Help Center/ Intelligent EdgeFabric/ API Reference/ Permissions and Supported Actions/ Identity Policy–based Authorization
Updated on 2026-06-05 GMT+08:00
View PDF
Share

Identity Policy–based Authorization

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies to supplement system-defined ones. Identity policies allow you to perform refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

  • The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
  • The Resource Type column indicates whether the action supports resource-level permissions.
    • You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions, and you must specify all resources ("*") in your identity policy statements.
    • If this column includes a resource type, you must specify the URN for the Resource element of your statements.
    • Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.

    For details about the resource types defined by IEF, see Resource.

  • The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
    • If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
    • If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
    • If the Condition Key column is empty (-) for an action, the action does not support any condition keys.

    For details about condition keys defined by IEF, see Condition.

  • The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for identity policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for IEF.

Table 1 Supported actions

Action

Description

Access Level

Resource Type (*: required)

Condition Key

Alias

ief:application:create

Grants permission to create an application template.

Write

application *

-

-

-

ief:IefInstanceId

ief:application:delete

Grants permission to delete an application template.

Write

application *

-

-

-

ief:IefInstanceId

ief:application:get

Grants permission to query application template details.

Read

application *

-

-

-

ief:IefInstanceId

ief:application:list

Grants permission to query the application template list.

List

application *

-

-

-

ief:IefInstanceId

ief:application:update

Grants permission to update an application template.

Write

application *

-

-

-

ief:IefInstanceId

ief:appversion:create

Grants permission to create an application template version.

Write

appversion *

-

-

-

ief:IefInstanceId

ief:appversion:delete

Grants permission to delete an application template version.

Write

appversion *

-

-

-

ief:IefInstanceId

ief:appversion:get

Grants permission to query application template version details.

Read

appversion *

-

-

-

ief:IefInstanceId

ief:appversion:list

Grants permission to query the application template version list.

List

appversion *

-

-

-

ief:IefInstanceId

ief:appversion:update

Grants permission to update an application template version.

Write

appversion *

-

-

-

ief:IefInstanceId

ief:batchjob:create

Grants permission to create a batch processing task.

Write

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:delete

Grants permission to delete a batch processing task.

Write

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:get

Grants permission to query batch processing task details.

Read

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:list

Grants permission to query the batch processing task list.

List

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:pause

Grants permission to stop a batch processing task.

Write

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:restore

Grants permission to resume a batch processing task.

Write

batchjob *

-

-

-

ief:IefInstanceId

ief:batchjob:retry

Grants permission to retry a batch processing task.

Write

batchjob *

-

-

-

ief:IefInstanceId

ief:configmap:create

Grants permission to create a ConfigMap.

Write

iefinstance *

-

-

ief:configmap:delete

Grants permission to delete a ConfigMap.

Write

iefinstance *

-

-

ief:configmap:get

Grants permission to query ConfigMap details.

Read

iefinstance *

-

-

ief:configmap:list

Grants permission to query the ConfigMap list.

List

iefinstance *

-

-

ief:configmap:update

Grants permission to update a ConfigMap.

Write

iefinstance *

-

-

ief:service:create

Grants permission to create a Service.

Write

iefinstance *

-

-

ief:service:delete

Grants permission to delete a Service.

Write

iefinstance *

-

-

ief:service:list

Grants permission to query the Service list.

List

iefinstance *

-

-

ief:service:get

Grants permission to query Service details.

Read

iefinstance *

-

-

ief:service:update

Grants permission to update a Service.

Write

iefinstance *

-

-

ief:device:create

Grants permission to create a device.

Write

iefinstance *

-

-

ief:device:delete

Grants permission to delete a device.

Write

iefinstance *

-

-

ief:device:get

Grants permission to query device details.

Read

iefinstance *

-

-

ief:device:list

Grants permission to query the device list.

List

iefinstance *

-

-

ief:device:update

Grants permission to update a device.

Write

iefinstance *

-

-

ief:device:createTemplate

Grants permission to create a device template.

Write

iefinstance *

-

ief:devicetemplate:create

ief:device:deleteTemplate

Grants permission to delete a device template.

Write

iefinstance *

-

ief:devicetemplate:delete

ief:device:listTemplate

Grants permission to query the device template list.

List

iefinstance *

-

ief:devicetemplate:list

ief:device:getTemplate

Grants permission to query details about a device template.

Read

iefinstance *

-

ief:devicetemplate:get

ief:device:updateTemplate

Grants permission to update details about a device template.

Write

iefinstance *

-

ief:devicetemplate:update

ief:endpoint:create

Grants permission to create an endpoint.

Write

iefinstance *

-

-

ief:endpoint:delete

Grants permission to delete an endpoint.

Write

iefinstance *

-

-

ief:endpoint:get

Grants permission to query endpoint details.

Read

iefinstance *

-

-

ief:endpoint:list

Grants permission to query the endpoint list.

List

iefinstance *

-

-

ief:agency:create

Grants permission to create an agency.

Write

iefinstance *

-

-

ief:quota:get

Grants permission to query quotas.

Read

iefinstance *

-

ief:quota:get

ief:plugin:create

Grants permission to create an add-on instance.

Write

iefinstance *

-

-

ief:plugin:delete

Grants permission to delete an add-on instance.

Write

iefinstance *

-

-

ief:plugin:get

Grants permission to query add-on instance details.

Read

iefinstance *

-

-

ief:plugin:getVersion

Grants permission to query add-on version details.

Read

iefinstance *

-

-

ief:plugin:listVersion

Grants permission to query the add-on version list.

List

iefinstance *

-

ief:plugin:list

ief:plugin:listInstance

Grants permission to query the add-on instance list.

List

iefinstance *

-

ief:plugin:list

ief:plugin:update

Grants permission to update an add-on instance.

Write

iefinstance *

-

-

ief:rule:create

Grants permission to create a message route.

Write

iefinstance *

-

-

ief:rule:delete

Grants permission to delete a message route.

Write

iefinstance *

-

-

ief:iefinstance:create

Grants permission to create a platinum cluster.

Write

iefinstance *

-

-

ief:iefinstance:delete

Grants permission to delete a platinum cluster.

Write

iefinstance *

-

-

ief:iefinstance:get

Grants permission to query platinum cluster details.

Read

iefinstance *

-

-

ief:iefinstance:list

Grants permission to query the platinum cluster list.

List

iefinstance *

-

-

ief:rule:listError

Grants permission to query the message route error list.

List

iefinstance *

-

ief:rule:list

ief:rule:get

Grants permission to query message route details.

Read

iefinstance *

-

-

ief:rule:listRule

Grants permission to query the message route list.

List

iefinstance *

-

ief:rule:list

ief:rule:stop

Grants permission to disable a message route.

Write

iefinstance *

-

ief:rule:update

ief:rule:start

Grants permission to enable a message route.

Write

iefinstance *

-

ief:rule:update

ief:systemEvent:create

Grants permission to create a system event.

Write

iefinstance *

-

-

ief:systemEvent:delete

Grants permission to delete a system event.

Write

iefinstance *

-

-

ief:systemEvent:get

Grants permission to query system event details.

Read

iefinstance *

-

-

ief:systemEvent:list

Grants permission to query the system event list.

List

iefinstance *

-

-

ief:systemEvent:stop

Grants permission to disable a system event.

Write

iefinstance *

-

ief:systemEvent:update

ief:systemEvent:start

Grants permission to enable a system event.

Write

iefinstance *

-

ief:systemEvent:update

ief:secret:create

Grants permission to create a secret.

Write

iefinstance *

-

-

ief:secret:delete

Grants permission to delete a secret.

Write

iefinstance *

-

-

ief:secret:get

Grants permission to query secret details.

Read

iefinstance *

-

-

ief:secret:list

Grants permission to query the secret list.

List

iefinstance *

-

-

ief:secret:update

Grants permission to update a secret.

Write

iefinstance *

-

-

ief:secureSecret:create

Grants permission to create encrypted data.

Write

iefinstance *

-

-

ief:secureSecret:delete

Grants permission to delete encrypted data.

Write

iefinstance *

-

-

ief:secureSecret:list

Grants permission to query the encrypted data list.

List

iefinstance *

-

-

ief:secureSecret:get

Grants permission to query encrypted data details.

Read

iefinstance *

-

-

ief:secureSecret:update

Grants permission to update encrypted data.

Write

iefinstance *

-

-

ief::tagResource

Grants permission to batch modify or create tags.

Tagging

node *

g:ResourceTag/<tag-key>

ief:tag:batchAction

-

ief::unTagResource

Grants permission to delete a tag.

Tagging

node *

g:ResourceTag/<tag-key>

ief:tag:delete

-

ief::listTagsForResource

Grants permission to query tag details.

List

node *

g:ResourceTag/<tag-key>

ief:tag:get

-

ief:IefInstanceId

ief::listResourcesByTag

Grants permission to query resource instances.

List

node *

-

ief:tag:listResourceInstance

-

ief::listTags

Grants permission to query the tag list.

List

node *

-

ief:tag:list

-

ief:IefInstanceId

ief:group:bindNode

Grants permission to add nodes to an edge node group.

Write

group *

-

-

-

ief:IefInstanceId

ief:group:createNodeGroup

Grants permission to create an edge node group.

Write

group *

-

ief:group:create

-

ief:IefInstanceId

ief:group:deleteNodeGroup

Grants permission to delete an edge node group.

Write

group *

-

ief:group:delete

-

ief:IefInstanceId

ief:group:updateNodeGroup

Grants permission to update an edge node group.

Write

group *

-

ief:group:update

-

ief:IefInstanceId

ief:group:getNodeGroup

Grants permission to query details about an edge node group.

Read

group *

-

ief:group:get

-

ief:IefInstanceId

ief:group:listNodeGroup

Grants permission to query the edge node group list.

List

group *

-

ief:group:list

-

ief:IefInstanceId

ief:group:listGroupInstanceState

Grants permission to query the status of an edge node group.

List

group *

-

-

-

ief:IefInstanceId

ief:group:createCert

Grants permission to create an edge node group certificate.

Write

group *

-

ief:group:create

-

ief:IefInstanceId

ief:group:deleteCert

Grants permission to delete an edge node group certificate.

Write

group *

-

ief:group:delete

-

ief:IefInstanceId

ief:group:listCert

Grants permission to query the edge node group certificate list.

List

group *

-

ief:group:list

-

ief:IefInstanceId

ief:group:getCert

Grants permission to query edge node group certificate details.

Read

group *

-

ief:group:get

-

ief:IefInstanceId

ief:deployment:create

Grants permission to create a Deployment.

Write

deployment *

-

-

-

ief:IefInstanceId

ief:deployment:delete

Grants permission to delete a Deployment.

Write

deployment *

-

-

-

ief:IefInstanceId

ief:deployment:get

Grants permission to query Deployments.

Read

deployment *

-

-

-

ief:IefInstanceId

ief:deployment:list

Grants permission to query the Deployment list.

List

deployment *

-

-

-

ief:IefInstanceId

ief:deployment:update

Grants permission to update a Deployment.

Write

deployment *

-

-

-

ief:IefInstanceId

ief:node:action

Grants permission to start or stop an edge node.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:bindDevices

Grants permission to bind a device.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:create

Grants permission to create an edge node.

Write

node *

-

-

-

ief:node:createNodeCert

Grants permission to create an edge node certificate.

Write

node *

-

-

-

ief:node:delete

Grants permission to delete an edge node.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:deleteNodeCert

Grants permission to delete an edge node certificate.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:get

Grants permission to query edge node details.

Read

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:list

Grants permission to query the edge node list.

List

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:listNodeCert

Grants permission to query the edge node certificate list.

List

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:maintain

Grants permission to maintain an edge node.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:update

Grants permission to update an edge node.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:node:upgrade

Grants permission to upgrade an edge node.

Write

node *

g:ResourceTag/<tag-key>

-

-

ief:IefInstanceId

ief:product:create

Grants permission to create a product.

Write

product *

-

-

-

ief:IefInstanceId

ief:product:delete

Grants permission to delete a product.

Write

product *

-

-

-

ief:IefInstanceId

ief:product:get

Grants permission to query product information.

Read

product *

-

-

-

ief:IefInstanceId

ief:product:list

Grants permission to query the product list.

List

product *

-

-

-

ief:IefInstanceId

Each API of IEF usually supports one or more actions. Table 2 lists the supported actions and dependencies.

Table 2 Actions and dependencies supported by IEF APIs

API

Action

Dependency

POST /v2/{project_id}/edgemgr/apps

ief:application:create

-

DELETE /v2/{project_id}/edgemgr/apps/{app_id}

ief:application:delete

-

GET /v2/{project_id}/edgemgr/apps/{app_id}

ief:application:get

-

GET /v2/{project_id}/edgemgr/apps

ief:application:list

-

PUT /v2/{project_id}/edgemgr/apps/{app_id}

ief:application:update

-

POST /v2/{project_id}/edgemgr/apps/{app_id}/versions

ief:appversion:create

-

DELETE /v2/{project_id}/edgemgr/apps/{app_id}/versions/{version_id}

ief:appversion:delete

-

GET /v2/{project_id}/edgemgr/apps/{app_id}/versions/{version_id}

ief:appversion:get

-

GET /v2/{project_id}/edgemgr/apps/{app_id}/versions

ief:appversion:list

-

PUT /v2/{project_id}/edgemgr/apps/{app_id}/versions/{version_id}

ief:appversion:update

-

POST /v2/{project_id}/productmgr/jobs

ief:batchjob:create

-

DELETE /v2/{project_id}/productmgr/jobs/{job_id}

ief:batchjob:delete

-

GET /v2/{project_id}/productmgr/jobs/{job_id}

ief:batchjob:get

-

GET /v2/{project_id}/productmgr/jobs

ief:batchjob:list

-

POST /v2/{project_id}/productmgr/jobs/{job_id}/pause

ief:batchjob:pause

-

POST /v2/{project_id}/productmgr/jobs/{job_id}/restore

ief:batchjob:restore

-

POST /v2/{project_id}/productmgr/jobs/{job_id}/retry

ief:batchjob:retry

-

POST /v2/{project_id}/edgemgr/configmaps

ief:configmap:create

-

DELETE /v2/{project_id}/edgemgr/configmaps/{configmap_id}

ief:configmap:delete

-

GET /v2/{project_id}/edgemgr/configmaps/{configmap_id}

ief:configmap:get

-

GET /v2/{project_id}/edgemgr/configmaps

ief:configmap:list

-

PUT /v2/{project_id}/edgemgr/configmaps/{configmap_id}

ief:configmap:update

-

POST /v2/{project_id}/edgemgr/services

ief:service:create

-

DELETE /v2/{project_id}/edgemgr/services/{service_id}

ief:service:delete

-

GET /v2/{project_id}/edgemgr/services

ief:service:list

-

GET /v2/{project_id}/edgemgr/services/{service_id}

ief:service:get

-

PUT /v2/{project_id}/edgemgr/services/{service_id}

ief:service:update

-

POST /v2/{project_id}/edgemgr/devices

ief:device:create

-

DELETE /v2/{project_id}/edgemgr/devices/{device_id}

ief:device:delete

-

GET /v2/{project_id}/edgemgr/devices/{device_id}

ief:device:get

-

GET /v2/{project_id}/edgemgr/devices

ief:device:list

-

PUT /v2/{project_id}/edgemgr/devices/{device_id}

ief:device:update

-

GET /v2/{project_id}/edgemgr/devices/{device_id}/twin

ief:device:get

-

PUT /v2/{project_id}/edgemgr/devices/{device_id}/twin

ief:device:update

-

PUT /v2/{project_id}/edgemgr/devices/{device_id}/nodes

ief:device:update

-

POST /v2/{project_id}/edgemgr/device-templates

ief:device:createTemplate

-

DELETE /v2/{project_id}/edgemgr/device-templates/{device_template_id}

ief:device:deleteTemplate

-

GET /v2/{project_id}/edgemgr/device-templates

ief:device:listTemplate

-

GET /v2/{project_id}/edgemgr/device-templates/{device_template_id}

ief:device:getTemplate

-

PUT /v2/{project_id}/edgemgr/device-templates/{device_template_id}

ief:device:updateTemplate

-

POST /v2/{project_id}/routemgr/endpoints

ief:endpoint:create

-

DELETE /v2/{project_id}/routemgr/endpoints/{endpoint_id}

ief:endpoint:delete

-

GET /v2/{project_id}/routemgr/endpoints/{endpoint_id}

ief:endpoint:get

-

GET /v2/{project_id}/routemgr/endpoints

ief:endpoint:list

-

-

ief:agency:create

-

GET /v2/{project_id}/edgemgr/quotas

ief:quota:get

-

POST /v3/{project_id}/edgemgr/plugins

ief:plugin:create

-

DELETE /v3/{project_id}/edgemgr/plugins/{plugin_instance_name}

ief:plugin:delete

-

GET /v3/{project_id}/edgemgr/plugins/{plugin_instance_name}

ief:plugin:get

-

-

ief:plugin:getVersion

-

GET /v3/{project_id}/edgemgr/pluginversions

ief:plugin:listVersion

-

GET /v3/{project_id}/edgemgr/plugins

ief:plugin:listInstance

-

PUT /v3/{project_id}/edgemgr/plugins/{plugin_instance_name}

ief:plugin:update

-

POST /v2/{project_id}/routemgr/rules

ief:rule:create

-

DELETE /v2/{project_id}/routemgr/rules/{rule_id}

ief:rule:delete

-

POST /v2/{project_id}/edgemgr/ief-instances

ief:iefinstance:create
  • ecs:availabilityZones:list
  • ecs:cloudServerFlavors:get
  • vpc:subnets:get
  • vpc:subnets:list
  • vpc:vpcs:get
  • vpc:vpcs:list
  • vpc:securityGroups:get
  • vpc:securityGroups:list
  • vpcep:endpoints:get
  • vpcep:endpoints:list
  • vpcep:endpointServices:get
  • vpcep:endpointServices:list
  • elb:loadbalancers:list
  • elb:loadbalancers:show
  • cce:node:list
  • cce:node:get
  • cce:cluster:get
  • vpc:subnets:create
  • vpc:vpcs:create
  • vpc:publicIps:create
  • vpc:securityGroups:create
  • vpcep:endpoints:create
  • vpcep:endpointServices:create
  • elb:loadbalancers:create
  • cce:cluster:create
  • cce:node:create

DELETE /v2/{project_id}/edgemgr/ief-instances/{ief_instance_id}

ief:iefinstance:delete
  • ecs:availabilityZones:list
  • ecs:cloudServerFlavors:get
  • vpc:subnets:get
  • vpc:subnets:list
  • vpc:vpcs:get
  • vpc:vpcs:list
  • vpc:securityGroups:get
  • vpc:securityGroups:list
  • vpcep:endpoints:get
  • vpcep:endpoints:list
  • vpcep:endpointServices:get
  • vpcep:endpointServices:list
  • elb:loadbalancers:list
  • elb:loadbalancers:show
  • cce:node:list
  • cce:node:get
  • cce:cluster:get
  • vpc:subnets:delete
  • vpc:vpcs:delete
  • vpc:publicIps:delete
  • vpc:securityGroups:delete
  • vpcep:endpoints:delete
  • vpcep:endpointServices:delete
  • elb:loadbalancers:delete
  • cce:cluster:delete
  • cce:node:delete

GET /v2/{project_id}/edgemgr/ief-instances/{ief_instance_id}

ief:iefinstance:get

-

GET /v2/{project_id}/edgemgr/ief-instances

ief:iefinstance:list

-

GET /v2/{project_id}/routemgr/rules/{rule_id}/errors

ief:rule:listError

-

GET /v2/{project_id}/routemgr/rules/{rule_id}

ief:rule:get

-

GET /v2/{project_id}/routemgr/rules

ief:rule:listRule

-

POST /v2/{project_id}/routemgr/rules/{rule_id}/stop

ief:rule:stop

-

POST /v2/{project_id}/routemgr/rules/{rule_id}/start

ief:rule:start

-

POST /v2/{project_id}/routemgr/exchanger/systemevents

ief:systemEvent:create

-

DELETE /v2/{project_id}/routemgr/exchanger/systemevents/{event_id}

ief:systemEvent:delete

-

GET /v2/{project_id}/routemgr/exchanger/systemevents/{event_id}

ief:systemEvent:get

-

GET /v2/{project_id}/routemgr/exchanger/systemevents

ief:systemEvent:list

-

POST /v2/{project_id}/routemgr/exchanger/systemevents/{event_id}/stop

ief:systemEvent:stop

-

POST /v2/{project_id}/routemgr/exchanger/systemevents/{event_id}/start

ief:systemEvent:start

-

POST /v2/{project_id}/edgemgr/secrets

ief:secret:create

-

DELETE /v2/{project_id}/edgemgr/secrets/{secret_id}

ief:secret:delete

-

GET /v2/{project_id}/edgemgr/secrets/{secret_id}

ief:secret:get

-

GET /v2/{project_id}/edgemgr/secrets

ief:secret:list

-

PUT /v2/{project_id}/edgemgr/secrets/{secret_id}

ief:secret:update

-

POST /v2/{project_id}/edm/nodes/{node_id}/encryptdatas

ief:secureSecret:create

-

DELETE /v2/{project_id}/edm/nodes/{node_id}/encryptdatas/{encryptdata_id}

ief:secureSecret:delete

-

POST /v2/{project_id}/edm/encryptdatas

ief:secureSecret:create

-

DELETE /v2/{project_id}/edm/encryptdatas/{encryptdata_id}

ief:secureSecret:delete

-

GET /v2/{project_id}/edm/encryptdatas

ief:secureSecret:list

-

GET /v2/{project_id}/edm/encryptdatas/{encryptdata_id}

ief:secureSecret:get

-

GET /v2/{project_id}/edm/nodes/{node_id}/encryptdatas

ief:secureSecret:list

-

GET /v2/{project_id}/edm/encryptdatas/{encryptdata_id}/nodes

ief:secureSecret:list

-

PUT /v2/{project_id}/edm/encryptdatas/{encryptdata_id}

ief:secureSecret:update

-

POST /v2/{project_id}/{resource_type}/{resource_id}/tags/action

ief::tagResource

-

POST /v2/{project_id}/{resource_type}/{resource_id}/tags

ief::tagResource

-

DELETE /v2/{project_id}/{resource_type}/{resource_id}/tags/{key}

ief::unTagResource

-

GET /v2/{project_id}/{resource_type}/{resource_id}/tags

ief::listTagsForResource

-

POST /v2/{project_id}/{resource_type}/resource_instances/action

ief::listResourcesByTag

-

GET /v2/{project_id}/{resource_type}/tags

ief::listTags

-

PUT /v2/{project_id}/edgemgr/groups/{group_id}/nodes

ief:group:bindNode

-

POST /v2/{project_id}/edgemgr/groups

ief:group:createNodeGroup

-

DELETE /v2/{project_id}/edgemgr/groups/{group_id}

ief:group:deleteNodeGroup

-

GET /v2/{project_id}/edgemgr/groups/{group_id}

ief:group:getNodeGroup

-

GET /v2/{project_id}/edgemgr/groups

ief:group:listNodeGroup

-

-

ief:group:listGroupInstanceState

-

POST /v2/{project_id}/edgemgr/groups/{group_id}/certs

ief:group:createCert

-

DELETE /v2/{project_id}/edgemgr/groups/{group_id}/certs/{group_cert_id}

ief:group:deleteCert

-

GET /v2/{project_id}/edgemgr/groups/{group_id}/certs

ief:group:listCert

-

GET /v2/{project_id}/edgemgr/groups/{group_id}/certs/{group_cert_id}

ief:group:getCert

-

PUT /v2/{project_id}/edgemgr/groups/{group_id}

ief:group:updateNodeGroup

-

POST /v3/{project_id}/edgemgr/deployments

ief:deployment:create

-

DELETE /v3/{project_id}/edgemgr/deployments/{deployment_id}

ief:deployment:delete

-

GET /v3/{project_id}/edgemgr/deployments/{deployment_id}

ief:deployment:get

-

GET /v3/{project_id}/edgemgr/pods

ief:deployment:list

-

GET /v3/{project_id}/edgemgr/deployments

ief:deployment:list

-

PUT /v3/{project_id}/edgemgr/deployments/{deployment_id}

ief:deployment:update

-

POST /v3/{project_id}/edgemgr/deployments/{deployment_id}/pods/{pod_name}/restart

ief:deployment:update

-

DELETE /v3/{project_id}/edgemgr/deployments/{deployment_id}/pods/{pod_name}

ief:deployment:update

-

POST /v2/{project_id}/edgemgr/nodes/{node_id}/action

ief:node:action

-

PUT /v2/{project_id}/edgemgr/nodes/{node_id}/devices

ief:node:bindDevices

-

POST /v2/{project_id}/edgemgr/nodes

ief:node:create

-

POST /v2/{project_id}/edgemgr/nodes/{node_id}/certs

ief:node:createNodeCert

-

DELETE /v2/{project_id}/edgemgr/nodes/{node_id}

ief:node:delete

-

DELETE /v2/{project_id}/edgemgr/nodes/{node_id}/certs/{cert_id}

ief:node:deleteNodeCert

-

GET /v2/{project_id}/edgemgr/nodes/{node_id}

ief:node:get

-

GET /v2/{project_id}/edgemgr/nodes

ief:node:list

-

GET /v2/{project_id}/edgemgr/nodes/{node_id}/certs

ief:node:listNodeCert

-

-

ief:node:maintain

-

PUT /v2/{project_id}/edgemgr/nodes/{node_id}

ief:node:update

-

-

ief:node:upgrade

-

POST /v2/{project_id}/edgemgr/nodes/{node_id}/upgrade

ief:node:upgrade

-

POST /v2/{project_id}/productmgr/products

ief:product:create

-

DELETE /v2/{project_id}/productmgr/products/{product_id}

ief:product:delete

-

GET /v2/{project_id}/productmgr/products/{product_id}

ief:product:get

-

GET /v2/{project_id}/productmgr/products

ief:product:list

-

Resource

A resource type indicates the resource that a policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for IEF.

Table 3 Resource types supported by IEF

Resource Type

URN

appversion

ief:<region>:<account-id>:appversion:<appversion-name>

product

ief:<region>:<account-id>:product:<product-name>

group

ief:<region>:<account-id>:group:<group-name>

node

ief:<region>:<account-id>:node:<node-name>

application

ief:<region>:<account-id>:application:<app-name>

iefinstance

ief:<region>:<account-id>:iefinstance:<cluster-name>

batchjob

ief:<region>:<account-id>:batchjob:<job-name>

deployment

ief:<region>:<account-id>:deployment:<deployment-name>

Condition

Condition Key

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

  • Condition keys are the key values in the Condition element of an identity policy statement. Condition keys are classified into global condition keys and service-specific condition keys based on the application scope.
    • Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
    • Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, ief:) apply only to operations of the specific service. For details, see Table 4.
    • The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
  • A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

Service-specific condition keys supported by IEF

The following table lists the condition keys that you can define in identity policies for IEF. You can include these condition keys to specify conditions for when your identity policy is in effect.

Table 4 Service-specific condition keys supported by IEF

Service-specific Condition Key

Type

Single-valued/Multivalued

Description

ief:IefInstanceId

string

Single-valued

Filters access permissions based on the cluster ID passed in the request.