Element Reference

A policy consists of several elements used to describe specific authorization information. Core elements include principal, action, resource, condition, and effect. The reserved word element can only be lowercase. There are no specific order requirements in description. For policies without specific conditional constraints, the condition element is optional. The principal element cannot be written in the console; it can only be used in policy management APIs and parameters related to policy syntax.

1.Version

Describes the syntax version of a policy. This element is required. Currently, the value can only be "2.0".

2.Principal

Describes the entity that the policy authorizes. It includes users (developers, sub-accounts, and anonymous users) and user groups. In the future, it will include more entities such as roles, federated users, and others. This element is only supported in policy syntax-related parameters in policy management APIs.

3.Statement

Describes the detailed information of one or more permissions. This element includes action, resource, condition, effect, and other related elements representing a single permission or a set of permissions. A policy should contain exactly one statement element.

4.Action

Describes the allowed or denied actions. An action can be an API (described by a name prefix) or a feature set (a set of specific APIs described by a permid prefix). This element is required.

5.Resource

Describes the detailed data to be authorized. A resource is described in a six-segment format. Detailed resource definitions vary by product. For more information on how to specify a resource, see the product documentation corresponding to the resources for which you are writing a statement. This element is required.

6.Condition

Describes the constraints for policy enforcement. A condition consists of an operator, key, and value. Condition values can include time, IP address, and other parameters. Some services allow you to specify other values in the condition. This element is optional.

7.Effect

Describes whether the result of the statement is "allow" or "deny". The possible values are allow and deny. This element is required.

8.Policy Example

In this example, the description is: Allow the sub-account (ID is 3232523) and the group (ID is 18825) under the developer (ID is 1238423) to have permissions of reading APIs and writing objects for all Cloud Object Storage (COS) and the permission of sending message queues on object2 under COS bucketA (Beijing) and COS bucketB (Guangzhou) when the access IP range is 10.121.2.

{
    "version": "2.0",
    "principal": {
        "qcs": [
            "qcs::cam::uin/1238423:uin/3232523",
            "qcs::cam::uin/1238423:groupid/18825"
        ]
    },
    "statement": [
        {
            "effect": "allow",
            "action": [
                "name/cos:PutObject",
                "permid/280655"
            ],
            "resource": [
                "qcs::cos:bj:uid/1238423:prefix//1238423/bucketA/*",
                "qcs::cos:gz:uid/1238423:prefix//1238423/bucketB/object2"
            ],
            "condition": {
                "ip_equal": {
                    "qcs:ip": "10.121.2.10/24"
                }
            }
        },
        {
            "effect": "allow",
            "action": "name/cmqqueue:Sendmessages",
            "resource": "*"
        }
    ]
}