Cloud Firewall (CFW)

IAM provides system-defined identity policies to define typical cloud service permissions. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to an organizational unit (OU) or a member account, the SCPs do not directly grant permissions to that OU or member account. Instead, the SCPs only determine what permissions are available for that member account or those member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see How IAM Is Different from Organizations for Access Control?.

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your identity policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by CFW, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by CFW, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for CFW.

**Table 1** Actions supported by CFW
Action	Description	Access Level	Resource Type (*: required)	Condition Key	Alias
cfw:acl:createAclRule	Grants permission to create an acl rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:create
cfw:acl:deleteAclRule	Grants permission to delete an acl rule.	Write	acl *	-	cfw:acl:delete
cfw:acl:deleteAclRule	Grants permission to delete an acl rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:delete
cfw:acl:deleteHitCount	Grants permission to delete acl rule hit count.	Write	acl *	-	cfw:acl:list
cfw:acl:deleteHitCount	Grants permission to delete acl rule hit count.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:instance:listDomainParseServers	Grants permission to get domain parse server.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:domain:get
cfw:instance:getDomainParseResult	Grants permission to parse domain.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:domain:get
cfw:acl:getExportStatus	Grants permission to get acl export status.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:acl:getImportStatus	Grants permission to get acl import status.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:acl:getImportTemplate	Grants permission to get acl import template.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:acl:listAclRules	Grants permission to list acl rules.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:acl:listAclTags	Grants permission to list acl rule tags.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:acl:updateAclRule	Grants permission to update acl rule.	Write	acl *	-	cfw:acl:put
cfw:acl:updateAclRule	Grants permission to update acl rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:put
cfw:acl:updateAclRuleAction	Grants permission to update acl rule action.	Write	acl *	-	cfw:acl:put
cfw:acl:updateAclRuleAction	Grants permission to update acl rule action.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:put
cfw:instance:updateDomainParseServer	Grants permission to update domain parse server.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:put
cfw:acl:setPriority	Grants permission to set acl rule priority.	Write	acl *	-	-
cfw:acl:setPriority	Grants permission to set acl rule priority.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:blackWhiteList:create	Grants permission to create blackwhite list.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:blackWhite:create
cfw:blackWhiteList:delete	Grants permission to delete blackwhite list.	Write	blackWhiteList *	-	cfw:blackWhite:delete
cfw:blackWhiteList:delete	Grants permission to delete blackwhite list.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:blackWhite:delete
cfw:blackWhiteList:list	Grants permission to list blackwhite lists.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:blackWhite:list
cfw:blackWhiteList:update	Grants permission to update blackwhite list.	Write	blackWhiteList *	-	cfw:blackWhite:put
cfw:blackWhiteList:update	Grants permission to update blackwhite list.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:blackWhite:put
cfw:domainGroup:update	Grants permission to update domainGroup.	Write	domainGroup *	-	cfw:ipGroup:put
cfw:domainGroup:update	Grants permission to update domainGroup.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:put
cfw:domainGroup:create	Grants permission to create domainGroup.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:create
cfw:domainGroup:delete	Grants permission to delete domainGroup.	Write	domainGroup *	-	cfw:ipGroup:delete
cfw:domainGroup:delete	Grants permission to delete domainGroup.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:delete
cfw:domainGroup:list	Grants permission to list domainGroup.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:list
cfw:eip:count	Grants permission to get eip statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:eipStatistics:get
cfw:eip:list	Grants permission to list eip.	List	instance *	g:ResourceTag/<tag-key>	-
cfw:eip:updateProtectStatus	Grants permission to change eip protect status.	Write	eip *	-	cfw:eip:operate
cfw:eip:updateProtectStatus	Grants permission to change eip protect status.	Write	-	g:EnterpriseProjectId	cfw:eip:operate
cfw:instance:checkNameRepeat	Grants permission to check if cfw name repeat.	Read	-	-	cfw:instance:list
cfw:instance:listAdvanceIpsRules	Grants permission to list cfw advance ips rules.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:get
cfw:instance:listUsedEr	Grants permission to list used er.	List	-	-	cfw:instance:list
cfw:instance:listUsedInspectionVpc	Grants permission to list used vpc.	List	-	-	cfw:instance:list
cfw:instance:addLogConfig	Grants permission to add CFW log config.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:create
cfw:instance:addLogConfig	Grants permission to add CFW log config.	Write	-	cfw:LogGroupId	cfw:instance:create
cfw:instance:updateCustomRule	Grants permission to update CFW custom ips rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateCustomRuleAction	Grants permission to update CFW custom ips rule action.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateLogConfig	Grants permission to update CFW LTS log config.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:upgrade
cfw:instance:updateLogConfig	Grants permission to update CFW LTS log config.	Write	-	cfw:LogGroupId	cfw:instance:upgrade
cfw:instance:createInstance	Grants permission to create an CFW instance.	Write	instance *	-	cfw:instance:create
cfw:instance:createInstance	Grants permission to create an CFW instance.	Write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId	cfw:instance:create
cfw:instance:deletePostPaidInstance	Grants permission to delete post paid CFW instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:createCaptureTask	Grants permission to create CFW capture task.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:captureTask:create
cfw:instance:createCustomRule	Grants permission to create CFW custom rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:createTags	Grants permission to create CFW tags.	Tagging	instance *	g:EnterpriseProjectId g:ResourceTag/<tag-key>	cfw:instance:upgrade
cfw:instance:createTags	Grants permission to create CFW tags.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	cfw:instance:upgrade
cfw:instance:deleteInstance	Grants permission to delete CFW instance.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:delete
cfw:instance:deleteCaptureTask	Grants permission to delete CFW capture task.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:captureTask:delete
cfw:instance:deleteCustomRule	Grants permission to delete CFW custom ips rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:deleteLogSearchHistory	Grants permission to delete CFW log search history.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:deleteTags	Grants permission to delete CFW tags.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:upgrade
cfw:instance:deleteTags	Grants permission to delete CFW tags.	Tagging	-	g:TagKeys	cfw:instance:upgrade
cfw:instance:exportLog	Grants permission to export log.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:accessControlLog:list
cfw:instance:listInstanceByTags	Grants permission to list cfw by tags.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:listInstanceByTags	Grants permission to list cfw by tags.	List	-	g:TagKeys	cfw:instance:list
cfw:instance:getBaseVersion	Grants permission to get cfw base version.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:baseVersion:get
cfw:instance:getCaptureTaskResult	Grants permission to get cfw capture task result.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:captureTask:getResult
cfw:instance:getCustomRule	Grants permission to get cfw custom rule.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:get
cfw:instance:getDomainParseServerStatus	Grants permission to get cfw domain parse server status.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:domain:get
cfw:instance:getIpsMode	Grants permission to get cfw ips mode.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:get
cfw:instance:getIpsStatus	Grants permission to get cfw ips status.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsStatus:get
cfw:instance:getLogConfig	Grants permission to get cfw log config.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLog:list
cfw:instance:getMaxCapturePacketNum	Grants permission to get cfw user max capture packet number.	Read	-	-	cfw:captureTask:list
cfw:instance:getPolicyStatistics	Grants permission to get cfw policy statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:policyStatistics:get
cfw:instance:listProjectTags	Grants permission to list project tags.	List	-	-	cfw:instance:list
cfw:instance:getRegionDb	Grants permission to get cfw region db.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:acl:list
cfw:instance:listInstanceTags	Grants permission to list cfw tags.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:listInstance	Grants permission to list CFW instances.	List	instance *	-	cfw:instance:list
cfw:instance:getInstance	Grants permission to get CFW instances detail.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:listAccessControlLog	Grants permission to list CFW access control log.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:accessControlLog:list
cfw:instance:listAttackLog	Grants permission to list CFW attack log.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLog:list
cfw:instance:listCaptureTask	Grants permission to list CFW capture tasks.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:captureTask:list
cfw:instance:listCustomRule	Grants permission to list CFW custom ips rule.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:get
cfw:instance:getEw	Grants permission to get cfw east-west firewall.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:listFlowLog	Grants permission to list cfw flow log.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:flowLog:list
cfw:instance:listIpsRule	Grants permission to list cfw ips rules.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:get
cfw:instance:listProtectedVpc	Grants permission to list cfw protect vpcs.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:updateIpsMode	Grants permission to update cfw ips mode.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateAdvanceIpsRule	Grants permission to update cfw advance ips rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateIpsRuleAction	Grants permission to update cfw ips rule mode.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateIpsStatus	Grants permission to update cfw ips status.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipsMode:operate
cfw:instance:updateEwProtectedStatus	Grants permission to update cfw east-west firewall protect status.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:create
cfw:instance:saveTags	Grants permission to save cfw tags.	Tagging	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:upgrade
cfw:instance:saveTags	Grants permission to save cfw tags.	Tagging	-	g:RequestTag/<tag-key> g:TagKeys	cfw:instance:upgrade
cfw:instance:startBaseVersion	Grants permission to start cfw base version.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:baseVersion:start
cfw:instance:stopBaseVersion	Grants permission to stop cfw base version.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:baseVersion:stop
cfw:instance:stopCaptureTask	Grants permission to stop cfw capture task.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:captureTask:stop
cfw:instance:updateAlarmConfig	Grants permission to update cfw alarm config.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:create
cfw:instance:getAlarmConfig	Grants permission to get cfw alarm config.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:list
cfw:instance:upgradeInstance	Grants permission to upgrade cfw.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:upgrade
cfw:instance:updateName	Grants permission to update cfw name.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:instance:upgrade
cfw:instance:getAccessControlLogStatistics	Grants permission to get cfw access control log statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:accessControlLogReport:get
cfw:instance:getAttackLogStatistics	Grants permission to get cfw attack log statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLogReport:get
cfw:instance:getLogSearchHistory	Grants permission to get cfw log search history.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLogReport:get
cfw:instance:getEngineLogStatistics	Grants permission to get cfw engine log statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLogReport:get
cfw:instance:getFlowLogStatistics	Grants permission to get cfw flow log statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:flowLogReport:get
cfw:instance:getIpLogStatistics	Grants permission to get cfw ip log statistics.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:attackLogReport:get
cfw:ipGroup:updateIpGroupMember	Grants permission to update cfw ip group member.	Write	ipGroup *	-	cfw:ipMember:put
cfw:ipGroup:updateIpGroupMember	Grants permission to update cfw ip group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipMember:put
cfw:ipGroup:createIpGroup	Grants permission to change cfw ip group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:create
cfw:ipGroup:createIpGroupMember	Grants permission to create cfw ip group member.	Write	ipGroup *	-	cfw:ipMember:create
cfw:ipGroup:createIpGroupMember	Grants permission to create cfw ip group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipMember:create
cfw:ipGroup:deleteIpGroup	Grants permission to delete cfw ip group.	Write	ipGroup *	-	cfw:ipGroup:delete
cfw:ipGroup:deleteIpGroup	Grants permission to delete cfw ip group.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:delete
cfw:ipGroup:deleteIpGroupMember	Grants permission to delete cfw ip group member.	Write	ipGroup *	-	cfw:ipMember:delete
cfw:ipGroup:deleteIpGroupMember	Grants permission to delete cfw ip group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipMember:delete
cfw:ipGroup:getIpGroup	Grants permission to get cfw ip group.	Read	ipGroup *	-	cfw:ipGroup:get
cfw:ipGroup:getIpGroup	Grants permission to get cfw ip group.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:get
cfw:ipGroup:listIpGroups	Grants permission to list cfw ip groups.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:list
cfw:ipGroup:listIpGroupMember	Grants permission to list cfw ip group members.	List	ipGroup *	-	cfw:ipMember:list
cfw:ipGroup:listIpGroupMember	Grants permission to list cfw ip group members.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipMember:list
cfw:ipGroup:updateIpGroup	Grants permission to update cfw ip group.	Write	ipGroup *	-	cfw:ipGroup:put
cfw:ipGroup:updateIpGroup	Grants permission to update cfw ip group.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:ipGroup:put
cfw:serviceGroup:updateServiceGroupMember	Grants permission to update cfw service group member.	Write	serviceGroup *	-	cfw:serviceMember:put
cfw:serviceGroup:updateServiceGroupMember	Grants permission to update cfw service group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:serviceMember:put
cfw:serviceGroup:create	Grants permission to create cfw service group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:serviceGroup:createServiceGroupMember	Grants permission to create cfw service group member.	Write	serviceGroup *	-	cfw:serviceMember:create
cfw:serviceGroup:createServiceGroupMember	Grants permission to create cfw service group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:serviceMember:create
cfw:serviceGroup:delete	Grants permission to delete cfw service group.	Write	serviceGroup *	-	-
cfw:serviceGroup:delete	Grants permission to delete cfw service group.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:serviceGroup:deleteServiceGroupMember	Grants permission to delete cfw service group member.	Write	serviceGroup *	-	cfw:serviceMember:delete
cfw:serviceGroup:deleteServiceGroupMember	Grants permission to delete cfw service group member.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:serviceMember:delete
cfw:serviceGroup:get	Grants permission to get cfw service group.	Read	serviceGroup *	-	-
cfw:serviceGroup:get	Grants permission to get cfw service group.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:serviceGroup:list	Grants permission to list cfw service groups.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:serviceGroup:listServiceGroupMember	Grants permission to list cfw service group members.	List	serviceGroup *	-	cfw:serviceMember:list
cfw:serviceGroup:listServiceGroupMember	Grants permission to list cfw service group members.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:serviceMember:list
cfw:serviceGroup:update	Grants permission to update cfw service group.	Write	serviceGroup *	-	cfw:serviceGroup:put
cfw:serviceGroup:update	Grants permission to update cfw service group.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	cfw:serviceGroup:put
cfw:instance:enableMultiAccount	Grants permission to enable multi account.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:listAccounts	Grants permission to list accounts.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:listOrganizationTree	Grants permission to list organization tree.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:addAccount	Grants permission to add account.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:deleteAccount	Grants permission to delete account.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:getProtectedVpc	Grants permission to get protected vpc.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:deleteProtectedVpc	Grants permission to delete protected vpc.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:addProtectedVpc	Grants permission to add protected vpc.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:updateProtectedVpc	Grants permission to update protected vpc.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:updateAntiVirusStatus	Grants permission to update cfw anti virus status.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:getAntiVirusStatus	Grants permission to get cfw anti virus status.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:updateAntiVirusRule	Grants permission to update cfw anti virus rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:getAntiVirusRule	Grants permission to get cfw anti virus rule.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:listReportProfile	Grants permission to list cfw report profile rules.	List	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:createReportProfile	Grants permission to create cfw report profile rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:updateReportProfile	Grants permission to update cfw report profile rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:getReportProfile	Grants permission to show cfw report profile rule.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:deleteReportProfile	Grants permission to delete cfw report profile rule.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:importCertificate	Grants permission to import tls certificate.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:getCertificate	Grants permission to get tls certificate information.	Read	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-
cfw:instance:deleteCertificate	Grants permission to delete tls certificate.	Write	instance *	g:ResourceTag/<tag-key> g:EnterpriseProjectId	-

Each API of CFW usually supports one or more actions. Table 2 lists the supported actions and dependencies.

**Table 2** Actions and dependencies supported by CFW APIs
API	Action	Dependencies
GET /v1/{project_id}/cfw/logs/flow	cfw:instance:listFlowLog	-
GET /v1/{project_id}/cfw/logs/access-control	cfw:instance:listAccessControlLog	-
GET /v1/{project_id}/cfw/logs/attack	cfw:instance:listAttackLog	-
PUT /v1/{project_id}/cfw/logs/configuration	cfw:instance:updateLogConfig	-
GET /v1/{project_id}/acl-rule/import-status	cfw:acl:getImportStatus	-
POST /v1/{project_id}/firewall/east-west	cfw:instance:createInstance	er:instances:list er:instances:listVpcAttachments er:attachments:create vpc:vpcs:list vpc:subnets:get vpc:subnets:create vpc:routeTables:list vpc:routeTables:update vpc:quotas:list nat:natGateways:list
DELETE /v2/{project_id}/firewall/{resource_id}	cfw:instance:deleteInstance	-
GET /v1/{project_id}/ips-rule	cfw:instance:listIpsRule	-
GET /v1/{project_id}/regions	cfw:instance:getRegionDb	-
GET /v1/{project_id}/advanced-ips-rules	cfw:instance:listAdvanceIpsRules	-
POST /v1/{project_id}/advanced-ips-rule	cfw:instance:updateAdvanceIpsRule	-
GET /v1/{project_id}/ips/custom-rule	cfw:instance:listCustomRule	-
PUT /v1/{project_id}/ips/custom-rule/{ips_cfw_id}	cfw:instance:updateCustomRule	-
POST /v1/{project_id}/ips/custom-rule/batch-delete	cfw:instance:deleteCustomRule	-
POST /v1/{project_id}/ips/custom-rule	cfw:instance:createCustomRule	-
GET /v1/{project_id}/cfw/alarm/config	cfw:instance:getAlarmConfig	-
PUT /v1/{project_id}/cfw/alarm/config	cfw:instance:updateAlarmConfig	-
GET /v1/{project_id}/firewall/east-west	cfw:instance:getEw	er:instances:listVpcAttachments vpc:vpcs:list nat:natGateways:list er:instances:listVpcAttachments er:instances:get
POST /v2/{project_id}/cfw-cfw/{fw_instance_id}/tags/create	cfw:instance:createTags	-
DELETE /v2/{project_id}/cfw-cfw/{fw_instance_id}/tags/delete	cfw:instance:deleteTags	-
PUT /v2/{project_id}/cfw-cfw/{fw_instance_id}/tags/save	cfw:instance:saveTags	-
GET /v2/{project_id}/cfw-cfw/tags	cfw:instance:listProjectTags	-
GET /v1/{project_id}/capture-task	cfw:instance:listCaptureTask	-
POST /v1/{project_id}/capture-task	cfw:instance:createCaptureTask	-
POST /v1/{project_id}/capture-task/stop	cfw:instance:stopCaptureTask	-
POST /v1/{project_id}/capture-task/batch-delete	cfw:instance:deleteCaptureTask	-
GET /v1/{project_id}/capture-task/capture-result	cfw:instance:getCaptureTaskResult	-
GET /v1/{project_id}/dns/servers	cfw:instance:listDomainParseServers	-
PUT /v1/{project_id}/dns/servers	cfw:instance:updateDomainParseServer	-
PUT /v1/{project_id}/domain-set/{set_id}	cfw:domainGroup:update	-
DELETE /v1/{project_id}/domain-set/{set_id}	cfw:domainGroup:delete	-
GET /v1/{project_id}/domain-sets	cfw:domainGroup:list	-
POST /v1/{project_id}/system/multi-account/enable	cfw:instance:enableMultiAccount	organizations:trustedServices:list organizations:organizations:get organizations:trustedServices:enable
GET /v1/{project_id}/system/multi-account/accounts	cfw:instance:listAccounts	organizations:trustedServices:list organizations:organizations:get organizations:delegatedAdministrators:list
POST /v1/{project_id}/system/multi-account/accounts	cfw:instance:addAccount	organizations:trustedServices:list organizations:organizations:get organizations:delegatedAdministrators:list organizations:roots:list
GET /v1/{project_id}/system/multi-account/organization-tree	cfw:instance:listOrganizationTree	organizations:trustedServices:list organizations:organizations:get organizations:delegatedAdministrators:list organizations:roots:list organizations:ous:list organizations:accounts:list
GET /v1/{project_id}/anti-virus/rule	cfw:instance:getAntiVirusRule	-
PUT /v1/{project_id}/anti-virus/rule	cfw:instance:updateAntiVirusRule	-
PUT /v1/{project_id}/report-profile/{report_profile_id}	cfw:instance:updateReportProfile	-
DELETE /v1/{project_id}/report-profile/{report_profile_id}	cfw:instance:deleteReportProfile	-
POST /v1/{project_id}/report-profile	cfw:instance:createReportProfile	-
DELETE /v1/{project_id}/address-items	cfw:ipGroup:deleteIpGroupMember	-
GET /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:getIpGroup	-
GET /v1/{project_id}/address-items	cfw:ipGroup:listIpGroupMember	-
GET /v1/{project_id}/address-sets	cfw:ipGroup:listIpGroups	-
DELETE /v1/{project_id}/domain-set/domains/{set_id}	cfw:domainGroup:delete	-
GET /v1/{project_id}/service-items	cfw:serviceGroup:listServiceGroupMember	-
DELETE /v1/{project_id}/service-items/{item_id}	cfw:serviceGroup:deleteServiceGroupMember	-
POST /v1/{project_id}/black-white-list	cfw:blackWhiteList:create	-
DELETE /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:delete	-
POST /v1/{project_id}/firewalls/list	cfw:instance:listInstance	-
PUT /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:update	-
POST /v1/{project_id}/eip/protect	cfw:eip:updateProtectStatus	-
POST /v1/{project_id}/domain-set	cfw:domainGroup:create	-
GET /v1/{project_id}/firewall/exist	cfw:instance:getInstance	-
DELETE /v1/{project_id}/acl-rule	cfw:acl:deleteAclRule	-
GET /v1/{project_id}/domain/parse/{domain_name}	cfw:instance:listDomainParseServers	-
POST /v1/{project_id}/acl-rule/count	cfw:acl:listAclRules	-
DELETE /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:deleteIpGroup	-
POST /v1/{project_id}/domain-set/domains/{set_id}	cfw:domainGroup:create	-
GET /v1/{project_id}/service-sets	cfw:serviceGroup:list	-
GET /v2/{project_id}/cfw-acl/tags	cfw:acl:listAclTags	-
POST /v1/{project_id}/service-set	cfw:serviceGroup:create	-
DELETE /v1/{project_id}/service-items	cfw:serviceGroup:deleteServiceGroupMember	-
POST /v1/{project_id}/ips/switch	cfw:instance:updateIpsStatus	-
POST /v1/{project_id}/ips/protect	cfw:instance:updateIpsMode	-
GET /v1/{project_id}/service-sets/{set_id}	cfw:serviceGroup:get	-
DELETE /v1/{project_id}/acl-rule/count	cfw:acl:deleteHitCount	-
PUT /v1/{project_id}/address-sets/{set_id}	cfw:ipGroup:updateIpGroup	-
DELETE /v1/{project_id}/acl-rule/{acl_rule_id}	cfw:acl:deleteAclRule	-
PUT /v1/{project_id}/acl-rule/action	cfw:acl:updateAclRuleAction	-
POST /v1/{project_id}/address-set	cfw:ipGroup:createIpGroup	-
PUT /v1/{project_id}/black-white-list/{list_id}	cfw:blackWhiteList:update	-
DELETE /v1/{project_id}/address-items/{item_id}	cfw:ipGroup:deleteIpGroupMember	-
GET /v1/{project_id}/ips/switch	cfw:instance:getIpsStatus	-
PUT /v1/{project_id}/acl-rule/{acl_rule_id}	cfw:acl:updateAclRule	-
GET /v1/{project_id}/vpcs/protection	cfw:instance:listProtectedVpc	-
GET /v1/{project_id}/eip-count/{object_id}	cfw:eip:count	-
GET /v1/{project_id}/black-white-lists	cfw:blackWhiteList:list	-
GET /v1/{project_id}/eips/protect	cfw:eip:list	-
DELETE /v1/{project_id}/black-white-list/{list_id}	cfw:blackWhiteList:delete	-
GET /v1/{project_id}/acl-rules	cfw:acl:listAclRules	-
GET /v1/{project_id}/domain-set/domains/{domain_set_id}	cfw:domainGroup:list	-
POST /v1/{project_id}/acl-rule	cfw:acl:createAclRule	-
PUT /v1/{project_id}/acl-rule/order/{acl_rule_id}	cfw:acl:setPriority	-
POST /v1/{project_id}/address-items	cfw:ipGroup:createIpGroupMember	-
GET /v1/{project_id}/ips/protect	cfw:instance:getIpsMode	-
POST /v1/{project_id}/service-items	cfw:serviceGroup:createServiceGroupMember	-
GET /v1/{project_id}/cfw/logs/configuration	cfw:instance:getLogConfig	-
POST /v1/{project_id}/cfw/logs/configuration	cfw:instance:updateLogConfig	-
POST /v2/{project_id}/firewall	cfw:instance:createInstance	-
GET /v3/{project_id}/jobs/{job_id}	cfw:instance:listInstance	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for CFW.

**Table 3** Resource types supported by CFW
Resource Type	URN
blackWhiteList	cfw:<region>:<account-id>:blackWhiteList:<blackWhiteList-id>
acl	cfw:<region>:<account-id>:acl:<acl-id>
instance	cfw:<region>:<account-id>:instance:<fwInstance-id>
serviceGroup	cfw:<region>:<account-id>:serviceGroup:<serviceGroup-id>
domainGroup	cfw:<region>:<account-id>:domainGroup:<domainGroup-id>
ipGroup	cfw:<region>:<account-id>:ipGroup:<ipGroup-id>
eip	cfw:<region>:<account-id>:eip:<eip-id>

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cfw) apply only to operations of the xx service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by CFW

The following table lists the condition keys that you can define in identity policies for CFW. You can include these condition keys to specify conditions for when your identity policy is in effect.

**Table 4** Service-specific condition keys supported by CFW
Service-specific Condition Key	Type	Single-valued/Multivalued	Description
cfw:LogGroupId	string	Single-valued	Filters access based on the LTS log group ID in the request.

Conditions

Condition Key Overview

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, cfw) apply only to operations of the xx service. For details, see Table 5.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see operators.

Service-specific condition keys supported by CFW

The following table lists the condition keys that you can define in identity policies for CFW. You can include these condition keys to specify conditions for when your identity policy is in effect.