/image/upgrade	css:cluster:upgradeCluster	-
-	css:cluster:upgradeCluster	-
POST /v1.0/{project_id}/clusters/{cluster_id}/inst-type/{inst_type}/azmigrate	css:cluster:azmigrate	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
GET /v1.0/{project_id}/clusters/{cluster_id}/upgrade/detail	css:cluster:listUpgradeCluster	-
GET /v1.0/{project_id}/clusters/{cluster_id}/target/{upgrade_type}/images	css:cluster:listUpgradeCluster	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/upgrade/{action_id}/retry	css:cluster:retryAction	-
-	css:cluster:listDiskType	evs:types:get
POST /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:load	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy obs:object:getObject
GET /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:get	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/thesaurus	css:IKThesaurus:delete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/open	css:publicKibana:open	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/close	css:publicKibana:close	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/bandwidth	css:publicIPAddress:modifyBandwidth	-
POST /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/update	css:publicIPAddress:setAccessControl	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/publickibana/whitelist/close	css:publicIPAddress:setAccessControl	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/open	css:cluster:openLogSetting	iam:agencies:pass obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies
PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/close	css:cluster:closeLogSetting	-
GET /v1.0/{project_id}/clusters/{cluster_id}/logs/records	css:log:listJob	-
GET /v1.0/{project_id}/clusters/{cluster_id}/logs/settings	css:log:getBasicConfigurations	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/settings	css:log:setBasicConfigurations	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/update	css:log:updateBackupPolicy	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/logs/policy/close	css:log:updateBackupPolicy	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/collect	css:log:backup	-
POST /v1.0/{project_id}/clusters/{cluster_id}/logs/search	css:log:list	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/open	css:publicIPAddress:associates	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/public/close	css:publicIPAddress:disassociates	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/bandwidth	css:publicIPAddress:modifyBandwidth	-
POST /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/update	css:publicIPAddress:setAccessControl	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/public/whitelist/close	css:publicIPAddress:setAccessControl	-
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/auto_setting	css:snapshot:enableAtomaticSnapsot	obs:bucket:createBucket obs:bucket:headBucket iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgency
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/setting	css:snapshot:setSnapshotContiguration	obs:bucket:listAllMyBuckets obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy iam:agencies:listAgencies iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot	css:snapshot:create	iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}/restore	css:snapshot:restore	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/{snapshot_id}	css:snapshot:delete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy	css:snapshot:setSnapshotPolicy	-
GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshot/policy	css:snapshot:getSnapshotPolicy	-
GET /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots	css:snapshot:list	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/index_snapshots	css:snapshot:disableSnapshotFuction	-
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/open	css:VPCEndpoint:enableOrDisable	vpcep:endpoints:create vpcep:endpoints:list vpcep:endpoints:get vpcep:endpoints:delete vpcep:endpoints:update
PUT /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/close	css:VPCEndpoint:enableOrDisable	vpcep::listQuotas vpcep:endpoints:create vpcep:endpoints:list vpcep:endpoints:get vpcep:endpoints:delete vpcep:endpoints:update
GET /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections	css:VPCEndpoint:listConnection	vpcep:endpoints:get
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/connections	css:VPCEndpoint:manageConnection	-
POST /v1.0/{project_id}/clusters/{cluster_id}/vpcepservice/permissions	css:VPCEndpoint:updateWhitelist	-
POST /v1.0/{project_id}/clusters/{cluster_id}/ymls/update	css:configurations:modify	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/joblists	css:configurations:list	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ymls/template	css:configurations:get	-
POST /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/open	css:snapshot:setSnapshotPolicy	-
PUT /v2.0/{project_id}/clusters/{cluster_id}/snapshots/policy/close	css:snapshot:setSnapshotPolicy	-
POST /v2.0/{project_id}/clusters/{cluster_id}/rolling_restart	css:cluster:rollingReboot	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listactions	css:logstash:listActions	-
DELETE /v1.0/{project_id}/lgsconf/deletetemplate	css:logstash:deleteConfTemplate	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/stop	css:logstash:confStop	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-stop	css:logstash:confStop	-
POST /v1.0/{project_id}/clusters/{cluster_id}/checkconnection	css:logstash:checkConnection	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/delete	css:logstash:confDelete	-
-	css:logstash:confDelete	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/start	css:logstash:confStart	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/hot-start	css:logstash:confStart	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/confdetail	css:logstash:getConfDetail	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/update	css:logstash:confUpdate	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listpipelines	css:logstash:listPipelines	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/submit	css:logstash:submitConf	-
POST /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/favorite	css:logstash:configFavorites	-
GET /v1.0/{project_id}/clusters/{cluster_id}/lgsconf/listconfs	css:logstash:listConfs	-
-	css:logstash:actionList	-
-	css:logstash:listConfigTemplate	-
GET /v1.0/{project_id}/lgsconf/template	css:logstash:listConfigTemplate	-
POST /v1.0/{project_id}/clusters/{cluster_id}/certs/upload	css:cluster:uploadCerts	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}/delete	css:cluster:deleteCerts	-
GET /v1.0/{project_id}/clusters/{cluster_id}/certs	css:cluster:listCerts	-
GET /v1.0/{project_id}/clusters/{cluster_id}/certs/{cert_id}	css:cluster:getCertsDetail	-
-	css:plugin:list	-
-	css:plugin:getOperationRecords	-
-	css:plugin:delete	-
-	css:plugin:installOrUninstall	-
-	css:plugin:upload	obs:bucket:listAllMyBuckets obs:bucket:headBucket obs:bucket:getBucketLocation obs:bucket:getBucketStoragePolicy obs:object:getObject
-	css:plugin:getDefault	-
-	css:cluster:getAgencies	iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject
POST /v1.0/{project_id}/clusters/{cluster_id}/route	css:cluster:modifyRoute	-
GET /v1.0/{project_id}/clusters/{cluster_id}/route	css:cluster:getRoutes	-
-	css:cluster:createUserInfo	-
-	css:VPCEndpoint:modifyConnections	-
-	css:cluster:queryNeedDeleteInstances	-
-	css:cluster:queryKey	-
-	css:cluster:queryKeys	-
-	css:cluster:getPubliczonePice	-
-	css:datastore:get	-
-	css:datastore:list	-
-	css:publicIPAddress:enableOrDisableIPv6Function	-
-	css:cluster:getDiskUsage	-
-	css:snapshot:showDetail	-
-	css:cluster:getAvailableBuckets	obs:bucket:listAllMyBuckets obs:bucket:getBucketStoragePolicy
-	css:cluster:checkCssName	-
-	css:snapshot:deleteAllFailedTask	-
-	css:snapshot:deleteSingleFailedTask	-
-	css:snapshot:getAllFailedTask	-
POST /v1.0/{project_id}/agency/create	css::createServiceAgency	iam:agencies:listAgencies iam:agencies:createAgency iam:permissions:grantRoleToAgency iam:agencies:pass
-	css:repository:create	-
-	css:repository:list	-
-	css:repository:get	-
-	css:repository:update	-
-	css:repository:delete	-
-	css:logstream:create	-
-	css:logstream:list	-
-	css:logstream:get	-
-	css:logstream:update	-
-	css:logstream:delete	-
-	css:logstream:read	-
-	css:logstream:write	-
-	css:logstream:createImportTask	dms:instance:get dms:instance:list dms:topic:list dms:instance:modify vpcep:endpointServices:create vpcep:endpointServices:list vpcep:endpointServices:get vpcep:endpointServices:updatePermissions vpcep:endpointServices:delete vpcep:endpointServices:updateConnections css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:updateImportTask	dms:instance:list dms:topic:list css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:showImportTask	-
-	css:logstream:listImportTask	-
-	css:logstream:deleteImportTask	-
-	css:logstream:stopImportTask	-
-	css:logstream:startImportTask	css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:updateLogImportTaskCreation	-
-	css:logstream:showLogImportTaskConnection	-
-	css:logstream:getConsumeLogs	-
-	css:logstream:pushLogs	-
-	css:logstream:flushLogs	-
-	css:logstream:showCursors	-
-	css:logstream:showCursorTime	-
-	css:logstream:listLogs	-
-	css:logstream:showLogsHistogram	-
-	css:logstream:listLogContext	-
-	css:logstream:showLogsAnalytics	-
-	css:logstream:createShipper	css:cluster:list css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:updateShipper	css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:deleteShipper	-
-	css:logstream:listShipper	-
-	css:logstream:showShipper	-
-	css:logstream:stopShipper	-
-	css:logstream:startShipper	css:cluster:getAgencies iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
-	css:logstream:listLogByCursor	-
POST /v1.0/{project_id}/clusters/{cluster_id}/ai-ops	css:cluster:createAiOps	-
GET /v1.0/{project_id}/clusters/{cluster_id}/ai-ops	css:cluster:listAiOps	-
DELETE /v1.0/{project_id}/clusters/{cluster_id}/ai-ops/{aiops_id}	css:cluster:deleteAiOps	-
GET /v1.0/{project_id}/domains/{domain_id}/ai-ops/smn-topics	css:cluster:listSmnTopics	css:cluster:getAgencies iam:agencies:list iam:agencies:listAgencies iam:agencies:listAttachedPolicies iam:agencies:pass
GET /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers	css:cluster:listElbs	elb:loadbalancers:list
POST /v1.0/{project_id}/clusters/{cluster_id}/loadbalancers/es-switch	css:cluster:elbSwitch	elb:loadbalancers:list iam:agencies:listAgencies iam:permissions:listRolesForAgency iam:permissions:listRolesForAgencyOnProject iam:agencies:pass
POST /v1.0/{project_id}/clusters/{cluster_id}/es-listeners	css:cluster:createElbListener	-
-	css:cluster:updateElbListener	-
GET /v1.0/{project_id}/clusters/{cluster_id}/es-listeners	css:cluster:getElbDetail	-
GET /v1.0/{project_id}/clusters/{cluster_id}/elb/certificates	css:cluster:listElbCerts	-
PUT /v1.0/{project_id}/clusters/{cluster_id}/es-listeners/{listener_id}	css:cluster:updateElbListener	-
-	css:plugin:installOrUninstall	-
-	css:cluster:listDiskType	-
-	css:cluster:getDiskUsage	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for CSS.

**Table 3** Resource types supported by CSS
Resource Type	URN
logstream	css:<region>:<account-id>:logstream:<logstream-id>
cluster	css:<region>:<account-id>:cluster:<cluster-id>
repository	css:<region>:<account-id>:repository:<repository-id>

Conditions

CSS does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent topic: Permissions and Supported Actions

Previous topic: Policy-Based Authorization

Next topic: Appendixes