配置审计 Config
Organizations服务中的服务控制策略（Service Control Policies，以下简称SCP）可以使用以下这些授权项元素设置访问控制策略。
SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。
本章节介绍组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。
如何使用这些元素编辑SCP自定义策略，请参考创建SCP。
操作（Action）
操作（Action）即为SCP中支持的授权项。
- “访问级别”列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在SCP中相应操作对应的访问级别。
- “资源类型”列指每个操作是否支持资源级权限。
- 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在SCP语句的Resource元素中指定所有资源类型（“*”）。
- 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。
- 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。
关于Config定义的资源类型的详细信息请参见资源类型（Resource）。
- “条件键”列包括了可以在SCP语句的Condition元素中支持指定的键值。
- 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
- 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
- 如果此列没有值（-），表示此操作不支持指定条件键。
关于Config定义的条件键的详细信息请参见条件（Condition）。
您可以在SCP语句的Action元素中指定以下Config的相关操作。
授权项 |
描述 |
访问级别 |
资源类型（*为必须） |
条件键 |
|---|---|---|---|---|
rms:organizationConformancePacks:create |
授予权限创建组织合规规则包。 |
write |
- |
- |
rms:organizationConformancePacks:get |
授予权限查看组织合规规则包。 |
read |
organizationConformancePacks * |
- |
rms:organizationConformancePacks:delete |
授予权限删除组织合规规则包。 |
write |
organizationConformancePacks * |
- |
rms:organizationConformancePacks:list |
授予权限查询组织合规规则包列表。 |
list |
- |
- |
rms:conformancePacks:create |
授予权限创建合规规则包。 |
write |
- |
- |
rms:conformancePacks:get |
授予权限查看合规规则包。 |
read |
conformancePacks * |
- |
rms:conformancePacks:delete |
授予权限删除合规规则包。 |
write |
conformancePacks * |
- |
rms:conformancePacks:list |
授予权限查询合规规则包列表。 |
list |
- |
- |
rms:storedQueries:create |
授予权限保存新的高级查询语句。 |
write |
- |
- |
rms:storedQueries:update |
授予权限更新已存在的高级查询语句。 |
write |
storedQueries * |
- |
rms:storedQueries:delete |
授予权限删除已存在的高级查询语句。 |
write |
storedQueries * |
- |
rms:storedQueries:get |
授予权限查看已存在的高级查询语句详情。 |
read |
storedQueries * |
- |
rms:storedQueries:list |
授予权限查看已存在的高级查询语句列表。 |
list |
- |
- |
rms:policyAssignments:create |
授予权限创建新的合规规则以评估你的资源。 |
write |
- |
- |
rms:policyAssignments:update |
授予权限更新已存在的合规规则以评估你的资源。 |
write |
policyAssignments * |
- |
rms:policyAssignments:delete |
授予权限删除已存在的合规规则和相应的评估状态结果。 |
write |
policyAssignments * |
- |
rms:policyAssignments:get |
授予权限查看已存在的合规规则详情。 |
read |
policyAssignments * |
- |
rms:organizationPolicyAssignments:put |
授予权限对整个组织创建或更新合规规则以评估你的资源。 |
write |
- |
- |
rms:organizationPolicyAssignments:delete |
授予权限删除指定的组织合规规则和组织内所有成员账号的合规评估状态结果。 |
write |
organizationPolicyAssignments * |
- |
rms:organizationPolicyAssignments:get |
授予权限查看组织合规规则详情。 |
read |
organizationPolicyAssignments * |
- |
rms:organizationPolicyAssignments:list |
授予权限查看组织合规规则列表。 |
list |
- |
- |
rms:policyStates:get |
授予权限查看合规规则评估状态结果列表。 |
read |
- |
- |
rms:policyStates:runEvaluation |
授予权限运行指定的合规规则以评估你的资源。 |
write |
- |
- |
rms:policyStates:update |
授予权限FunctionGraph函数将评估结果传输到Config。 |
write |
- |
- |
rms:aggregators:create |
授予权限创建聚合器聚合指定租户资源。 |
write |
- |
- |
rms:aggregators:update |
授予权限更新已存在的聚合器。 |
write |
aggregators * |
- |
rms:aggregators:delete |
授予权限删除指定聚合器并删除被聚合的租户资源。 |
write |
aggregators * |
- |
rms:aggregators:list |
授予权限查看已存在的聚合器列表。 |
list |
- |
- |
rms:aggregators:get |
授予权限查看已存在的聚合器详情。 |
read |
aggregators * |
- |
rms:aggregatorResources:list |
授予权限查看已被聚合的资源。 |
list |
- |
- |
rms:aggregatorResources:runQuery |
授予权限执行高级查询语句返回被聚合的资源属性。 |
list |
- |
- |
rms:aggregatorResources:get |
授予权限查看用户指定被聚合的资源详情。 |
read |
- |
- |
rms:aggregationAuthorizations:create |
授予权限创建聚合授权。 |
write |
aggregationAuthorizations * |
- |
- |
rms:AuthorizedAccountOrgPath |
|||
rms:aggregationAuthorizations:list |
授予权限查看已存在的聚合授权列表。 |
list |
- |
- |
rms:aggregationAuthorizations:delete |
授予权限删除已存在聚合授权并删除被聚合的租户资源。 |
write |
aggregationAuthorizations * |
- |
- |
rms:AuthorizedAccountOrgPath |
|||
rms:aggregationRequests:delete |
授予权限删除来自其他账号的聚合请求。 |
write |
- |
- |
rms:aggregationRequests:list |
授予权限查看来自其他账号的聚合请求列表。 |
list |
- |
- |
rms:trackerConfig:put |
授予权限创建或更新资源记录器配置以记录指定资源类型的资源历史数据。 |
write |
- |
- |
rms:trackerConfig:delete |
授予权限删除资源记录器配置以停止记录指定资源类型的资源历史数据。 |
write |
- |
- |
rms:trackerConfig:get |
授予权限查看资源记录器配置。 |
read |
- |
- |
rms:schemas:list |
授予权限查看高级查询资源Schema。 |
list |
- |
- |
rms:policyDefinitions:get |
授予权限查看预定义合规策略。 |
list |
- |
- |
rms:resources:getHistory |
授予权限查看指定资源的历史配置数据。 |
list |
- |
- |
rms:resources:getRelation |
授予权限查看资源关系。 |
list |
- |
- |
rms:resources:get |
授予权限查看用户指定的资源详情。 |
read |
- |
- |
rms:resources:list |
授予权限查看用户所有的资源列表。 |
list |
- |
- |
rms:resources:runQuery |
授予权限执行高级查询语句。 |
list |
- |
- |
rms:resources:summarize |
授予权限查看用户的资源概况。 |
list |
- |
- |
rms::tagResource |
授予权限批量创建资源标签。 |
tagging |
policyAssignments |
g:ResourceTag/<tag-key> |
- |
|
|||
rms::unTagResource |
授予权限批量删除资源标签。 |
tagging |
policyAssignments |
g:ResourceTag/<tag-key> |
- |
|
|||
rms::listTagsForResource |
授予权限查询资源标签。 |
list |
policyAssignments |
g:ResourceTag/<tag-key> |
rms::listTags |
授予权限查询项目标签。 |
list |
- |
- |
rms::listResourcesByTag |
授予权限查询资源实例。 |
list |
- |
g:TagKeys |
Config的API通常对应着一个或多个授权项。表2展示了API与授权项的关系，以及该API需要依赖的授权项。
API |
对应的授权项 |
依赖的授权项 |
|---|---|---|
POST /v1/resource-manager/organizations/{organization_id}/conformance-packs |
rms:organizationConformancePacks:create |
|
DELETE /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id} |
rms:organizationConformancePacks:delete |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs |
rms:organizationConformancePacks:list |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id} |
rms:organizationConformancePacks:get |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/statuses |
rms:organizationConformancePacks:list |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/conformance-packs/detailed-statuses |
rms:organizationConformancePacks:get |
organizations:organizations:get |
POST /v1/resource-manager/domains/{domain_id}/conformance-packs |
rms:conformancePacks:create |
|
DELETE /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id} |
rms:conformancePacks:delete |
|
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id} |
rms:conformancePacks:get |
- |
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance |
rms:conformancePacks:get |
- |
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance/details |
rms:conformancePacks:get |
- |
GET /v1/resource-manager/domains/{domain_id}/conformance-packs |
rms:conformancePacks:list |
- |
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/compliance/summary |
rms:conformancePacks:list |
- |
GET /v1/resource-manager/domains/{domain_id}/conformance-packs/scores |
rms:conformancePacks:list |
- |
POST /v1/resource-manager/domains/{domain_id}/stored-queries |
rms:storedQueries:create |
- |
PUT /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id} |
rms:storedQueries:update |
- |
DELETE /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id} |
rms:storedQueries:delete |
- |
GET /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id} |
rms:storedQueries:get |
- |
GET /v1/resource-manager/domains/{domain_id}/stored-queries |
rms:storedQueries:list |
- |
PUT /v1/resource-manager/domains/{domain_id}/policy-assignments |
rms:policyAssignments:create |
- |
DELETE /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id} |
rms:policyAssignments:delete |
- |
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id} |
rms:policyAssignments:get |
- |
GET /v1/resource-manager/domains/{domain_id}/policy-assignments |
rms:policyAssignments:get |
- |
PUT /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id} |
rms:policyAssignments:update |
- |
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/disable |
rms:policyAssignments:update |
- |
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/enable |
rms:policyAssignments:update |
- |
PUT /v1/resource-manager/organizations/{organization_id}/policy-assignments |
rms:organizationPolicyAssignments:put |
|
GET /v1/resource-manager/organizations/{organization_id}/policy-assignments |
rms:organizationPolicyAssignments:list |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id} |
rms:organizationPolicyAssignments:get |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-statuses |
rms:organizationPolicyAssignments:list |
organizations:organizations:get |
GET /v1/resource-manager/organizations/{organization_id}/policy-assignment-detailed-status |
rms:organizationPolicyAssignments:list |
organizations:organizations:get |
DELETE /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id} |
rms:organizationPolicyAssignments:delete |
organizations:organizations:get |
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states |
rms:policyStates:get |
- |
GET /v1/resource-manager/domains/{domain_id}/policy-states |
rms:policyStates:get |
- |
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/policy-states |
rms:policyStates:get |
- |
POST /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/run-evaluation |
rms:policyStates:runEvaluation |
- |
GET /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/evaluation-state |
rms:policyStates:get |
- |
PUT /v1/resource-manager/domains/{domain_id}/policy-states |
rms:policyStates:update |
- |
PUT /v1/resource-manager/domains/{domain_id}/aggregators |
rms:aggregators:create |
- |
PUT /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id} |
rms:aggregators:update |
- |
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id} |
rms:aggregators:delete |
- |
GET /v1/resource-manager/domains/{domain_id}/aggregators |
rms:aggregators:list |
- |
GET /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id} |
rms:aggregators:get |
- |
GET /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/aggregator-sources-status |
rms:aggregators:get |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-summary |
rms:aggregatorResources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignments/compliance |
rms:aggregatorResources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-details |
rms:aggregatorResources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignment/detail |
rms:aggregatorResources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-resource-config |
rms:aggregatorResources:get |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resources |
rms:aggregatorResources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/run-query |
rms:aggregatorResources:runQuery |
- |
POST /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resource-counts |
rms:aggregatorResources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization |
rms:aggregationAuthorizations:list |
- |
PUT /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization |
rms:aggregationAuthorizations:create |
- |
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization/{authorized_account_id} |
rms:aggregationAuthorizations:delete |
- |
DELETE /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request/{requester_account_id} |
rms:aggregationRequests:delete |
- |
GET /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request |
rms:aggregationRequests:list |
- |
PUT /v1/resource-manager/domains/{domain_id}/tracker-config |
rms:trackerConfig:put |
- |
DELETE /v1/resource-manager/domains/{domain_id}/tracker-config |
rms:trackerConfig:delete |
- |
GET /v1/resource-manager/domains/{domain_id}/tracker-config |
rms:trackerConfig:get |
- |
GET /v1/resource-manager/domains/{domain_id}/schemas |
rms:schemas:list |
- |
GET /v1/resource-manager/policy-definitions |
rms:policyDefinitions:get |
- |
GET /v1/resource-manager/policy-definitions/{policy_definition_id} |
rms:policyDefinitions:get |
- |
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/history |
rms:resources:getHistory |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id}/relations |
rms:resources:getRelation |
- |
GET /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources/{resource_id} |
rms:resources:get |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources |
rms:resources:list |
- |
POST /v1/resource-manager/domains/{domain_id}/run-query |
rms:resources:runQuery |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources/summary |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources/tags |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources/count |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id} |
rms:resources:get |
- |
GET /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/relations |
rms:resources:summarize |
- |
GET /v1/resource-manager/domains/{domain_id}/tracked-resources |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/tracked-resources/count |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/tracked-resources/tags |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/tracked-resources/summary |
rms:resources:list |
- |
GET /v1/resource-manager/domains/{domain_id}/tracked-resources/{resource_id} |
rms:resources:get |
- |
POST /v1/resource-manager/{resource_type}/{resource_id}/tags/create |
rms::tagResource |
- |
POST /v1/resource-manager/{resource_type}/{resource_id}/tags/delete |
rms::unTagResource |
- |
GET /v1/resource-manager/{resource_type}/{resource_id}/tags |
rms::listTagsForResource |
- |
GET /v1/resource-manager/{resource_type}/tags |
rms::listTags |
- |
POST /v1/resource-manager/{resource_type}/resource-instances/count |
rms::listResourcesByTag |
- |
POST /v1/resource-manager/{resource_type}/resource-instances/filter |
rms::listResourcesByTag |
- |
资源类型（Resource）
资源类型（Resource）表示SCP所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的SCP语句中指定该资源的URN，SCP仅作用于此资源；如未指定，Resource默认为“*”，则SCP将应用到所有资源。您也可以在SCP中设置条件，从而指定资源类型。
Config定义了以下可以在SCP的Resource元素中使用的资源类型。
资源类型 |
URN |
|---|---|
conformancePacks |
rms::<account-id>:conformancePacks:<conformance-pack-id> |
storedQueries |
rms::<account-id>:storedQueries:<query-id> |
policyAssignments |
rms::<account-id>:policyAssignments:<policy-assignment-id> |
organizationPolicyAssignments |
rms::<account-id>:organizationPolicyAssignments:<organization-id>/<organization-policy-assignments-id> |
organizationConformancePacks |
rms::<account-id>:organizationConformancePacks:<organization-id>/<organization-conformance-pack-id> |
aggregators |
rms::<account-id>:aggregators:<aggregator-id> |
aggregationAuthorizations |
rms::<account-id>:aggregationAuthorizations:<authorized-account-id> |
条件（Condition）
条件（Condition）是SCP生效的特定条件，包括条件键和运算符。
- 条件键表示SCP语句的Condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。
- 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：全局条件键。
- 服务级条件键（前缀为服务缩写，如config:）仅适用于对应服务的操作，详情请参见表4。
- 单值/多值表示API调用时请求中与条件关联的值数。单值条件键在API调用时的请求中最多包含一个值，多值条件键在API调用时请求可以包含多个值。例如：g:SourceVpce是单值条件键，表示仅允许通过某个VPC终端节点发起请求访问某资源，一个请求最多包含一个VPC终端节点ID值。g:TagKeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用API请求时传入标签可以传入多个值。
- 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，SCP才能生效。支持的运算符请参见：运算符。
Config定义了以下可以在SCP的Condition元素中使用的条件键，您可以使用这些条件键进一步细化SCP语句应用的条件。
