# 应用管理与运维平台 ServiceStage 云服务在IAM预置了常用授权项，称为系统身份策略。如果IAM系统身份策略无法满足授权要求，管理员可以根据各服务支持的授权项，创建IAM自定义身份策略来进行精细的访问控制，IAM自定义身份策略是对系统身份策略的扩展和补充。 除IAM服务外，[Organizations](https://support.huaweicloud.com/productdesc-organizations/org_01_0011.html)服务中的[服务控制策略](https://support.huaweicloud.com/usermanual-organizations/org_03_0065.html)（Service Control Policies，以下简称SCP）也可以使用这些授权项元素设置访问控制策略。 SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。IAM策略授予权限的有效性受SCP限制，只有在SCP允许范围内的权限才能生效。 IAM服务与Organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参考[IAM服务与Organizations服务权限访问控制的区别](https://support.huaweicloud.com/organizations_faq/org_06_0004.html)。 本章节介绍IAM服务身份策略授权场景中自定义身份策略和组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。 - 如何使用这些元素编辑IAM自定义策略，请参考考[创建自定义身份策略](https://support.huaweicloud.com/usermanual-iam5/iam_01_0917.html)。 - 如何使用这些元素编辑SCP自定义策略，请参考[创建SCP](https://support.huaweicloud.com/usermanual-organizations/org_03_0035.html)。 #### 操作（Action） 操作（Action）即为身份策略中支持的授权项。 - **"访问级别"**列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。 - **"资源类型"** 列指每个操作是否支持资源级权限。 - 资源类型支持通配符号\*表示所有。如果此列没有值（-），则必须在策略语句的Resource元素中指定所有资源类型（"\*"）。 - 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。 - 资源类型列中必需资源在表中用星号（\*）标识，表示使用此操作必须指定该资源类型。 关于ServiceStage定义的资源类型的详细信息请参见[资源类型（Resource）]。 - **"条件键"** 列包括了可以在身份策略语句的Condition元素中支持指定的键值。 - 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。 - 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。 - 如果此列条件键没有值（-），表示此操作不支持指定条件键。 关于ServiceStage定义的条件键的详细信息请参见[条件（Condition）]。 - "**别名** "列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的API访问。详细信息请参见[身份策略兼容性说明](https://support.huaweicloud.com/iam5_faq/iam_01_1103.html)。 您可以在身份策略语句的Action元素中指定以下ServiceStage的相关操作。 表1ServiceStage支持的授权项 | 授权项 | 描述 | 访问级别 | 资源类型（\*为必须） | 条件键 | 别名 | |:---|:---|:---|:---|:---|:---| | servicestage:app:getApplication | 授予用户查看指定应用权限 | read | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:get | | servicestage:app:createApplication | 授予用户创建应用权限 | write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:create | | servicestage:app:createApplication | 授予用户创建应用权限 | write | app \* | - | servicestage:app:create | | servicestage:app:modifyApplication | 授予用户更新应用权限 | write | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:modifyApplication | 授予用户更新应用权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:deleteApplication | 授予用户删除应用权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:delete | | servicestage:app:listApplication | 授予用户查看应用列表权限 | list | - | - | servicestage:app:list | | servicestage:app:getConfiguration | 授予用户查看应用配置权限 | read | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:get | | servicestage:app:deleteConfiguration | 授予用户删除应用配置权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:modifyConfiguration | 授予用户更新应用配置权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:getComponent | 授予用户查看指定应用组件权限 | read | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:get | | servicestage:app:createComponent | 授予用户创建应用组件权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:create | | servicestage:app:modifyComponent | 授予用户更新应用组件权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:deleteComponent | 授予用户删除应用组件权限 | write | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:delete | | servicestage:app:listComponent | 授予用户查看应用组件列表权限 | list | - | - | servicestage:app:list | | servicestage::approveContract | 授予用户审批合同的权限 | write | - | - | servicestage:app:approve | | servicestage::createEventReport | 授予用户创建事件上报权限 | write | - | - | servicestage:app:create | | servicestage:app:createGovernanceRule | 授予用户创建治理规则权限 | write | app \* | - | servicestage:app:create | | servicestage:app:deleteGovernanceRule | 授予用户删除治理规则权限 | write | app \* | - | servicestage:app:delete | | servicestage:app:getGovernanceRule | 授予用户获取治理规则权限 | read | app \* | - | servicestage:app:get | | servicestage:app:listGovernanceRule | 授予用户获取治理规则列表权限 | list | app \* | - | servicestage:app:list | | servicestage:app:modifyGovernanceRule | 授予用户修改治理规则权限 | write | app \* | - | servicestage:app:modify | | servicestage:app:createRoute | 授予用户创建组件路由权限 | write | app \* | - | servicestage:app:create | | servicestage:app:deleteRoute | 授予用户删除组件路由权限 | write | app \* | - | servicestage:app:delete | | servicestage:app:modifyRoute | 授予用户修改组件路由权限 | write | app \* | - | servicestage:app:modify | | servicestage:environment:create | 授予用户创建环境权限 | write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:create | 授予用户创建环境权限 | write | environment \* | - | - | | servicestage:environment:get | 授予用户查看环境信息权限 | read | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:get | | servicestage:environment:list | 授予用户查看环境列表权限 | list | - | - | servicestage:app:list | | servicestage:environment:modify | 授予用户更新环境权限 | write | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:modify | 授予用户更新环境权限 | write | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:delete | 授予用户删除环境权限 | write | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:refresh | 授予用户刷新环境权限 | write | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:tag | 授予TMS用户创建环境标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:environment:modify | | servicestage:environment:tag | 授予TMS用户创建环境标签权限 | tagging | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:environment:modify | | servicestage:app:tag | 授予TMS用户创建应用标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:tag | 授予TMS用户创建应用标签权限 | tagging | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:environment:listResourcesByTag | 授予TMS用户通过标签查询环境资源权限 | read | - | - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:list | | servicestage:environment:listResourcesByTag | 授予TMS用户通过标签查询环境资源权限 | read | environment \* | - | servicestage:app:list | | servicestage:app:listResourcesByTag | 授予TMS用户通过标签查询应用资源权限 | read | - | - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:list | | servicestage:app:listResourcesByTag | 授予TMS用户通过标签查询应用资源权限 | read | app \* | - | servicestage:app:list | | servicestage:environment:unTagResource | 授予TMS用户删除环境资源标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:environment:modify | | servicestage:environment:unTagResource | 授予TMS用户删除环境资源标签权限 | tagging | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:environment:modify | | servicestage:app:unTagResource | 授予TMS用户删除应用资源标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:app:unTagResource | 授予TMS用户删除应用资源标签权限 | tagging | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:modify | | servicestage:environment:listTags | 授予TMS用户查询环境资源标签列表权限 | read | - | - | servicestage:app:list | | servicestage:app:listTags | 授予TMS用户查询应用资源标签列表权限 | read | - | - | servicestage:app:list | | servicestage:environment:createAddon | 授予用户创建插件权限 | write | environment \* | - | servicestage:app:create | | servicestage:environment:listAddon | 授予用户查询插件列表权限 | list | environment \* | - | servicestage:app:list | | servicestage:environment:getAddon | 授予用户查询插件详情权限 | read | environment \* | - | servicestage:app:get | | servicestage:environment:modifyAddon | 授予用户修改插件权限 | write | environment \* | - | servicestage:app:modify | | servicestage:environment:deleteAddon | 授予用户删除插件权限 | write | environment \* | - | servicestage:app:delete | | servicestage:environment:createCell | 授予用户创建部署单元权限 | write | environment \* | - | servicestage:app:create | | servicestage:environment:deleteCell | 授予用户删除部署单元权限 | write | environment \* | - | servicestage:app:delete | | servicestage:environment:listCell | 授予用户获取部署单元列表权限 | list | environment \* | - | servicestage:app:list | | servicestage:environment:modifyCell | 授予用户修改部署单元权限 | write | environment \* | - | servicestage:app:modify | | servicestage:environment:provisionResources | 授予用户开通环境资源权限 | write | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:environment:rollback | 授予用户回滚环境权限 | write | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage::createLaneGroup | 授予用户创建泳道组权限 | write | - | - | servicestage:app:create | | servicestage::getLaneGroup | 授予用户查询泳道组权限 | read | - | - | servicestage:app:get | | servicestage::listLaneGroup | 授予用户获取所有泳道组权限 | list | - | - | servicestage:app:list | | servicestage::modifyLaneGroup | 授予用户根据泳道组ID修改泳道组权限 | write | - | - | servicestage:app:modify | | servicestage::deleteLaneGroup | 授予用户根据泳道组ID删除泳道组权限 | write | - | - | servicestage:app:delete | | servicestage::createLane | 授予用户泳道组下创建泳道权限 | write | - | - | servicestage:app:create | | servicestage::getLane | 授予用户根据泳道ID获取泳道信息权限 | read | - | - | servicestage:app:get | | servicestage::listLane | 授予用户获取泳道组下所有泳道权限 | list | - | - | servicestage:app:list | | servicestage::modifyLane | 授予用户根据泳道ID修改泳道信息权限 | write | - | - | servicestage:app:modify | | servicestage::deleteLane | 授予用户根据泳道ID删除泳道权限 | write | - | - | servicestage:app:delete | | servicestage:config:createGroup | 授予用户创建配置分组权限 | write | - | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:createGroup | 授予用户创建配置分组权限 | write | configGroup \* | - | - | | servicestage:config:getGroup | 授予用户根据配置分组ID获取分组详情权限 | read | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:modifyGroup | 授予用户修改配置分组权限 | write | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:modifyGroup | 授予用户修改配置分组权限 | write | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:listGroup | 授予用户获取配置分组权限 | list | - | - | - | | servicestage:config:deleteGroup | 授予用户根据配置分组ID删除分组权限 | write | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:configGroup:listResourcesByTag | 授予TMS用户通过标签查询配置分组资源权限 | list | - | [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:list | | servicestage:configGroup:listResourcesByTag | 授予TMS用户通过标签查询配置分组资源权限 | list | configGroup \* | - | servicestage:configGroup:list | | servicestage:configGroup:listTags | 授予TMS用户查询配置分组资源标签列表权限 | read | - | - | servicestage:configGroup:list | | servicestage:configGroup:listTagsForResource | 授予eps用户查询配置分组资源标签列表权限 | read | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:list | | servicestage:configGroup:tag | 授予TMS用户创建配置分组标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:modify | | servicestage:configGroup:tag | 授予TMS用户创建配置分组标签权限 | tagging | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:modify | | servicestage:configGroup:unTagResource | 授予TMS用户删除配置分组资源标签权限 | tagging | - | - [g:RequestTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:TagKeys](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:modify | | servicestage:configGroup:unTagResource | 授予TMS用户删除配置分组资源标签权限 | tagging | configGroup \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:configGroup:modify | | servicestage:config:get | 授予用户根据配置文件ID获取配置文件信息权限 | read | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:list | 授予用户获取配置文件信息权限 | list | - | - | - | | servicestage:config:create | 授予用户创建配置文件权限 | write | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:modify | 授予用户根据配置文件ID修改配置文件权限 | write | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:delete | 授予用户根据配置文件ID删除配置文件权限 | write | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:import | 授予用户导入配置文件权限 | write | - | - | - | | servicestage:config:listHistories | 授予用户根据配置文件ID获取配置文件历史权限 | list | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:getHistory | 授予用户根据配置文件历史ID获取配置文件历史信息权限 | read | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage:config:deleteHistory | 授予用户根据配置文件历史ID删除配置文件历史权限 | write | config \* | [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | - | | servicestage::getRuntimeStack | 授予用户根据技术栈ID查询技术栈权限 | read | - | - | servicestage:runtimestack:get | | servicestage::createRuntimeStack | 授予用户创建技术栈权限 | write | - | - | servicestage:runtimestack:create | | servicestage::modifyRuntimeStack | 授予用户根据技术栈ID修改技术栈权限 | write | - | - | servicestage:runtimestack:modify | | servicestage::deleteRuntimeStack | 授予用户根据技术栈ID删除技术栈权限 | write | - | - | servicestage:runtimestack:delete | | servicestage::switchRuntimeStackStatus | 授予用户发布和取消发布技术栈权限 | write | - | - | servicestage:runtimestack:switchStatus | | servicestage::createReleasePlan | 授予用户创建发布单权限 | write | - | - | servicestage:app:create | | servicestage::getReleasePlan | 授予用户根据发布单ID获取发布单信息权限 | read | - | - | servicestage:app:get | | servicestage::listReleasePlan | 授予用户获取发布单列表权限 | list | - | - | servicestage:app:list | | servicestage::modifyReleasePlan | 授予用户根据发布单ID编辑发布单权限 | write | - | - | servicestage:app:modify | | servicestage::deleteReleasePlan | 授予用户根据发布单ID删除发布单权限 | write | - | - | servicestage:app:delete | | servicestage:pipeline:get | 授予用户查看流水线权限 | read | pipeline \* | - | - | | servicestage:pipeline:create | 授予用户创建流水线权限 | write | pipeline \* | - | - | | servicestage:pipeline:modify | 授予用户更新流水线权限 | write | pipeline \* | - | servicestage:pipeline:execute | | servicestage:pipeline:delete | 授予用户删除流水线权限 | write | pipeline \* | - | - | | servicestage:pipeline:list | 授予用户查看流水线列表权限 | list | - | - | - | | servicestage:assembling:runtimeList | 授予用户查看技术栈列表权限 | read | - | - | servicestage:assembling:get | | servicestage:assembling:getInfo | 授予用户查看构建信息权限 | read | assembling \* | - | servicestage:assembling:get | | servicestage:assembling:create | 授予用户创建构建任务权限 | write | assembling \* | - | - | | servicestage:assembling:modify | 授予用户更新构建任务权限 | write | assembling \* | - | - | | servicestage:assembling:delete | 授予用户删除构建任务权限 | write | assembling \* | - | - | | servicestage:assembling:list | 授予用户查看构建任务列表权限 | list | - | - | - | | servicestage:repositoryAuth:list | 授予用户获取仓库授权列表权限 | list | - | - | servicestage:app:list | | servicestage:repositoryAuth:get | 授予用户获取仓库授权权限 | read | repositoryAuth \* | - | servicestage:app:get | | servicestage:repositoryAuth:create | 授予用户创建仓库授权权限 | write | repositoryAuth \* | - | servicestage:app:create | | servicestage:repositoryAuth:delete | 授予用户删除仓库授权权限 | write | repositoryAuth \* | - | servicestage:app:delete | | servicestage:environment:listTagsForResource | 授予eps用户查询环境资源标签列表权限 | read | environment \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:list | | servicestage:app:listTagsForResource | 授予eps用户查询应用资源标签列表权限 | read | app \* | - [g:EnterpriseProjectId](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) - [g:ResourceTag/\](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html) | servicestage:app:list | ServiceStage的API通常对应着一个或多个授权项。[表2]展示了API与授权项的关系，以及该API需要依赖的授权项。 表2API与授权项的关系 | API | 对应的授权项 | 依赖的授权项 | |:---|:---|:---| | POST /v3/{project_id}/cas/environments | servicestage:environment:create | - | | GET /v3/{project_id}/cas/environments | servicestage:environment:list | - | | PUT /v3/{project_id}/cas/environments/{environment_id} | servicestage:environment:modify | - | | DELETE /v3/{project_id}/cas/environments/{environment_id} | servicestage:environment:delete | - | | GET /v3/{project_id}/cas/environments/{environment_id} | servicestage:environment:get | - | | PUT /v3/{project_id}/cas/environments/{environment_id}/resources | servicestage:environment:modify | - | | GET /v3/{project_id}/cas/environments/{environment_id}/resources | servicestage:environment:list | - | | GET /v3/{project_id}/cas/environments/resources | servicestage:environment:list | - | | POST /v3/{project_id}/cas/environments/{environment_id}/refresh | servicestage:environment:refresh | - | | POST /v3/{project_id}/cas/applications | servicestage:app:createApplication | - | | GET /v3/{project_id}/cas/applications | servicestage:app:listApplication | - | | PUT /v3/{project_id}/cas/applications/{application_id} | servicestage:app:modifyApplication | - | | GET /v3/{project_id}/cas/applications/{application_id} | servicestage:app:getApplication | - | | DELETE /v3/{project_id}/cas/applications/{application_id} | servicestage:app:deleteApplication | - | | POST /v3/{project_id}/cas/applications/{application_id}/action | servicestage:app:modifyApplication | - | | GET /v3/{project_id}/cas/applications/{application_id}/configuration | servicestage:app:getConfiguration | - | | PUT /v3/{project_id}/cas/applications/{application_id}/configuration | servicestage:app:modifyConfiguration | - | | DELETE /v3/{project_id}/cas/applications/{application_id}/configuration | servicestage:app:deleteConfiguration | - | | POST /v3/{project_id}/cas/applications/{application_id}/components | servicestage:app:createComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:create - as:scalingPolicy:get - as:scalingPolicy:list - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:create - elb:l7policies:get - elb:l7policies:list - elb:listeners:create - elb:listeners:get - elb:listeners:list - elb:members:create - elb:members:get - elb:members:list - ims:dataImages:create - ims:images:create - ims:images:get - ims:images:list - ims:wholeImages:create - rds:instance:get - servicestage:assembling:create - servicestage:assembling:getInfo - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | GET /v3/{project_id}/cas/applications/{application_id}/components | servicestage:app:listComponent | - | | GET /v3/{project_id}/cas/components | servicestage:app:listComponent | - | | PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id} | servicestage:app:modifyComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:get - as:scalingPolicy:list - as:scalingPolicy:update - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:get - elb:l7policies:list - elb:l7policies:update - elb:listeners:get - elb:listeners:list - elb:listeners:update - elb:members:get - elb:members:list - elb:members:update - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | DELETE /v3/{project_id}/cas/applications/{application_id}/components/{component_id} | servicestage:app:deleteComponent | - aom:discoveryRule:delete - aom:discoveryRule:list - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:delete - as:scalingPolicy:get - as:scalingPolicy:list - cce:cluster:get - dcs:instance:get - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:delete - elb:l7policies:get - elb:l7policies:list - elb:listeners:delete - elb:listeners:get - elb:listeners:list - elb:members:delete - elb:members:get - elb:members:list - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id} | servicestage:app:getComponent | - | | POST /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/action | servicestage:app:modifyComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:get - as:scalingPolicy:list - as:scalingPolicy:update - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:get - elb:l7policies:list - elb:l7policies:update - elb:listeners:get - elb:listeners:list - elb:listeners:update - elb:members:get - elb:members:list - elb:members:update - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | GET /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/records | servicestage:app:listComponent | - | | PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/refresh | servicestage:app:modifyComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:get - as:scalingPolicy:list - as:scalingPolicy:update - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:get - elb:l7policies:list - elb:l7policies:update - elb:listeners:get - elb:listeners:list - elb:listeners:update - elb:members:get - elb:members:list - elb:members:update - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | GET /v3/{project_id}/cas/components/filterOptions | servicestage:app:listComponent | - | | POST /v3/{project_id}/cas/components/action | servicestage:app:modifyComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:get - as:scalingPolicy:list - as:scalingPolicy:update - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:get - elb:l7policies:list - elb:l7policies:update - elb:listeners:get - elb:listeners:list - elb:listeners:update - elb:members:get - elb:members:list - elb:members:update - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | POST /v3/{project_id}/cas/components | servicestage:app:createComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:create - as:scalingPolicy:get - as:scalingPolicy:list - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:create - elb:l7policies:get - elb:l7policies:list - elb:listeners:create - elb:listeners:get - elb:listeners:list - elb:members:create - elb:members:get - elb:members:list - ims:dataImages:create - ims:images:create - ims:images:get - ims:images:list - ims:wholeImages:create - rds:instance:get - servicestage:assembling:create - servicestage:assembling:getInfo - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | POST /v3/{project_id}/cas/components/parse-template-package | servicestage:app:getComponent | - | | PUT /v3/{project_id}/cas/applications/{application_id}/components/{component_id}/redeployment | servicestage:app:modifyComponent | - aom:discoveryRule:list - aom:discoveryRule:set - as:scalingConfig:create - as:scalingConfig:delete - as:scalingConfig:get - as:scalingConfig:list - as:scalingPolicy:get - as:scalingPolicy:list - as:scalingPolicy:update - cce:cluster:get - dcs:instance:get - dns:recordset:create - dns:recordset:delete - dns:recordset:get - ecs:cloudServers:get - elb:l7policies:get - elb:l7policies:list - elb:l7policies:update - elb:listeners:get - elb:listeners:list - elb:listeners:update - elb:members:get - elb:members:list - elb:members:update - rds:instance:get - vpc:addressGroups:get - vpc:networks:get - vpc:routeTables:get - vpc:securityGroupRules:get - vpc:securityGroups:get - vpc:subnets:get - vpc:subnets:get - vpc:vpcs:get | | GET /v3/{project_id}/cas/jobs/{job_id} | servicestage:app:listApplication | - | | POST /v3/{project_id}/cas/config-groups | servicestage:config:createGroup | - | | GET /v3/{project_id}/cas/config-groups | servicestage:config:listGroup | - | | POST /v3/{project_id}/cas/configs | servicestage:config:create | - | | POST /v3/{project_id}/cas/configs/import | servicestage:config:import | - | | GET /v3/{project_id}/cas/configs | servicestage:config:list | - | | GET /v3/{project_id}/cas/configs/{config_id} | servicestage:config:get | - | | DELETE /v3/{project_id}/cas/configs/{config_id} | servicestage:config:delete | - | | PUT /v3/{project_id}/cas/configs/{config_id} | servicestage:config:modify | - | | GET /v3/{project_id}/cas/configs/{config_id}/histories | servicestage:config:listHistories | - | | GET /v3/{project_id}/cas//configs/{config_id}/histories/{config_history_id} | servicestage:config:getHistory | - | | DELETE /v3/{project_id}/cas/configs/{config_id}/histories/{config_history_id} | servicestage:config:deleteHistory | - | | GET /v3/{project_id}/cas/config-groups/{config_group_id} | servicestage:config:getGroup | - | | DELETE /v3/{project_id}/cas/config-groups/{config_group_id} | servicestage:config:deleteGroup | - | | POST /v3/{project_id}/cas/swimlane-group | servicestage::createLaneGroup | - | | GET /v3/{project_id}/cas/swimlane-group | servicestage::listLaneGroup | - | | GET /v3/{project_id}/cas/swimlane-group/{lane_group_id} | servicestage::getLaneGroup | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id} | servicestage::modifyLaneGroup | - | | DELETE /v3/{project_id}/cas/swimlane-group/{lane_group_id} | servicestage::deleteLaneGroup | - | | GET /v3/{project_id}/cas/swimlane-group/target-services | servicestage::listLaneGroup | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/route | servicestage::modifyLaneGroup | - | | GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/view | servicestage::getLaneGroup | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/view | servicestage::modifyLaneGroup | - | | POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlanes-action | servicestage::modifyLaneGroup | - | | POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane | servicestage::createLane | - | | GET /v3/{project_id}/cas/swimlane | servicestage::listLaneGroup | - | | GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane | servicestage::listLane | - | | GET /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id} | servicestage::getLane | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id} | servicestage::modifyLane | - | | DELETE /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id} | servicestage::deleteLane | - | | POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/action | servicestage::modifyLane | - | | POST /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/components-action | servicestage::modifyLane | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/component-instances | servicestage::modifyLane | - | | GET /v3/{project_id}/cas/swim_lans/{swimlan_id}/records | servicestage::getLane | - | | PUT /v3/{project_id}/cas/swimlane-group/{lane_group_id}/swimlane/{lane_id}/instances | servicestage::modifyLane | - | | POST /v3/{project_id}/cas/environments/{environment_id}/addons | servicestage:environment:createAddon | - | | GET /v3/{project_id}/cas/environments/{environment_id}/addons | servicestage:environment:listAddon | - | | GET /v3/{project_id}/cas/environments/{environment_id}/addons-metadata | servicestage:environment:listAddon | - | | GET /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id} | servicestage:environment:getAddon | - | | POST /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id}/action | servicestage:environment:modifyAddon | - | | DELETE /v3/{project_id}/cas/environments/{environment_id}/addons/{addon_id} | servicestage:environment:deleteAddon | - | | GET /v3/{project_id}/assembling/base-images | servicestage:assembling:list | - | | POST /v3/{project_id}/cas/release-plans | servicestage::createReleasePlan | - | | PUT /v3/{project_id}/cas/release-plans/{release_plan_id} | servicestage::modifyReleasePlan | - | | DELETE /v3/{project_id}/cas/release-plans/{release_plan_id} | servicestage::deleteReleasePlan | - | | GET /v3/{project_id}/cas/release-plans | servicestage::listReleasePlan | - | | GET /v3/{project_id}/cas/release-plans/{release_plan_id} | servicestage::getReleasePlan | - | | GET /v3/{project_id}/cas/release-plans/{release_plan_id}/deploy-info | servicestage::getReleasePlan | - | | POST /v3/{project_id}/cas/release-plans/{release_plan_id}/execute | servicestage::createReleasePlan | - | | POST /v3/{project_id}/cas/release-plans/{release_plan_id}/rollback | servicestage::createReleasePlan | - | | POST /v3/{project_id}/cas/release-plans/{release_plan_id}/abort | servicestage::createReleasePlan | - | | POST /v3/{project_id}/pipeline/pipelines | servicestage:pipeline:create | - | | GET /v3/{project_id}/pipeline/pipelines | servicestage:pipeline:list | - servicestage:environment:get - servicestage:environment:list | | PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id} | servicestage:pipeline:modify | - | | POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/action | servicestage:pipeline:modify | - | | GET /v3/{project_id}/pipeline/pipelines/{pipeline_id} | servicestage:pipeline:get | - | | GET /v3/{project_id}/pipeline/pipelines/{id}/records | servicestage:pipeline:get | - | | POST /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks | servicestage:pipeline:create | - | | PUT /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks | servicestage:pipeline:modify | - | | GET /v3/{project_id}/pipeline/pipelines/{pipeline_id}/hooks | servicestage:pipeline:list | - servicestage:environment:get - servicestage:environment:list | | POST /v3/{project_id}/pipeline/pipelines/parse-template-package | servicestage:pipeline:get | - | | POST /v3/{project_id}/cas/runtimestacks | servicestage::createRuntimeStack | - | | GET /v3/{project_id}/cas/runtimestacks | servicestage:app:listApplication | - | | GET /v3/{project_id}/cas/runtimestacks/{runtimestack_id} | servicestage::getRuntimeStack | - | | PUT /v3/{project_id}/cas/runtimestacks/{runtimestack_id} | servicestage::modifyRuntimeStack | - | | DELETE /v3/{project_id}/cas/runtimestacks/{runtimestack_id} | servicestage::deleteRuntimeStack | - | | POST /v3/{project_id}/cas/runtimestacks/action | servicestage::switchRuntimeStackStatus | - | | GET /v3/{project_id}/cas/innerimages | servicestage:app:listApplication | - | | GET /v1/{project_id}/git/auths | servicestage:repositoryAuth:list | - | | GET /v1/{project_id}/git/auths/{repo_type}/redirect | servicestage:repositoryAuth:get | - | | POST /v1/{project_id}/git/auths/{repo_type}/oauth | servicestage:repositoryAuth:create | - | | POST /v1/{project_id}/git/auths/{repo_type}/personal | servicestage:repositoryAuth:create | - | | POST /v1/{project_id}/git/auths/{repo_type}/password | servicestage:repositoryAuth:create | - | | DELETE /v1/{project_id}/git/auths/{name} | servicestage:repositoryAuth:delete | - | | GET /v1/{project_id}/git/auths/{repo_type}/password/valid | servicestage:repositoryAuth:get | - | | POST /v1/{project851_id}/kie/file | cse:config:upload | - | | POST /v1/{project_id}/kie/download | cse:config:download | - | | GET /v2/{project_id}/enginemgr/engines | cse:engine:list | - | | POST /v2/{project_id}/enginemgr/engines | cse:engine:create | - | | GET /v2/{project_id}/enginemgr/engines/{engine_id} | cse:engine:get | - | | DELETE /v2/{project_id}/enginemgr/engines/{engine_id} | cse:engine:delete | - | | GET /v2/{project_id}/enginemgr/engines/{engine_id}/jobs/{job_id} | cse:engine:get | - | | POST /v1/{project_id}/kie/kv | cse:namespace:update | - | | PUT /v1/{project_id}/kie/kv/{kv_id} | cse:namespace:update | - | | GET /v1/{project_id}/kie/kv | cse:namespace:get | - | | DELETE /v1/{project_id}/kie/kv/{kv_id} | cse:namespace:update | - | | DELETE /v1/{project_id}/kie/kv | cse:namespace:update | - | #### 资源类型（Resource） 资源类型（Resource）用于定义身份策略生效的资源范围。如[表3]中某项操作已指定了对应的资源类型，则在包含该操作的身份策略语句中选择填写对应资源的URN时，身份策略仅对该指定资源生效；未填写对应资源的URN时，身份策略将对指定资源类型下所有资源生效；如未指定资源类型，Resource默认取值为"\*"，身份策略将作用于所有资源。此外，您也可在身份策略中设置条件，进一步精细化限定资源类型。 ServiceStage定义了以下可以在身份策略的Resource元素中使用的资源类型。 表3ServiceStage支持的资源类型 | 资源类型 | URN | |:---|:---| | app | servicestage:\:\:app:\ | | environment | servicestage:\:\:environment:\ | | pipeline | servicestage:\:\:pipeline:\ | | assembling | servicestage:\:\:assembling:\ | | repositoryAuth | servicestage:\:\:repositoryAuth:\ | | configGroup | servicestage:\:\:configGroup:\ | | config | servicestage:\:\:config:\/\ | #### 条件（Condition） ServiceStage服务不支持在身份策略中的条件键中配置服务级的条件键。 ServiceStage可以使用适用于所有服务的全局条件键，请参考[全局条件键](https://support.huaweicloud.com/usermanual-iam5/iam_01_1287.html)。