Cloud Native Anti-DDoS Basic

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by Anti-DDoS, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by Anti-DDoS, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for Anti-DDoS.

**Table 1** Actions supported by Anti-DDoS
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
anti-ddos:task:list	Grants permission to query Anti-DDoS tasks.	List	-	-	-
anti-ddos:quota:list	Grants permission to query quotas.	List	-	-	-
anti-ddos:optionalDefensePolicy:list	Grants permission to query Anti-DDoS protection specifications.	List	-	-	-
anti-ddos:logConfig:update	Grants permission to update LTS configurations.	Write	-	-	-
anti-ddos:logConfig:get	Grants permission to query LTS configurations.	Read	-	-	-
anti-ddos:ip:updateDefensePolicy	Grants permission to update Anti-DDoS.	Write	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:untagResource	Grants permission to delete tags in batches.	Write	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:tagResource	Grants permission to add tags in batches.	Write	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:listTagsForResource	Grants permission to query resource tags.	List	ip *	-	-
anti-ddos:ip:listDefenseStatuses	Grants permission to query EIP protection statuses.	List	ip *	-	-
anti-ddos:ip:getWeeklyReport	Grants permission to query weekly protection statistics.	Read	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:getDefenseStatus	Grants permission to query the protection status of an EIP.	Read	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:getDefensePolicy	Grants permission to query Anti-DDoS.	Read	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:getDailyTrafficReport	Grants permission to query protected traffic of an EIP.	Read	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:getDailyEventReport	Grants permission to query abnormal events of an EIP.	Read	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:enableDefensePolicy	Grants permission to enable Anti-DDoS.	Write	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:ip:disableDefensePolicy	Grants permission to disable Anti-DDoS.	Write	ip *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
anti-ddos:defaultDefensePolicy:get	Grants permission to query default Anti-DDoS protection policies.	Read	-	-	-
anti-ddos:defaultDefensePolicy:delete	Grants permission to delete default Anti-DDoS protection policies.	Write	-	-	-
anti-ddos:defaultDefensePolicy:create	Grants permission to configure default Anti-DDoS protection policies.	Write	-	-	-
anti-ddos:alertConfig:update	Grants permission to update alarm configurations.	Write	-	-	-
anti-ddos:alertConfig:get	Grants permission to query alarm configurations.	Read	-	-	-

Each API of Anti-DDoS usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by Anti-DDoS APIs
API	Action	Dependencies
GET /v2/{project_id}/query-task-status	anti-ddos:task:list	-
GET /v1/{project_id}/antiddos/quotas	anti-ddos:quota:list	-
GET /v1/{project_id}/antiddos/query-config-list	anti-ddos:optionalDefensePolicy:list	-
PUT /v1/{project_id}/antiddos/lts-config	anti-ddos:logConfig:update	-
GET /v1/{project_id}/antiddos/lts-config	anti-ddos:logConfig:get	-
PUT /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:updateDefensePolicy	-
DELETE /v1/{project_id}/antiddos-ip/{resource_id}/tags/delete	anti-ddos:ip:untagResource	-
POST /v1/{project_id}/antiddos-ip/{resource_id}/tags/create	anti-ddos:ip:tagResource	-
GET /v1/{project_id}/antiddos-ip/{resource_id}/tags	anti-ddos:ip:listTagsForResource	-
GET /v1/{project_id}/antiddos-ip/tags	anti-ddos:ip:listTagsForResource	-
GET /v1/{project_id}/antiddos	anti-ddos:ip:listDefenseStatuses	-
POST /v1/{project_id}/antiddos-ip/resource-instances/count	anti-ddos:ip:listDefenseStatuses	-
POST /v1/{project_id}/antiddos-ip/resource-instances/filter	anti-ddos:ip:listDefenseStatuses	-
GET /v1/{project_id}/antiddos/weekly	anti-ddos:ip:getWeeklyReport	-
GET /v1/{project_id}/antiddos/weekly-export	anti-ddos:ip:getWeeklyReport	-
GET /v1/{project_id}/antiddos/{floating_ip_id}/status	anti-ddos:ip:getDefenseStatus	-
GET /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:getDefensePolicy	-
GET /v1/{project_id}/antiddos/queryIsEnabledResult/query	anti-ddos:ip:getDefensePolicy	-
GET /v1/{project_id}/antiddos/{floating_ip_id}/daily	anti-ddos:ip:getDailyTrafficReport	-
GET /v1/{project_id}/antiddos/{floating_ip_id}/daily-export	anti-ddos:ip:getDailyTrafficReport	-
GET /v1/{project_id}/antiddos/{floating_ip_id}/logs	anti-ddos:ip:getDailyEventReport	-
POST /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:enableDefensePolicy	-
POST /v1/{project_id}/antiddos/immediate_protection	anti-ddos:ip:enableDefensePolicy	-
DELETE /v1/{project_id}/antiddos/{floating_ip_id}	anti-ddos:ip:disableDefensePolicy	-
DELETE /v1/{project_id}/antiddos/{floating_ip_id}/closeAndReason	anti-ddos:ip:disableDefensePolicy	-
GET /v1/{project_id}/antiddos/default/config	anti-ddos:defaultDefensePolicy:get	-
DELETE /v1/{project_id}/antiddos/default/config	anti-ddos:defaultDefensePolicy:delete	-
POST /v1/{project_id}/antiddos/default/config	anti-ddos:defaultDefensePolicy:create	-
POST /v2/{project_id}/warnalert/alertconfig/update	anti-ddos:alertConfig:update	-
GET /v2/{project_id}/warnalert/alertconfig/query	anti-ddos:alertConfig:get	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for Anti-DDoS.

**Table 3** Resource types supported by Anti-DDoS
Resource Type	URN
ip	anti-ddos:<region>:<account-id>:ip:<ip-id>

Conditions

Anti-DDoS does not support service-specific condition keys in identity policies.It can only use global condition keys applicable to all services. For details, see Global Condition Keys.

Parent topic: Anti-DDoS Service (AAD)

Previous topic: Anti-DDoS Service (AAD)

Next topic: Cloud Native Anti-DDoS Advanced