Cloud Certificate & Manager (CCM)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to a principal. They only set the permissions boundary for the principal. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM is different from Organizations for access control, see What Are the Differences in Access Control Between IAM and Organizations?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For details about how to use these elements to create an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to create a custom SCP, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in an identity policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify a URN for the Resource element in your identity policy statements.
- Required resources are marked with asterisks (*) in the table.
For details about the resource types defined by the PCA, see Table 3.
The Condition Key contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key only takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by PCA, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization. For details, see Policies and Identity Policies.

The following table lists the actions that you can define in identity policy statements for PCA.

**Table 1** Actions supported by PCA
Action	Description	Access Level	Resource Type (*: Required)	Condition Key	Alias
pca:ca:create	Grants the permission to create a private CA.	write	ca *	-	-
pca:ca:create	Grants the permission to create a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:delete	Grants the permission to delete a private CA.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:delete	Grants the permission to delete a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:disable	Grants the permission to disable a private CA.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:disable	Grants the permission to disable a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:enable	Grants the permission to enable a private CA.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:enable	Grants the permission to enable a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:export	Grants the permission to export a private CA certificate.	read	ca *	g:ResourceTag/<tag-key>	-
pca:ca:export	Grants the permission to export a private CA certificate.	read	-	g:EnterpriseProjectId	-
pca:ca:getCsr	Grants the permission to export the certificate signing request (CSR) of a private CA.	read	ca *	g:ResourceTag/<tag-key>	-
pca:ca:getCsr		read	-	g:EnterpriseProjectId	-
pca:ca:import	Grants the permission to import a certificate as a private CA certificate.	write	ca *	-	-
pca:ca:import		write	-	g:EnterpriseProjectId	-
pca:ca:activate	Grants the permission to activate a private CA.	write	ca *	g:ResourceTag/<tag-key>	pca:ca:active
pca:ca:activate	Grants the permission to activate a private CA.	write	-	g:EnterpriseProjectId	pca:ca:active
pca:ca:list	Grants the permission to query the private CA list.	list	ca *	-	-
pca:ca:list	Grants the permission to query the private CA list.	list	-	g:EnterpriseProjectId	-
pca:ca:restore	Grants the permission to restore a private CA.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:restore	Grants the permission to restore a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:revoke	Grants the permission to revoke a private CA.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:revoke	Grants the permission to revoke a private CA.	write	-	g:EnterpriseProjectId	-
pca:ca:get	Grants the permission to query private CA details.	read	ca *	g:ResourceTag/<tag-key>	-
pca:ca:get	Grants the permission to query private CA details.	read	-	g:EnterpriseProjectId	-
pca:ca:quota	Grants the permission to query the private CA quota.	read	-	-	-
pca:ca:createTag	Grants the permission to create or update tags for a private CA.	tagging	ca *	g:ResourceTag/<tag-key>	-
pca:ca:createTag		tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
pca:ca:deleteTag	Grants the permission to delete a private CA tag.	tagging	ca *	g:ResourceTag/<tag-key>	-
pca:ca:deleteTag	Grants the permission to delete a private CA tag.	tagging	-	g:EnterpriseProjectId g:TagKeys	-
pca:ca:listTags	Grants the permission to query the tag list of a private CA.	list	ca *	g:ResourceTag/<tag-key>	-
pca:ca:listTags		list	-	g:EnterpriseProjectId	-
pca:ca:listAllTags	Grants the permission to query the private CA tag list.	list	ca *	-	-
pca:ca:listByTag	Grants the permission to query the private CA list by tag.	list	ca *	-	-
pca:ca:listByTag	Grants the permission to query the private CA list by tag.	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
pca:ca:issueCert	Grants the permission to issue a private certificate.	write	ca *	-	-
pca:ca:issueCert	Grants the permission to issue a private certificate.	write	-	g:EnterpriseProjectId pca:CommonName	-
pca:ca:issueCertByCsr	Grants the permission to issue private certificates based on CSRs.	write	ca *	-	pca:ca:issueCertThroughCSR
pca:ca:issueCertByCsr		write	-	g:EnterpriseProjectId pca:CommonName	pca:ca:issueCertThroughCSR
pca:cert:delete	Grants the permission to delete a private certificate.	write	-	g:EnterpriseProjectId	-
pca:cert:export	Grants the permission to export a private certificate.	read	-	g:EnterpriseProjectId	-
pca:cert:list	Grants the permission to query the private certificate list.	list	-	g:EnterpriseProjectId	-
pca:ca:revokeCert	Grants the permission to revoke a private certificate.	write	ca *	g:ResourceTag/<tag-key>	pca:cert:revoke
pca:ca:revokeCert	Grants the permission to revoke a private certificate.	write	-	g:EnterpriseProjectId	pca:cert:revoke
pca:cert:get	Grants the permission to query private certificate details.	read	-	g:EnterpriseProjectId	-
pca:cert:quota	Grants the permission to query the private certificate quota.	read	-	-	-
pca:cert:createTag	Grants the permission to create or update private certificate tags.	tagging	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
pca:cert:deleteTag	Grants the permission to delete a private certificate tag.	tagging	-	g:EnterpriseProjectId g:TagKeys	-
pca:cert:listTags	Grants the permission to query the tag list of a private certificate.	list	-	g:EnterpriseProjectId	-
pca:cert:listAllTags	Grants the permission to query the private certificate tag list.	list	-	-	-
pca:cert:listByTag	Grants the permission to query the private certificate list by tag.	list	-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys	-
pca:ca:disableCrl	Grants the permission to disable CRLs.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:disableCrl	Grants the permission to disable CRLs.	write	-	g:EnterpriseProjectId	-
pca:ca:enableCrl	Grants the permission to enable CRLs.	write	ca *	g:ResourceTag/<tag-key>	-
pca:ca:enableCrl	Grants the permission to enable CRLs.	write	-	g:EnterpriseProjectId	-

Each API of PCA usually supports one or more actions. Table 2 lists the actions and dependencies supported by PCA APIs.

**Table 2** Actions and dependencies supported by PCA APIs
API	Action	Dependencies
POST /v1/private-certificate-authorities	pca:ca:create	-
POST /v1/private-certificate-authorities/order	pca:ca:create	-
DELETE /v1/private-certificate-authorities/{ca_id}	pca:ca:delete	-
POST /v1/private-certificate-authorities/{ca_id}/disable	pca:ca:disable	-
POST /v1/private-certificate-authorities/{ca_id}/enable	pca:ca:enable	-
POST /v1/private-certificate-authorities/{ca_id}/export	pca:ca:export	-
GET /v1/private-certificate-authorities/{ca_id}/csr	pca:ca:getCsr	-
POST /v1/private-certificate-authorities/{ca_id}/import	pca:ca:import	-
POST /v1/private-certificate-authorities/{ca_id}/activate	pca:ca:activate	-
GET /v1/private-certificate-authorities	pca:ca:list	-
POST /v1/private-certificate-authorities/{ca_id}/restore	pca:ca:restore	-
POST /v1/private-certificate-authorities/{ca_id}/revoke	pca:ca:revoke	-
GET /v1/private-certificate-authorities/{ca_id}	pca:ca:get	-
GET /v1/private-certificate-authorities/quotas	pca:ca:quota	-
POST /v1/private-certificate-authorities/{ca_id}/tags/create	pca:ca:createTag	-
DELETE /v1/private-certificate-authorities/{ca_id}/tags/delete	pca:ca:deleteTag	-
POST /v1/private-certificate-authorities/{ca_id}/tags	pca:ca:createTag	-
GET /v1/private-certificate-authorities/{ca_id}/tags	pca:ca:listTags	-
GET /v1/private-certificate-authorities/tags	pca:ca:listAllTags	-
POST /v1/private-certificate-authorities/resource-instances/filter	pca:ca:listByTag	-
POST /v1/private-certificates	pca:ca:issueCert	-
POST /v1/private-certificates/csr	pca:ca:issueCertByCsr	-
DELETE /v1/private-certificates/{certificate_id}	pca:cert:delete	-
POST /v1/private-certificates/{certificate_id}/export	pca:cert:export	-
GET /v1/private-certificates	pca:cert:list	-
POST /v1/private-certificates/{certificate_id}/revoke	pca:ca:revokeCert	-
GET /v1/private-certificates/{certificate_id}	pca:cert:get	-
GET /v1/private-certificates/quotas	pca:cert:quota	-
POST /v1/private-certificates/{certificate_id}/tags/create	pca:cert:createTag	-
DELETE /v1/private-certificates/{certificate_id}/tags/delete	pca:cert:deleteTag	-
POST /v1/private-certificates/{certificate_id}/tags	pca:cert:createTag	-
GET /v1/private-certificates/{certificate_id}/tags	pca:cert:listTags	-
GET /v1/private-certificates/tags	pca:cert:listAllTags	-
POST /v1/private-certificates/resource-instances/filter	pca:cert:listByTag	-
POST /v1/private-certificate-authorities/{ca_id}/crl/disable	pca:ca:disableCrl	-
POST /v1/private-certificate-authorities/{ca_id}/crl/enable	pca:ca:enableCrl	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 3, the resource URN must be specified in the identity policy using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for PCA.

**Table 3** Resource types supported by PCA
Resource Type	URN
ca	pca:<region>:<account-id>:ca:<ca-id>

Conditions

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, IAM automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name plus a colon as the prefix, for example, pca:) apply only to operations of the corresponding service. For details, see Table 4.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
A condition operator, a condition key, and a condition value together constitute a complete condition statement. An identity policy can be applied only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in identity policies for PCA. You can include these condition keys to specify conditions for when your identity policy is in effect.