文档首页/云桌面 Workspace/云应用用户指南/管理员操作指南/权限管理/权限和授权项
更新时间：2024-07-18 GMT+08:00
查看PDF
分享

权限和授权项

如果您需要对您所拥有的Workspace Application Streaming进行精细的权限管理，您可以使用统一身份认证服务（Identity and Access Management，简称IAM），如果账号已经能满足您的要求，不需要创建独立的IAM用户，您可以跳过本章节，不影响您使用AppStream服务的其它功能。

默认情况下，新建的IAM用户没有任何权限，您需要将其加入用户组，并给用户组授予策略或角色，才能使用户组中的用户获得相应的权限，这一过程称为授权。授权后，用户就可以基于已有权限对云服务进行操作。

权限根据授权的精细程度，分为角色和策略。角色以服务为粒度，是IAM最初提供的一种根据用户的工作职能定义权限的粗粒度授权机制。策略以API接口为粒度进行权限拆分，授权更加精细，可以精确到某个操作、资源和条件，能够满足企业对权限最小化的安全管控要求。

如果您要允许或是禁止某个接口的操作权限，请使用策略。

支持的授权项

策略包含系统策略和自定义策略，如果系统策略不满足授权要求，租户管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下：

  • 权限：允许或拒绝某项操作。
  • 对应API接口：自定义策略实际调用的API接口。
  • 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。
  • 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。
  • IAM项目（Project）/企业项目（Enterprise Project）：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。关于IAM项目与企业项目的区别，详情请参见：IAM与企业管理的区别。

授权项（Action）

API方法

对应API接口

授权项说明

IAM项目（Project）

企业项目（Enterprise Project）

workspace:appGroup:list

GET

/v1/{project_id}/app-groups

查询应用组

√

x

workspace:appGroup:create

POST

/v1/{project_id}/app-groups

创建应用组

√

x

workspace:appGroup:delete

DELETE

/v1/{project_id}/app-groups/{app_group_id}

应用组删除

√

x

workspace:appGroup:get

GET

/v1/{project_id}/app-groups/{app_group_id}

查询应用组详情

√

x

workspace:appGroup:update

PATCH

/v1/{project_id}/app-groups/{app_group_id}

修改应用组

√

x

workspace:app:listPublishedApp

GET

/v1/{project_id}/app-groups/{app_group_id}/apps

查询已发布应用

√

x

workspace:app:publish

POST

/v1/{project_id}/app-groups/{app_group_id}/apps

发布应用

√

x

workspace:app:get

GET

/v1/{project_id}/app-groups/{app_group_id}/apps/{app_id}

查询应用详细信息

√

x

workspace:app:update

PATCH

/v1/{project_id}/app-groups/{app_group_id}/apps/{app_id}

修改应用信息

√

x

workspace:app:deleteIcon

DELETE

/v1/{project_id}/app-groups/{app_group_id}/apps/{app_id}/icon

删除自定义应用图标

√

x

workspace:app:uploadIcon

POST

/v1/{project_id}/app-groups/{app_group_id}/apps/{app_id}/icon

修改自定义应用图标

√

x

workspace:app:check

POST

/v1/{project_id}/app-groups/{app_group_id}/apps/actions/check

校验应用

√

x

workspace:app:batchDisable

POST

/v1/{project_id}/app-groups/{app_group_id}/apps/actions/disable

批量禁用应用

√

x

workspace:app:batchEnable

POST

/v1/{project_id}/app-groups/{app_group_id}/apps/actions/enable

批量启用应用

√

x

workspace:app:unpublish

POST

/v1/{project_id}/app-groups/{app_group_id}/apps/batch-unpublish

批量取消应用发布

√

x

workspace:appGroup:listPublishableApp

GET

/v1/{project_id}/app-groups/{app_group_id}/publishable-app

可发布应用列表

√

x

workspace:appGroup:batchDeleteAuthorization

POST

/v1/{project_id}/app-groups/actions/batch-delete-authorization

移除应用组授权

√

x

workspace:appGroup:disassociate

POST

/v1/{project_id}/app-groups/actions/disassociate-app-group

解除服务组关联的所有应用组

√

x

workspace:appGroup:listAuthorization

GET

/v1/{project_id}/app-groups/actions/list-authorizations

查询应用组授权记录

√

x

workspace:appGroup:addAuthorization

POST

/v1/{project_id}/app-groups/authorizations

增加应用组授权

√

x

workspace:appGroup:batchDelete

POST

/v1/{project_id}/app-groups/batch-delete

批量删除应用组

√

x

workspace:appGroup:check

POST

/v1/{project_id}/app-groups/rules/validate

校验应用组

√

x

workspace:serverGroup:list

GET

/v1/{project_id}/app-server-groups

查询服务器组列表

√

√

workspace:serverGroup:create

POST

/v1/{project_id}/app-server-groups

创建服务器组

√

√

workspace:serverGroup:delete

DELETE

/v1/{project_id}/app-server-groups/{server_group_id}

删除服务器组

√

√

workspace:serverGroup:get

GET

/v1/{project_id}/app-server-groups/{server_group_id}

查询指定服务器组

√

√

workspace:serverGroup:update

PATCH

/v1/{project_id}/app-server-groups/{server_group_id}

修改服务器组

√

√

workspace:serverGroup:getServerState

GET

/v1/{project_id}/app-server-groups/{server_group_id}/state

查询指定服务器组内服务器状态

√

√

workspace:serverGroup:listDetail

GET

/v1/{project_id}/app-server-groups/actions/list

查询租户服务器组基础信息列表

√

√

workspace:serverGroup:getRestrict

GET

/v1/{project_id}/app-server-groups/resources/restrict

指定租户服务器组限制查询

√

x

workspace:serverGroup:validate

POST

/v1/{project_id}/app-server-groups/rules/validate

校验服务器组

√

x

workspace:serverGroup:tagResource

POST

/v1/{project_id}/server-group/{server_group_id}/tags/create

服务器组添加标签

√

√

workspace:serverGroup:unTagResource

DELETE

/v1/{project_id}/server-group/{server_group_id}/tags/delete

服务器组删除标签

√

√

workspace:serverGroup:listTagsForResource

GET

/v1/{project_id}/server-group/{resource_id}/tags

查询服务器组标签

√

√

workspace:serverGroup:listTags

GET

/v1/{project_id}/server-group/tags

查询租户所有服务器上标签

√

√

workspace:serverGroup:batchCreateTags

POST

/v1/{project_id}/server-group/tags/batch-create

批量添加服务器组标签

√

√

workspace:serverGroup:batchDeleteTags

POST

/v1/{project_id}/server-group/tags/batch-delete

批量删除服务器组标签

√

√

workspace:server:list

GET

/v1/{project_id}/app-servers

查询服务器列表

√

√

workspace:server:delete

DELETE

/v1/{project_id}/app-servers/{server_id}

删除服务器

√

√

workspace:server:get

GET

/v1/{project_id}/app-servers/{server_id}

查询指定服务器

√

√

workspace:server:update

PATCH

/v1/{project_id}/app-servers/{server_id}

修改服务器

√

√

workspace:server:changeImage

POST

/v1/{project_id}/app-servers/{server_id}/actions/change-image

修改服务器的镜像

√

√

workspace:server:reinstall

POST

/v1/{project_id}/app-servers/{server_id}/actions/reinstall

重装服务器

√

√

workspace:server:getVncUrl

GET

/v1/{project_id}/app-servers/{server_id}/actions/vnc

获取VNC远程登录地址

√

√

workspace:accessAgent:list

GET

/v1/{project_id}/app-servers/access-agent/actions/show-latest-version

查询租户的所有HDA最新版本

√

x

workspace:accessAgent:batchUpgrade

PATCH

/v1/{project_id}/app-servers/access-agent/actions/upgrade

批量升级服务器HDA版本

√

√

workspace:accessAgent:listLatestVersion

GET

/v1/{project_id}/app-servers/access-agent/latest-version

查询租户的HDA最新版本

√

x

workspace:server:listAccessAgentDetails

GET

/v1/{project_id}/app-servers/access-agent/list

查询服务器的HDA相关信息

√

√

workspace:accessAgent:getUpgradeFlag

GET

/v1/{project_id}/app-servers/access-agent/upgrade-flag

查询HDA升级提醒标识

√

x

workspace:accessAgent:updateUpgradeFlag

PATCH

/v1/{project_id}/app-servers/access-agent/upgrade-flag

更新HDA升级通知标识

√

x

workspace:accessAgent:listUpgradeRecords

GET

/v1/{project_id}/app-servers/access-agent/upgrade-record

查询服务器的HDA升级跟踪记录

√

x

workspace:server:batchDelete

POST

/v1/{project_id}/app-servers/actions/batch-delete

批量删除服务器

√

√

workspace:server:batchChangeMaintainMode

PATCH

/v1/{project_id}/app-servers/actions/batch-maint

标记服务器维护状态

√

√

workspace:server:batchReboot

PATCH

/v1/{project_id}/app-servers/actions/batch-reboot

重启服务器

√

√

workspace:server:batchRejoinDomain

PATCH

/v1/{project_id}/app-servers/actions/batch-rejoin-domain

批量服务器重新加域

√

√

workspace:server:batchStart

PATCH

/v1/{project_id}/app-servers/actions/batch-start

启动服务器

√

√

workspace:server:batchStop

PATCH

/v1/{project_id}/app-servers/actions/batch-stop

关闭服务器

√

√

workspace:server:batchUpdateTsvi

PATCH

/v1/{project_id}/app-servers/actions/batch-update-tsvi

批量更新服务器虚拟会话IP配置

√

√

workspace:server:create

POST

/v1/{project_id}/app-servers/actions/create

创建云服务器

√

√

workspace:server:batchMigrateHosts

PATCH

/v1/{project_id}/app-servers/hosts/batch-migrate

迁移云办公主机下面的服务器到目标云办公主机

√

√

workspace:server:getMetricData

GET

/v1/{project_id}/app-servers/metric-data/{server_id}

查询云应用服务器监控信息

√

√

workspace:jobs:listSubJobs

GET

/v1/{project_id}/app-server-sub-jobs

子任务查询

√

x

workspace:jobs:batchDeleteSubJobs

POST

/v1/{project_id}/app-server-sub-jobs/actions/batch-delete

批量删除子任务

√

x

workspace:jobs:countSubJobs

GET

/v1/{project_id}/app-server-sub-jobs/actions/count

子任务数量查询

√

x

workspace:appWarehouse:authorizeObs

POST

/v1/{project_id}/app-warehouse/action/authorize

获取上传至OBS桶的ak/sk

√

x

workspace:appWarehouse:batchDeleteApp

POST

/v1/{project_id}/app-warehouse/actions/batch-delete

批量删除应用仓库中的指定应用

√

x

workspace:appWarehouse:ListWarehouseApps

GET

/v1/{project_id}/app-warehouse/apps

查询租户应用仓库中的应用列表

√

x

workspace:appWarehouse:createApp

POST

/v1/{project_id}/app-warehouse/apps

在应用仓库中新增应用

√

x

workspace:appWarehouse:deleteApp

DELETE

/v1/{project_id}/app-warehouse/apps/{id}

删除应用仓库中的指定应用

√

x

workspace:appWarehouse:uploadAppIcon

POST

/v1/{project_id}/app-warehouse/apps/icon

在应用仓库中上传图标文件

√

x

workspace:appWarehouse:createBucketOrAcl

POST

/v1/{project_id}/app-warehouse/bucket-and-acl/create

添加桶或者桶授权

√

x

workspace:orders:create

POST

/v1/{project_id}/bundles/subscribe/order

创建订单

√

x

workspace:quotas:get

GET

/v1/{project_id}/check/quota

配额校验

√

x

workspace:volumes:listDssPoolsDetail

GET

/v1/{project_id}/dss-pools/detail

获取专属分布式存储池详情列表

√

x

workspace:images:listImageJobs

GET

/v1/{project_id}/image-server-jobs

查询租户的任务列表

√

x

workspace:images:getImageJob

GET

/v1/{project_id}/image-server-jobs/{job_id}

查询任务详情

√

x

workspace:imageServer:list

GET

/v1/{project_id}/image-servers

查询镜像实例列表

√

√

workspace:imageServer:create

POST

/v1/{project_id}/image-servers

创建镜像实例

√

√

workspace:imageServer:get

GET

/v1/{project_id}/image-servers/{server_id}

查询指定镜像实例

√

√

workspace:imageServer:update

PATCH

/v1/{project_id}/image-servers/{server_id}

修改镜像实例

√

√

workspace:imageServer:attachApp

POST

/v1/{project_id}/image-servers/{server_id}/actions/attach-app

分发软件信息至镜像实例

√

√

workspace:imageServer:listLatestAttachedApp

GET

/v1/{project_id}/image-servers/{server_id}/actions/latest-attached-app

查询最近一次分发软件信息列表

√

x

workspace:imageServer:recreate

POST

/v1/{project_id}/image-servers/{server_id}/actions/recreate-image

构建云应用镜像

√

√

workspace:imageServer:batchDelete

PATCH

/v1/{project_id}/image-servers/actions/batch-delete

批量删除镜像实例

√

√

workspace:imageServer:listImageSubJobs

GET

/v1/{project_id}/image-server-sub-jobs

子任务查询

√

x

workspace:imageServer:batchDeleteImageSubJobs

PATCH

/v1/{project_id}/image-server-sub-jobs/actions/batch-delete

批量删除子任务

√

x

workspace:imageServer:countImageSubJobs

GET

/v1/{project_id}/image-server-sub-jobs/actions/count

子任务数量查询

√

x

workspace:jobs:get

GET

/v1/{project_id}/job/{job_id}

查询任务的执行状态

√

x

workspace:appGroup:listMailRecord

GET

/v1/{project_id}/mails

查询应用组授权邮件发送记录

√

x

workspace:appGroup:resendMail

POST

/v1/{project_id}/mails/actions/send

重发应用组授权邮件（根据授权邮件记录）

√

x

workspace:appGroup:resendMail

POST

/v1/{project_id}/mails/actions/send-by-authorization

重发应用组授权邮件（根据授权记录）

√

x

workspace:storage:listPersistentStorage

GET

/v1/{project_id}/persistent-storages

查询WKS存储

√

x

workspace:storage:createPersistentStorage

POST

/v1/{project_id}/persistent-storages

创建WKS存储

√

x

workspace:storage:deletePersistentStorage

DELETE

/v1/{project_id}/persistent-storages/{storage_id}

删除WKS存储

√

x

workspace:storage:updateUserFolderAssignment

POST

/v1/{project_id}/persistent-storages/{storage_id}/actions/assign-folder

创建个人存储目录

√

x

workspace:storage:updateShareFolderAssignment

POST

/v1/{project_id}/persistent-storages/{storage_id}/actions/assign-share-folder

修改共享目录成员

√

x

workspace:storage:createShareFolder

POST

/v1/{project_id}/persistent-storages/{storage_id}/actions/create-share-folder

创建共享存储目录

√

x

workspace:storage:deleteStorageClaim

POST

/v1/{project_id}/persistent-storages/{storage_id}/actions/delete-storage-claim

删除共享目录

√

x

workspace:storage:deleteUserStorageAttachment

POST

/v1/{project_id}/persistent-storages/{storage_id}/actions/delete-user-attachment

删除个人存储目录

√

x

workspace:storage:batchDeletePersistentStorage

POST

/v1/{project_id}/persistent-storages/actions/batch-delete

删除WKS存储

√

x

workspace:storage:listStorageAssignment

GET

/v1/{project_id}/persistent-storages/actions/list-attachments

查询个人存储目录

√

x

workspace:storage:listShareFolder

GET

/v1/{project_id}/persistent-storages/actions/list-share-folders

查询共享存储目录

√

x

workspace:policyGroups:list

GET

/v1/{project_id}/policy-groups

查询策略组列表

√

x

workspace:policyGroups:create

POST

/v1/{project_id}/policy-groups

新增策略组

√

x

workspace:policyGroups:delete

DELETE

/v1/{project_id}/policy-groups/{policy_group_id}

删除策略组

√

x

workspace:policyGroups:get

GET

/v1/{project_id}/policy-groups/{policy_group_id}

查询策略组详情

√

x

workspace:policyGroups:update

PATCH

/v1/{project_id}/policy-groups/{policy_group_id}

修改策略组

√

x

workspace:policyGroups:listPolicies

GET

/v1/{project_id}/policy-groups/{policy_group_id}/policy

查询策略组中的策略项

√

x

workspace:policyGroups:listTargets

GET

/v1/{project_id}/policy-groups/{policy_group_id}/target

查询策略组应用对象

√

x

workspace:policyGroups:getOriginalPolicies

GET

/v1/{project_id}/policy-groups/actions/list-original-policy

查询初始策略项

√

x

workspace:policyGroups:listDetail

GET

/v1/{project_id}/policy-groups/show/detail

查询策略组详情列表

√

x

workspace:policyGroups:listTemplate

GET

/v1/{project_id}/policy-templates

查询策略模板列表

√

x

workspace:policyGroups:createTemplate

POST

/v1/{project_id}/policy-templates

新增策略模板

√

x

workspace:policyGroups:deleteTemplate

DELETE

/v1/{project_id}/policy-templates/{policy_template_id}

删除策略模板

√

x

workspace:policyGroups:updateTemplate

PATCH

/v1/{project_id}/policy-templates/{policy_template_id}

修改策略模板

√

x

workspace:privacystatements:get

GET

/v1/{project_id}/privacy-statement

查询最新版本的隐私声明

√

x

workspace:privacystatements:sign

POST

/v1/{project_id}/privacy-statement

签署隐私声明

√

x

workspace:scalingPolicy:delete

DELETE

/v1/{project_id}/scaling-policy

删除弹性伸缩策略

√

x

workspace:scalingPolicy:list

GET

/v1/{project_id}/scaling-policy

查询服务器组弹性伸缩策略

√

x

workspace:scalingPolicy:create

PUT

/v1/{project_id}/scaling-policy

新增/修改弹性伸缩策略

√

x

workspace:scheduledTasks:list

GET

/v1/{project_id}/schedule-task

查询定时任务列表

√

x

workspace:scheduledTasks:create

POST

/v1/{project_id}/schedule-task

新增定时任务

√

x

workspace:scheduledTasks:getRecord

GET

/v1/{project_id}/schedule-task/{execute_history_id}/execute-detail

查询定时任务执行子任务列表

√

x

workspace:scheduledTasks:delete

DELETE

/v1/{project_id}/schedule-task/{task_id}

删除任务

√

x

workspace:scheduledTasks:get

GET

/v1/{project_id}/schedule-task/{task_id}

查询指定定时任务详情

√

x

workspace:scheduledTasks:update

PATCH

/v1/{project_id}/schedule-task/{task_id}

修改定时任务

√

x

workspace:scheduledTasks:listRecords

GET

/v1/{project_id}/schedule-task/{task_id}/execute-history

查询定时任务执行列表

√

x

workspace:scheduledTasks:batchDelete

POST

/v1/{project_id}/schedule-task/actions/batch-delete

批量删除定时任务

√

x

workspace:scheduledTasks:getFuture

POST

/v1/{project_id}/schedule-task/future-executions

未来执行的具体时间列表

√

x

workspace:session:listAppConnection

POST

/v1/{project_id}/session/app-connection

查询应用使用记录

√

x

workspace:session:logoffUserSession

POST

/v1/{project_id}/session/logoff

用户会话注销

√

x

workspace:session:listUserConnection

POST

/v1/{project_id}/session/user-connection

查询用户登录记录

√

x

workspace:session:listSessionByUserName

GET

/v1/{project_id}/session/user-session-info

根据用户名查询当前会话

√

x

workspace:storagePolicy:create

PUT

/v1/{project_id}/storages-policy/actions/create-statements

新增或更新存储目录访问权限自定义策略

√

x

workspace:storagePolicy:list

GET

/v1/{project_id}/storages-policy/actions/list-statements

查询存储目录访问权限策略

√

x

workspace:users:list

GET

/v1/{project_id}/users

查询用户(组)

√

x

workspace:storage:listSfs3Storage

GET

/v1/persistent-storages/actions/list-sfs-storages

查询SFS3.0存储

√

x

workspace:baseResource:list

GET

/v1/{project_id}/availability-zone

查询可用分区列表

√

x

workspace:tenants:listConfigInfo

POST

/v1/{project_id}/bundles/batch-query-config-info

查询企业系统配置

√

x

workspace:baseResource:list

GET

/v1/{project_id}/product

查询云应用套餐

√

x

workspace:baseResource:list

GET

/v1/{project_id}/session-type

查询会话套餐列表

√

x

workspace:tenants:active

POST

/v1/{project_id}/tenant/action/active

租户服务激活、初始化

√

x

workspace:tenants:listTenantProfile

GET

/v1/{project_id}/tenant/profile

查询租户信息

√

x

workspace:baseResource:list

GET

/v1/{project_id}/volume-type

查询可用磁盘类型

√

x

workspace:server:listServerMetricData

GET

/v1/{project_id}/app-servers/server-metric-data/{server_id}

查询服务器的监控数据

√

x

workspace:session:listSessions

GET

/v1/{project_id}/session/list-sessions

查询企业会话列表

√

x

父主题：权限管理

相关文档