Elastic Load Balance

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by ELB, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by ELB, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for ELB.

**Table 1** Actions supported by ELB
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
elb:flavors:show	Grants permission to show flavor.	Read	flavor *	-	elb:flavors:get
elb:flavors:list	Grants permission to list flavors.	List	flavor *	-	-
elb:quotas:list	Grants permission to list quotas.	List	-	-	-
elb:quotas:show	Grants permission to show resource quota.	Read	-	-	elb:quotas:get
elb:availability-zones:list	Grants permission to list az.	List	availabilityZone *	-	-
elb:availability-zones:list	Grants permission to list az.	List	-	g:EnterpriseProjectId	-
elb:loadbalancers:list	Grants permission to list loadbalancer.	List	loadbalancer *	-	-
elb:loadbalancers:list	Grants permission to list loadbalancer.	List	-	g:EnterpriseProjectId	-
elb:loadbalancers:show	Grants permission to get loadbalancer info.	Read	loadbalancer *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	elb:loadbalancers:get
elb:loadbalancers:create	Grants permission to create loadbalancer.	Write	loadbalancer *	-	-
			subnet	-
			-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId elb:AssociatePublicips
elb:loadbalancers:update	Grants permission to update loadbalancer.	Write	subnet	-	elb:loadbalancers:put
			loadbalancer *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
			-	elb:AssociatePublicips
elb:loadbalancers:delete	Grants permission to delete loadbalancer.	Write	loadbalancer *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
elb:listeners:create	Grants permission to create listener.	Write	listener *	g:EnterpriseProjectId	-
			loadbalancer *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
			-	g:RequestTag/<tag-key> g:TagKeys
elb:listeners:update	Grants permission to update listener.	Write	listener *	g:ResourceTag/<tag-key> g:EnterpriseProjectId elb:UpdateListenerIpgroup elb:OnlyUpdateListenerIpgroup	elb:listeners:put
elb:listeners:list	Grants permission to list listener.	List	listener *	-	-
elb:listeners:list	Grants permission to list listener.	List	-	g:EnterpriseProjectId	-
elb:listeners:show	Grants permission to get listener.	Read	listener *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	elb:listeners:get
elb:listeners:delete	Grants permission to delete listener.	Write	listener *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
elb:certificates:list	Grants permission to list certificate.	List	certificate *	-	-
elb:certificates:list	Grants permission to list certificate.	List	-	g:EnterpriseProjectId	-
elb:certificates:show	Grants permission to get certificate info.	Read	certificate *	-	elb:certificates:get
elb:certificates:create	Grants permission to create certificate.	Write	certificate *	-	-
elb:certificates:create	Grants permission to create certificate.	Write	-	g:EnterpriseProjectId	-
elb:certificates:update	Grants permission to modify certificate.	Write	certificate *	-	elb:certificates:put
elb:certificates:delete	Grants permission to delete certificate.	Write	certificate *	-	-
elb:certificates:setPrivateKeyEcho	Grants permission to set private key echo switch.	Write	-	-	-
elb:certificates:getPrivateKeyEcho	Grants permission to get private key echo switch.	Write	-	-	-
elb:healthmonitors:create	Grants permission to create a healthmonitor.	Write	healthmonitor *	g:EnterpriseProjectId	-
elb:healthmonitors:create	Grants permission to create a healthmonitor.	Write	pool *	g:EnterpriseProjectId	-
elb:healthmonitors:update	Grants permission to modify healthmonitor.	Write	healthmonitor *	g:EnterpriseProjectId	elb:healthmonitors:put
elb:healthmonitors:delete	Grants permission to delete healthmonitor.	Write	healthmonitor *	g:EnterpriseProjectId	-
elb:healthmonitors:show	Grants permission to get healthmonitor.	Read	healthmonitor *	g:EnterpriseProjectId	elb:healthmonitors:get
elb:healthmonitors:list	Grants permission to list healthmonitor.	List	healthmonitor *	-	-
elb:healthmonitors:list	Grants permission to list healthmonitor.	List	-	g:EnterpriseProjectId	-
elb:ipgroups:list	Grants permission to list ipgroups.	List	ipgroup *	-	-
elb:ipgroups:list	Grants permission to list ipgroups.	List	-	g:EnterpriseProjectId	-
elb:ipgroups:show	Grants permission to get ipgroup info.	Read	ipgroup *	-	elb:ipgroups:get
elb:ipgroups:create	Grants permission to create ipgroup.	Write	ipgroup *	-	-
elb:ipgroups:create	Grants permission to create ipgroup.	Write	-	g:EnterpriseProjectId	-
elb:ipgroups:update	Grants permission to modify ipgroup.	Write	ipgroup *	-	elb:ipgroups:put
elb:ipgroups:delete	Grants permission to delete ipgroup.	Write	ipgroup *	-	-
elb:ipgroups:showRelatedListeners	Grants permission to get listeners associated with the specified ipgroup.	Read	ipgroup *	-	elb:ipgroups:related-listeners
elb:l7policies:create	Grants permission to create l7policy.	Write	listener *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
			l7policy *	g:EnterpriseProjectId
			pool	g:EnterpriseProjectId
elb:l7policies:update	Grants permission to modify l7policy.	Write	l7policy *	g:EnterpriseProjectId	elb:l7policies:put
			listener	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			pool	g:EnterpriseProjectId
elb:l7policies:delete	Grants permission to delete l7policy.	Write	l7policy *	g:EnterpriseProjectId	-
elb:l7policies:show	Grants permission to get l7policy info.	Read	l7policy *	g:EnterpriseProjectId	elb:l7policies:get
elb:l7policies:list	Grants permission to list l7policies.	List	l7policy *	-	-
elb:l7policies:list	Grants permission to list l7policies.	List	-	g:EnterpriseProjectId	-
elb:l7rules:create	Grants permission to create l7rule.	Write	l7rule *	g:EnterpriseProjectId	-
elb:l7rules:create	Grants permission to create l7rule.	Write	l7policy *	g:EnterpriseProjectId	-
elb:l7rules:update	Grants permission to modify l7rule.	Write	l7rule *	g:EnterpriseProjectId	elb:l7rules:put
elb:l7rules:list	Grants permission to list l7rules.	List	l7policy *	-	-
			l7rule *	-
			-	g:EnterpriseProjectId
elb:l7rules:show	Grants permission to get l7rule.	Read	l7rule *	g:EnterpriseProjectId	elb:l7rules:get
elb:l7rules:delete	Grants permission to delete l7rule.	Write	l7rule *	g:EnterpriseProjectId	-
elb:logtanks:list	Grants permission to list logtanks.	List	logtank *	-	-
elb:logtanks:list	Grants permission to list logtanks.	List	-	g:EnterpriseProjectId	-
elb:logtanks:show	Grants permission to show logtank info.	Read	logtank *	g:EnterpriseProjectId	elb:logtanks:get
elb:logtanks:create	Grants permission to create logtank.	Write	logtank *	g:EnterpriseProjectId	-
elb:logtanks:create	Grants permission to create logtank.	Write	loadbalancer *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
elb:logtanks:update	Grants permission to modify logtank.	Write	logtank *	g:EnterpriseProjectId	elb:logtanks:put
elb:logtanks:delete	Grants permission to delete logtank.	Write	logtank *	g:EnterpriseProjectId	-
elb:pools:list	Grants permission to list pool.	List	pool *	-	-
elb:pools:list	Grants permission to list pool.	List	-	g:EnterpriseProjectId	-
elb:pools:show	Grants permission to get pool.	Read	pool *	g:EnterpriseProjectId	elb:pools:get
elb:pools:create	Grants permission to create pool.	Write	loadbalancer	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
			listener	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			pool *	g:EnterpriseProjectId
elb:pools:update	Grants permission to modify pool.	Write	pool *	g:EnterpriseProjectId	elb:pools:put
elb:pools:delete	Grants permission to delete pool.	Write	pool *	g:EnterpriseProjectId	-
elb:members:list	Grants permission to list member.	List	pool	-	-
			member *	-
			-	g:EnterpriseProjectId
elb:members:show	Grants permission to get member.	Read	member *	g:EnterpriseProjectId	elb:members:get
elb:members:create	Grants permission to create member.	Write	member *	g:EnterpriseProjectId	-
			pool *	g:EnterpriseProjectId
			subnet	-
elb:members:update	Grants permission to modify member.	Write	member *	g:EnterpriseProjectId	elb:members:put
elb:members:delete	Grants permission to delete member.	Write	member *	g:EnterpriseProjectId	-
elb:security-policies:list	Grants permission to list security-policies.	List	securityPolicy *	-	-
elb:security-policies:list	Grants permission to list security-policies.	List	-	g:EnterpriseProjectId	-
elb:security-policies:show	Grants permission to get security-policy.	Read	securityPolicy *	-	elb:security-policies:get
elb:security-policies:create	Grants permission to create security-policy.	Write	securityPolicy *	-	-
elb:security-policies:create	Grants permission to create security-policy.	Write	-	g:EnterpriseProjectId	-
elb:security-policies:update	Grants permission to modify security-policy.	Write	securityPolicy *	-	elb:security-policies:put
elb:security-policies:delete	Grants permission to delete security-policy.	Write	securityPolicy *	-	-
elb:loadbalancers:export	Grants permission to export loadbalancers.	Read	loadbalancer *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-
elb:listeners:export	Grants permission to export listeners.	Read	listener *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	-

Each API of ELB usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by ELB APIs
API	Action	Dependencies
GET /v3/{project_id}/elb/flavors	elb:flavors:list	-
GET /v3/{project_id}/elb/flavors/{flavor_id}	elb:flavors:show	-
GET /v3/{project_id}/elb/quotas/details	elb:quotas:list	-
GET /v3/{project_id}/elb/quotas	elb:quotas:show	-
POST /v3/{project_id}/elb/loadbalancers	elb:loadbalancers:create	-
DELETE /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}	elb:loadbalancers:delete	-
DELETE /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}/force-elb	elb:loadbalancers:delete	-
GET /v3/{project_id}/elb/loadbalancers	elb:loadbalancers:list	-
GET /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}	elb:loadbalancers:show	-
GET /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}/statuses	elb:loadbalancers:show	-
PUT /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}	elb:loadbalancers:update	-
POST /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}/availability-zone/batch-remove	elb:loadbalancers:update	-
POST /v3/{project_id}/elb/loadbalancers/{loadbalancer_id}/availability-zone/batch-add	elb:loadbalancers:update	-
POST /v3/{project_id}/elb/ipgroups	elb:ipgroups:create	-
DELETE /v3/{project_id}/elb/ipgroups/{ipgroup_id}	elb:ipgroups:delete	-
GET /v3/{project_id}/elb/ipgroups	elb:ipgroups:list	-
GET /v3/{project_id}/elb/ipgroups/{ipgroup_id}	elb:ipgroups:show	-
PUT /v3/{project_id}/elb/ipgroups/{ipgroup_id}	elb:ipgroups:update	-
POST /v3/{project_id}/elb/ipgroups/{ipgroup_id}/iplist/create-or-update	elb:ipgroups:update	-
POST /v3/{project_id}/elb/ipgroups/{ipgroup_id}/iplist/batch-delete	elb:ipgroups:update	-
GET /v3/{project_id}/elb/ipgroups/{ipgroup_id}/related-listeners	elb:ipgroups:showRelatedListeners	-
POST /v3/{project_id}/elb/security-policies	elb:security-policies:create	-
DELETE /v3/{project_id}/elb/security-policies/{security_policy_id}	elb:security-policies:delete	-
GET /v3/{project_id}/elb/security-policies	elb:security-policies:list	-
GET /v3/{project_id}/elb/system-security-policies	elb:security-policies:list	-
GET /v3/{project_id}/elb/security-policies/{security_policy_id}	elb:security-policies:show	-
PUT /v3/{project_id}/elb/security-policies/{security_policy_id}	elb:security-policies:update	-
POST /v3/{project_id}/elb/pools/{pool_id}/members	elb:members:create	-
DELETE /v3/{project_id}/elb/pools/{pool_id}/members/{member_id}	elb:members:delete	-
GET /v3/{project_id}/elb/pools/{pool_id}/members	elb:members:list	-
GET /v3/{project_id}/elb/pools/{pool_id}/members/{member_id}	elb:members:show	-
PUT /v3/{project_id}/elb/pools/{pool_id}/members/{member_id}	elb:members:update	-
POST /v3/{project_id}/elb/pools/{pool_id}/members/batch-update	elb:members:update	-
POST /v3/{project_id}/elb/pools/{pool_id}/members/batch-add	elb:members:create	-
POST /v3/{project_id}/elb/pools/{pool_id}/members/batch-delete	elb:members:delete	-
POST /v3/{project_id}/elb/pools	elb:pools:create	-
DELETE /v3/{project_id}/elb/pools/{pool_id}	elb:pools:delete	-
GET /v3/{project_id}/elb/pools	elb:pools:list	-
GET /v3/{project_id}/elb/pools/{pool_id}	elb:pools:show	-
PUT /v3/{project_id}/elb/pools/{pool_id}	elb:pools:update	-
POST /v3/{project_id}/elb/master-slave-pools	elb:pools:create	-
GET /v3/{project_id}/elb/master-slave-pools	elb:pools:list	-
GET /v3/{project_id}/elb/master-slave-pools/{pool_id}	elb:pools:show	-
DELETE /v3/{project_id}/elb/master-slave-pools/{pool_id}	elb:pools:delete	-
POST /v3/{project_id}/elb/listeners	elb:listeners:create	-
DELETE /v3/{project_id}/elb/listeners/{listener_id}	elb:listeners:delete	-
DELETE /v3/{project_id}/elb/listeners/{listener_id}/force	elb:listeners:delete	-
GET /v3/{project_id}/elb/listeners	elb:listeners:list	-
GET /v3/{project_id}/elb/listeners/{listener_id}	elb:listeners:show	-
PUT /v3/{project_id}/elb/listeners/{listener_id}	elb:listeners:update	-
POST /v3/{project_id}/elb/healthmonitors	elb:healthmonitors:create	-
DELETE /v3/{project_id}/elb/healthmonitors/{healthmonitor_id}	elb:healthmonitors:delete	-
GET /v3/{project_id}/elb/healthmonitors	elb:healthmonitors:list	-
GET /v3/{project_id}/elb/healthmonitors/{healthmonitor_id}	elb:healthmonitors:show	-
PUT /v3/{project_id}/elb/healthmonitors/{healthmonitor_id}	elb:healthmonitors:update	-
GET /v3/{project_id}/elb/availability-zones	elb:availability-zones:list	-
GET /v3/{project_id}/elb/preoccupy-ip-num	elb:loadbalancers:show	-
POST /v3/{project_id}/elb/logtanks	elb:logtanks:create	-
DELETE /v3/{project_id}/elb/logtanks/{logtank_id}	elb:logtanks:delete	-
GET /v3/{project_id}/elb/logtanks	elb:logtanks:list	-
GET /v3/{project_id}/elb/logtanks/{logtank_id}	elb:logtanks:show	-
PUT /v3/{project_id}/elb/logtanks/{logtank_id}	elb:logtanks:update	-
POST /v3/{project_id}/elb/certificates	elb:certificates:create	-
DELETE /v3/{project_id}/elb/certificates/{certificate_id}	elb:certificates:delete	-
GET /v3/{project_id}/elb/certificates	elb:certificates:list	-
GET /v3/{project_id}/elb/certificates/{certificate_id}	elb:certificates:show	-
PUT /v3/{project_id}/elb/certificates/{certificate_id}	elb:certificates:update	-
POST /v3/{project_id}/elb/certificates/settings/private-key-echo	elb:certificates:setPrivateKeyEcho	-
GET /v3/{project_id}/elb/certificates/settings/private-key-echo	elb:certificates:getPrivateKeyEcho	-
POST /v3/{project_id}/elb/l7policies	elb:l7policies:create	-
DELETE /v3/{project_id}/elb/l7policies/{l7policy_id}	elb:l7policies:delete	-
GET /v3/{project_id}/elb/l7policies	elb:l7policies:list	-
GET /v3/{project_id}/elb/l7policies/{l7policy_id}	elb:l7policies:show	-
PUT /v3/{project_id}/elb/l7policies/{l7policy_id}	elb:l7policies:update	-
POST /v3/{project_id}/elb/l7policies/batch-update-priority	elb:l7policies:update	-
POST /v3/{project_id}/elb/l7policies/{l7policy_id}/rules	elb:l7rules:create	-
DELETE /v3/{project_id}/elb/l7policies/{l7policy_id}/rules/{l7rule_id}	elb:l7rules:delete	-
GET /v3/{project_id}/elb/l7policies/{l7policy_id}/rules	elb:l7rules:list	-
GET /v3/{project_id}/elb/l7policies/{l7policy_id}/rules/{l7rule_id}	elb:l7rules:show	-
PUT /v3/{project_id}/elb/l7policies/{l7policy_id}/rules/{l7rule_id}	elb:l7rules:update	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for ELB.

**Table 3** Resource types supported by ELB
Resource Type	URN
pool	elb:<region>:<account-id>:pool:<pool-id>
loadbalancer	elb:<region>:<account-id>:loadbalancer:<loadbalancer-id>
certificate	elb:<region>:<account-id>:certificate:<certificate-id>
healthmonitor	elb:<region>:<account-id>:healthmonitor:<healthmonitor-id>
ipgroup	elb:<region>:<account-id>:ipgroup:<ipgroup-id>
securityPolicy	elb:<region>:<account-id>:securityPolicy:<security-policy-id>
logtank	elb:<region>:<account-id>:logtank:<logtank-id>
availabilityZone	elb:<region>:<account-id>:availabilityZone:<availability-zone-id>
member	elb:<region>:<account-id>:member:<pool-id>/<member-id>
l7policy	elb:<region>:<account-id>:l7policy:<l7policy-id>
l7rule	elb:<region>:<account-id>:l7rule:<l7policy-id>/<l7rule-id>
flavor	elb:<region>:<account-id>:flavor:<flavor-id>
subnet	vpc:<region>:<account-id>:subnet:<subnet-id>
listener	elb:<region>:<account-id>:listener:<listener-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, elb) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by ELB

The following table lists the condition keys that you can define in identity policies for ELB. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by ELB
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
elb:AssociatePublicips	boolean	Single-valued	Filters access based on whether creating or binding a public network is involved during load balancer creation or modification.To prevent the Elastic Load Balancer from accessing the public network, you need to use the EIP-related actions for policy management.
elb:UpdateListenerIpgroup	boolean	Single-valued	Filters access permissions based on whether the access control needs to be updated when the listener is modified.
elb:OnlyUpdateListenerIpgroup	boolean	Single-valued	Filters access permissions based on whether only the access control needs to be updated when the listener is modified.