Data Lake Insight(DLI)

IAM provides system-defined identity policies to define common actions supported by cloud services. You can also create custom identity policies using the actions supported by cloud services for more refined access control.

In addition to IAM, the Organizations service also provides Service Control Policies (SCPs) to set access control policies.

SCPs do not actually grant any permissions to an entity. They only set the permissions boundary for the entity. When SCPs are attached to a member account or an organizational unit (OU), they do not directly grant permissions to that member account or OU. Instead, the SCPs just determine what permissions are available for that member account or the member accounts under that OU. The granted IAM identity permissions can be applied only if they are allowed by the SCPs.

To learn more about how IAM policies are different from Organizations SCPs, see What Are the Differences Between IAM Policies and Organizations SCPs?

This section describes the elements used by IAM custom identity policies and Organizations SCPs. The elements include actions, resources, and conditions.

For how to use these elements to edit an IAM custom identity policy, see Creating a Custom Identity Policy.
For details about how to use these elements to edit a custom SCP policy, see Creating an SCP.

Actions

Actions are specific operations that are allowed or denied in an identity policy.

The Access Level column describes how the action is classified (List, Read, or Write). This classification helps you understand the level of access that an action grants when you use it in a policy.
The Resource Type column indicates whether the action supports resource-level permissions.
- You can use a wildcard (*) to indicate all resource types. If this column is empty (-), the action does not support resource-level permissions and you must specify all resources ("*") in your identity policy statements.
- If this column includes a resource type, you must specify the URN in the Resource element of your policy statements.
- Required resources are marked with asterisks (*) in the table. If you specify a resource in a statement using this action, then it must be of this type.
For details about the resource types defined by DLI, see Resources.
The Condition Key column contains keys that you can specify in the Condition element of an identity policy statement.
- If the Resource Type column has values for an action, the condition key takes effect only for the listed resource types.
- If the Resource Type column is empty (-) for an action, the condition key takes effect for all resources that action supports.
- If the Condition Key column is empty (-) for an action, the action does not support any condition keys.
For details about the condition keys defined by DLI, see Conditions.
The Alias column lists the policy actions that are configured in identity policies. With these actions, you can use APIs for policy-based authorization.
For details, see Policies and Identity Policies.

The following table lists the actions that you can define in custom identity policies for DLI.

**Table 1** Actions supported by DLI
Action	Description	Access Level	Resource Type (*: required)	Condition Key
dli::operateAuth	Grants the permission to manage DLI permissions.	permission_management	-	-
dli::listAuth	Grants the permission to query DLI permissions.	list	-	-
dli:variable:list	Grants the permission to list global variables.	list	variable *	-
dli:variable:create	Grants the permission to create global variables.	write	variable *	-
dli:variable:update	Grants the permission to update global variables.	write	variable *	-
dli:variable:delete	Grants the permission to delete global variables.	write	variable *	-
dli:catalog:list	Grants the permission to list data catalogs.	list	-	-
dli:catalog:bind	Grants the permission to bind data catalogs.	write	-	-
dli:catalog:get	Grants the permission to query data catalog details.	read	-	-
dli:queue:list	Grants the permission to list queues.	list	queue *	-
dli:queue:list	Grants the permission to list queues.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:queue:create	Grants the permission to create queues.	write	queue *	-
dli:queue:create	Grants the permission to create queues.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dli:queue:get	Grants the permission to query queue details.	read	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:update	Grants the permission to update queues.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:delete	Grants the permission to delete queues.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:scale	Grants the permission to scale out/in a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:checkConnection	Grants the permission to test the connectivity of an address.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:getConnection	Grants the permission to query connectivity results.	read	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:listPlans	Grants the permission to list scheduled scaling plans of a queue.	list	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:createPlan	Grants the permission to create scheduled scaling plans for a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:deletePlan	Grants the permission to delete scheduled scaling plans from a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:updatePlan	Grants the permission to update scheduled scaling plans for a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:createProperty	Grants the permission to create configurations for a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:listProperties	Grants the permission to list queue configurations.	list	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:updateProperty	Grants the permission to update configurations for a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:deleteProperty	Grants the permission to delete configurations from a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:jobs:list	Grants the permission to list jobs.	list	jobs *	-
dli:jobs:list	Grants the permission to list jobs.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:queue:submitJob	Grants the permission to submit jobs on a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:jobs:get	Grants the permission to query job details.	read	jobs *	g:ResourceTag/<tag-key>
dli:table:select	Grants the permission to query tables.	read	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:insertInto	Grants the permission to insert table data.	write	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:queue:cancelJob	Grants the permission to cancel jobs on a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:jobs:exportResult	Grants the permission to export job results.	read	jobs *	g:ResourceTag/<tag-key>
dli::checkSql	Grants the permission to verify the SQL syntax.	write	-	-
dli:database:list	Grants the permission to list databases.	list	database *	-
dli:database:list	Grants the permission to list databases.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:database:create	Grants the permission to create databases.	write	database *	-
dli:database:create	Grants the permission to create databases.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dli:database:update	Grants the permission to update databases.	write	database *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:database:delete	Grants the permission to delete databases.	write	database *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:database:displayAllTables	Grant the permission to display all tables in a database.	list	database *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:database:createTable	Grants the permission to create tables in a database.	write	database *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:update	Grants the permission to update tables.	write	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:describe	Grants the permission to display the table structure.	read	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:delete	Grants the permission to delete tables.	write	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:showPartitions	Grants the permission to display all partitions of a table.	read	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:sqldefendrule:create	Grants the permission to create SQL inspection rules.	write	-	-
dli:sqldefendrule:list	Grants the permission to list SQL inspection rules.	list	-	-
dli:sqldefendrule:update	Grants the permission to update SQL inspection rules.	write	-	-
dli:sqldefendrule:delete	Grants the permission to delete SQL inspection rules.	write	-	-
dli:sqldefendrule:get	Grants the permission to query details about SQL inspection rules.	read	-	-
dli:resource:create	Grants the permission to create resource packages.	write	resource *	-
dli:resource:create	Grants the permission to create resource packages.	write	-	g:RequestTag/<tag-key> g:TagKeys
dli:resource:get	Grants the permission to query resource package details.	read	resource *	g:ResourceTag/<tag-key>
dli:resource:delete	Grants the permission to delete resource packages.	write	resource *	g:ResourceTag/<tag-key>
dli:resource:list	Grants the permission to list resource packages.	list	resource *	-
dli:resource:list	Grants the permission to list resource packages.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:resource:update	Grants the permission to update resource packages.	write	resource *	g:ResourceTag/<tag-key>
dli:jobs:update	Grants the permission to update jobs.	write	jobs *	g:ResourceTag/<tag-key>
dli:jobs:delete	Grants the permission to delete jobs.	write	jobs *	g:ResourceTag/<tag-key>
dli:jobs:create	Grants the permission to create jobs.	write	jobs *	-
dli:jobs:create	Grants the permission to create jobs.	write	-	g:RequestTag/<tag-key> g:TagKeys
dli:jobs:startFlinkJob	Grants the permission to start a job.	write	jobs *	g:ResourceTag/<tag-key>
dli:jobs:stopFlinkJob	Grants the permission to stop a job.	write	jobs *	g:ResourceTag/<tag-key>
dli:jobs:export	Grants the permission to export jobs.	write	jobs *	g:ResourceTag/<tag-key>
dli::createEdgeChannel	Grants the permission to create IEF message channels.	write	-	-
dli::reportEdgeJob	Grants the permission to report statuses of Flink edge jobs.	write	-	-
dli::callbackEdgeJobAction	Grants the permission to call back action statuses of Flink edge jobs.	write	-	-
dli::createEdgeSystemEvent	Grants the permission to report IEF system events.	write	-	-
dli:template:list	Grants the permission to list templates.	list	template *	-
dli:template:create	Grants the permission to create templates.	write	template *	-
dli:template:update	Grants the permission to update templates.	write	template *	-
dli:template:delete	Grants the permission to delete templates.	write	template *	-
dli:template:get	Grants the permission to query template details.	read	template *	-
dli:elasticresourcepool:resourceManagement	Grants the permission to manage resources to an elastic resource pool.	write	elasticresourcepool *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:elasticresourcepool:list	Grants the permission to list elastic resource pools.	list	elasticresourcepool *	-
dli:elasticresourcepool:list	Grants the permission to list elastic resource pools.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:elasticresourcepool:create	Grants the permission to create elastic resource pools.	write	elasticresourcepool *	-
dli:elasticresourcepool:create	Grants the permission to create elastic resource pools.	write	-	g:RequestTag/<tag-key> g:TagKeys g:EnterpriseProjectId
dli:elasticresourcepool:update	Grants the permission to update elastic resource pools.	write	elasticresourcepool *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:elasticresourcepool:delete	Grants the permission to delete elastic resource pools.	write	elasticresourcepool *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:elasticresourcepool:scale	Grants the permission to scale out/in an elastic resource pool.	list	elasticresourcepool *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli::createLakehouse	Grants the permission to create lakehouses.	write	-	-
dli::getLakehouse	Grants the permission to query lakehouses.	read	-	-
dli:connection:list	Grants the permission to list basic datasource connections.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli:connection:create	Grants the permission to create basic datasource connections.	write	-	g:RequestTag/<tag-key> g:TagKeys
dli:connection:get	Grants the permission to query basic datasource connections.	read	-	-
dli:connection:delete	Grants the permission to delete basic datasource connections.	write	-	-
dli:edsconnection:get	Grants the permission to query details about an enhanced datasource connection.	read	edsconnection *	g:ResourceTag/<tag-key>
dli:edsconnection:update	Grants the permission to update enhanced datasource connections.	write	edsconnection *	g:ResourceTag/<tag-key>
dli:edsconnection:delete	Grants the permission to delete enhanced datasource connections.	write	edsconnection *	g:ResourceTag/<tag-key>
dli:edsconnection:list	Grants the permission to list enhanced datasource connections.	list	edsconnection *	-
dli:edsconnection:list		list	-	g:RequestTag/<tag-key> g:TagKeys
dli:edsconnection:create	Grants the permission to create enhanced datasource connections.	write	edsconnection *	-
dli:edsconnection:create		write	-	g:RequestTag/<tag-key> g:TagKeys dli:VpcId
dli:edsconnection:unbindQueue	Grants the permission to unbind an enhanced datasource connection from a queue.	write	edsconnection *	g:ResourceTag/<tag-key>
dli:edsconnection:bindQueue	Grants the permission to bind an enhanced datasource connection to a queue.	write	edsconnection *	g:ResourceTag/<tag-key>
dli:datasourceauth:list	Grants the permission to list datasource authentication connections.	list	datasourceauth *	-
dli:datasourceauth:update	Grants the permission to update security authentication information.	write	datasourceauth *	-
dli:datasourceauth:create	Grants the permission to create security authentication information.	write	datasourceauth *	-
dli:datasourceauth:delete	Grants the permission to delete security authentication information.	write	datasourceauth *	-
dli:edsconnection:deleteRoute	Grants the permission to delete routes from enhanced datasource connections.	write	edsconnection *	g:ResourceTag/<tag-key>
dli:edsconnection:createRoute	Grants the permission to create routes for enhanced datasource connections.	write	edsconnection *	g:ResourceTag/<tag-key>
dli::getQuota	Grants the permission to query quotas.	read	-	-
dli:queue:restart	Grants the permission to restart a queue.	write	queue *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:table:insertOverwriteTable	Grants the permission to overwrite data to a table.	write	table *	g:ResourceTag/<tag-key> g:EnterpriseProjectId
dli:catalog:unbind	Grants the permission to unbind data catalogs.	write	-	-
dli::listTags	Grants the permission to list tags.	list	-	-
dli::listResourcesByTag	Grants the permission to query resources by tag.	list	-	g:RequestTag/<tag-key> g:TagKeys
dli::unTagResource	Grants the permission to delete tags.	tagging	queue	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			resource	g:ResourceTag/<tag-key>
			database	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			elasticresourcepool	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			edsconnection	g:ResourceTag/<tag-key>
			jobs	g:ResourceTag/<tag-key>
			-	g:RequestTag/<tag-key> g:TagKeys
dli::listTagsForResource	Grants the permission to query the tags of a specified resource.	list	queue	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			resource	g:ResourceTag/<tag-key>
			database	g:EnterpriseProjectId g:ResourceTag/<tag-key>
			elasticresourcepool	g:ResourceTag/<tag-key> g:EnterpriseProjectId
			edsconnection	g:ResourceTag/<tag-key>
			jobs	g:ResourceTag/<tag-key>
dli::createDownloader	Grants the permission to create download tasks.	write	-	-

Each API of DLI usually supports one or more actions. Table 2 lists the actions and dependencies supported by DLI APIs.

**Table 2** Actions and dependencies supported by open DLI APIs
API	Action	Dependency
PUT /v1.0/{project_id}/queues/user-authorization	dli::operateAuth	-
PUT /v1.0/{project_id}/user-authorization	dli::operateAuth	-
GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/users	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/users/{user_name}	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/users	dli::listAuth	-
GET /v1.0/{project_id}/queues/{queue_name}/users	dli::listAuth	-
GET /v1.0/{project_id}/authorization/privileges	dli::listAuth	-
PUT /v1.0/{project_id}/authorization	dli::operateAuth	-
GET /v1.0/{project_id}/variables	dli:variable:list	-
POST /v1.0/{project_id}/variables	dli:variable:create	-
PUT /v1.0/{project_id}/variables/{var_name}	dli:variable:update	-
DELETE /v1.0/{project_id}/variables/{var_name}	dli:variable:delete	-
GET /v3/{project_id}/catalogs	dli:catalog:list	-
POST /v3/{project_id}/catalogs/action	dli:catalog:bind	dli:catalog:unbind
GET /v3/{project_id}/catalogs/{catalog_name}	dli:catalog:get	-
GET /v1.0/{project_id}/queues	dli:queue:list	-
POST /v1.0/{project_id}/queues	dli:queue:create	-
GET /v1.0/{project_id}/queues/{queue_name}	dli:queue:get	-
PUT /v1.0/{project_id}/queues/{queue_name}	dli:queue:update	-
DELETE /v1.0/{project_id}/queues/{queue_name}	dli:queue:delete	-
PUT /v1.0/{project_id}/queues/{queue_name}/action	dli:queue:scale	dli:queue:restart
POST /v1.0/{project_id}/queues/{queue_name}/connection-test	dli:queue:checkConnection	-
GET /v1.0/{project_id}/queues/{queue_name}/connection-test/{task_id}	dli:queue:getConnection	-
GET /v1/{project_id}/queues/{queue_name}/plans	dli:queue:listPlans	-
POST /v1/{project_id}/queues/{queue_name}/plans	dli:queue:createPlan	-
POST /v1/{project_id}/queues/{queue_name}/plans/batch-delete	dli:queue:deletePlan	-
PUT /v1.0/{project_id}/queues/{queue_name}	dli:queue:updatePlan	-
DELETE /v1/{project_id}/queues/{queue_name}/plans/{plan_id}	dli:queue:deletePlan	-
POST /v3/{project_id}/queues/{queue_name}/properties	dli:queue:createProperty	-
GET /v3/{project_id}/queues/{queue_name}/properties	dli:queue:listProperties	-
PUT /v3/{project_id}/queues/{queue_name}/properties	dli:queue:updateProperty	-
DELETE /v3/{project_id}/queues/{queue_name}/properties	dli:queue:deleteProperty	-
GET /v1.0/{project_id}/jobs	dli:jobs:list	-
POST /v1.0/{project_id}/jobs/submit-job	dli:queue:submitJob	-
GET /v1.0/{project_id}/jobs/{job_id}/status	dli:jobs:get	-
GET /v1.0/{project_id}/jobs/{job_id}/detail	dli:jobs:get	-
DELETE /v1.0/{project_id}/jobs/{job_id}	dli:queue:cancelJob	-
GET /v1.0/{project_id}/jobs/{job_id}/preview	dli:jobs:get	-
POST /v1.0/{project_id}/jobs/check-sql	dli::checkSql	-
GET /v1/{project_id}/jobs/{job_id}/progress	dli:jobs:get	-
POST /v1/{project_id}/sql-defend-rules	dli:sqldefendrule:create	-
GET /v1/{project_id}/sql-defend-rules	dli:sqldefendrule:list	-
PUT /v1/{project_id}/sql-defend-rules/{rule_id}	dli:sqldefendrule:update	-
DELETE /v1/{project_id}/sql-defend-rules/{rule_id}	dli:sqldefendrule:delete	-
GET /v1/{project_id}/sql-defend-rules/{rule_id}	dli:sqldefendrule:get	-
POST /v1.0/{project_id}/streaming/jobs/{job_id}/import-savepoint	dli:jobs:update	-
POST /v1.0/{project_id}/streaming/jobs/{job_id}/savepoint	dli:jobs:update	-
GET /v1.0/{project_id}/streaming/jobs/{job_id}	dli:jobs:get	-
DELETE /v1.0/{project_id}/streaming/jobs/{job_id}	dli:jobs:delete	-
GET /v1.0/{project_id}/streaming/jobs	dli:jobs:list	-
POST /v1.0/{project_id}/streaming/sql-jobs	dli:jobs:create	-
PUT /v1.0/{project_id}/streaming/sql-jobs/{job_id}	dli:jobs:update	-
POST /v1.0/{project_id}/streaming/flink-jobs	dli:jobs:create	-
PUT /v1.0/{project_id}/streaming/flink-jobs/{job_id}	dli:jobs:update	-
POST /v1.0/{project_id}/streaming/jobs/run	dli:jobs:startFlinkJob	dli:queue:submitJob
POST /v1.0/{project_id}/streaming/jobs/stop	dli:jobs:stopFlinkJob	dli:queue:cancelJob
POST /v1.0/{project_id}/streaming/jobs/delete	dli:jobs:delete	-
GET /v1.0/{project_id}/streaming/jobs/{job_id}/execute-graph	dli:jobs:get	-
POST /v1.0/{project_id}/streaming/jobs/export	dli:jobs:export	-
POST /v1.0/{project_id}/streaming/jobs/import	dli:jobs:create	-
POST /v3/{project_id}/streaming/jobs/{job_id}/gen-graph	dli:jobs:get	-
GET /v1.0/{project_id}/streaming/job-templates	dli:template:list	-
POST /v1.0/{project_id}/streaming/job-templates	dli:template:create	-
PUT /v1.0/{project_id}/streaming/job-templates/{template_id}	dli:template:update	-
DELETE /v1.0/{project_id}/streaming/job-templates/{template_id}	dli:template:delete	-
POST /v1.0/{project_id}/sqls	dli:template:create	-
GET /v1.0/{project_id}/sqls	dli:template:list	-
GET /v1.0/{project_id}/sqls/sample	dli:template:list	-
PUT /v1.0/{project_id}/sqls/{template_id}	dli:template:update	-
POST /v1.0/{project_id}/sqls-deletion	dli:template:delete	-
POST /v3/{project_id}/templates	dli:template:create	-
GET /v3/{project_id}/templates	dli:template:list	-
PUT /v3/{project_id}/templates/{template_id}	dli:template:update	-
GET /v3/{project_id}/templates/{template_id}	dli:template:get	-
GET /v2.0/{project_id}/batches	dli:jobs:list	-
POST /v2.0/{project_id}/batches	dli:queue:submitJob	-
GET /v2.0/{project_id}/batches/{batch_id}	dli:jobs:get	-
DELETE /v2.0/{project_id}/batches/{batch_id}	dli:queue:cancelJob	-
GET /v2.0/{project_id}/batches/{batch_id}/log	dli:jobs:get	-
GET /v2.0/{project_id}/batches/{batch_id}/state	dli:jobs:get	-
POST /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/notebook/action	dli:elasticresourcepool:resourceManagement	-
POST /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/notebook/instances	dli:elasticresourcepool:resourceManagement	-
GET /v3/{project_id}/elastic-resource-pools	dli:elasticresourcepool:list	-
POST /v3/{project_id}/elastic-resource-pools	dli:elasticresourcepool:create	-
PUT /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}	dli:elasticresourcepool:update	-
DELETE /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}	dli:elasticresourcepool:delete	-
GET /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/queues	dli:elasticresourcepool:resourceManagement	-
POST /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/queues	dli:elasticresourcepool:resourceManagement	dli:queue:create dli:queue:delete
PUT /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/queues/{queue_name}	dli:elasticresourcepool:resourceManagement	-
GET /v3/{project_id}/elastic-resource-pools/{elastic_resource_pool_name}/scale-records	dli:elasticresourcepool:scale	-
POST /v3/{project_id}/orders/elastic-resource-pools	dli:elasticresourcepool:create	-
POST /v3/{project_id}/orders/elastic-resource-pools/specification-change	dli:elasticresourcepool:scale	-
POST /v3/{project_id}/lakehouse	dli::createLakehouse	-
GET /v3/{project_id}/lakehouse	dli::getLakehouse	-
GET /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}	dli:edsconnection:get	-
PUT /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}	dli:edsconnection:update	-
DELETE /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}	dli:edsconnection:delete	-
GET /v2.0/{project_id}/datasource/enhanced-connections	dli:edsconnection:list	-
POST /v2.0/{project_id}/datasource/enhanced-connections	dli:edsconnection:create	-
POST /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}/disassociate-queue	dli:edsconnection:unbindQueue	-
POST /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}/associate-queue	dli:edsconnection:bindQueue	-
GET /v2.0/{project_id}/datasource/enhanced-connections/{connection_id}/privileges	dli::listAuth	-
GET /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:list	-
PUT /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:update	-
POST /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:create	-
DELETE /v3/{project_id}/datasource/auth-infos/{auth_info_name}	dli:datasourceauth:delete	-
POST /v3/{project_id}/datasource/enhanced-connections/{connection_id}/routes	dli:edsconnection:deleteRoute	-
DELETE /v3/{project_id}/datasource/enhanced-connections/{connection_id}/routes/{name}	dli:edsconnection:createRoute	-
GET /v3/{project_id}/quotas	dli::getQuota	-
GET /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:list	-
PUT /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:update	-
POST /v3/{project_id}/datasource/auth-infos	dli:datasourceauth:create	-
DELETE /v3/{project_id}/datasource/auth-infos/{auth_info_name}	dli:datasourceauth:delete	-
POST /v3/{project_id}/datasource/enhanced-connections/{connection_id}/routes	dli:edsconnection:createRoute	-
DELETE /v3/{project_id}/datasource/enhanced-connections/{connection_id}/routes/{name}	dli:edsconnection:deleteRoute	-
GET /v3/{project_id}/{resource_type}/tags	dli::listTags	-
POST /v3/{project_id}/{resource_type}/resource-instances/filter	dli::listResourcesByTag	-
POST /v3/{project_id}/{resource_type}/resource-instances/count	dli::listResourcesByTag	-
POST /v3/{project_id}/{resource_type}/{resource_id}/tags/delete	dli::unTagResource	-
GET /v3/{project_id}/{resource_type}/{resource_id}/tags	dli::listTagsForResource	-

**Table 3** Actions and dependencies supported by DLI console APIs
API	Action	Dependency
GET /v1.0/{project_id}/logs/transfer	dli::getLogTransfer	-
POST /v1.0/{project_id}/logs/history	dli::getLog	-
POST /v1.0/{project_id}/logs/runtime	dli::getLog	-
GET /v1.0/{project_id}/logs/pods	dli::getLog	-
GET /v1.0/{project_id}/logs/pods/{pod_name}	dli::getLog	-
PUT /v1.0/{project_id}/databases/{database_name}/name	dli:database:update	-
POST /v1/{project_id}/streaming/jobs/check	dli:jobs:check	-
POST /v1/{project_id}/streaming/sql/validate	dli::checkSql	-
GET /v1/{project_id}/streaming/jobs/{job_id}/log	dli:jobs:get	-
GET /v1/{project_id}/streaming/jobs/{job_id}/log/{tm_id}	dli:jobs:get	-
GET /v1/{project_id}/streaming/jobs/{job_id}/submitlog	dli:jobs:get	-
POST /v1/{project_id}/streaming/templates/check	dli:template:check	-
GET /v1.0/{project_id}/databases/{database_name}/projects	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/projects	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/projects/{projectId}	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/projects/{projectId}	dli::listAuth	-
GET /v1.0/{project_id}/databases/{database_name}/tables/{table_name}/columns/{column_name}/projects/{projectId}	dli::listAuth	-
POST /v1.0/{project_id}/logs/transfer	dli::createLogTransfer	-
POST /v1.0/{project_id}/orders/queues	dli:queue:create	-
PUT /v1.0/{project_id}/orders/queues	dli:queue:scale	-
PUT /v3/{project_id}/queues/{queue_name}/scale-range	dli:queue:scale	-

Resources

A resource type indicates the resources that an identity policy applies to. If you specify a resource type for any action in Table 4, the resource URN must be specified in the identity policy statements using that action, and the identity policy applies only to resources of this type. If no resource type is specified, the Resource element is marked with an asterisk (*) and the identity policy applies to all resources. You can also set condition keys in an identity policy to define resource types.

The following table lists the resource types that you can define in identity policy statements for DLI.

**Table 4** Resource types supported by DLI
Resource Type	URN
variable	dli:<region>:<account-id>:variable:<variable-name-with-prefix>
queue	dli:<region>:<account-id>:queue:<queue-name-with-prefix>
jobs	dli:<region>:<account-id>:jobs:<job-id-with-prefix>
table	dli:<region>:<account-id>:table:<table-name-with-prefix>
database	dli:<region>:<account-id>:database:<database-name-with-prefix>
resource	dli:<region>:<account-id>:resource:<resource-name-with-prefix>
template	dli:<region>:<account-id>:template:<template-name-with-prefix>
elasticresourcepool	dli:<region>:<account-id>:elasticresourcepool:<elasticresourcepool-name-with-prefix>
edsconnection	dli:<region>:<account-id>:edsconnection:<edsconnection-id-with-prefix>
datasourceauth	dli:<region>:<account-id>:datasourceauth:<datasourceauth-name-with-prefix>

Conditions

A Condition element lets you specify conditions for when an identity policy is in effect. It contains condition keys and operators.

The condition key that you specify can be a global condition key or a service-specific condition key.
- Global condition keys (with the g: prefix) apply to all actions. Cloud services do not need to provide user identity information. Instead, the system automatically obtains such information and authenticates users. For details, see Global Condition Keys.
- Service-specific condition keys (with the abbreviation of a service name as the prefix, for example, dli:) apply only to DLI operations. For details, see Table 5.
- The number of values associated with a condition key in the request context of an API call makes the condition key single-valued or multivalued. Single-valued condition keys have at most one value in the request context of an API call. Multivalued condition keys can have multiple values in the request context of an API call. For example, a request can originate from at most one VPC endpoint, so g:SourceVpce is a single-valued condition key. You can tag resources and include multiple tag key-value pairs in a request, so g:TagKeys is a multivalued condition key.
An operator, a condition key, and a condition value together constitute a complete condition statement. An identity policy becomes in effect only when its request conditions are met. For supported condition operators, see Condition operators.

The following table lists the condition keys that you can define in custom identity policies for DLI. You can include these condition keys to specify conditions for when your identity policy is in effect.