Conditions

Use Cases

In many scenarios, you may need to define the conditions of the created policies further.

• Scenario 1: When CAM users call the cloud API, their access sources need to be restricted. In this case, IP conditions should be added based on existing policies.
• Scenario 2: When CAM users call the VPC peering connection API, in addition to verifying whether they have the access permission to the peering connection API and its resources, it is also necessary to confirm whether they have the access permission to the VPC associated with the peering connection.

Syntax Structure

The syntax structure of conditions is shown in the following figure. A condition block can be composed of several sub-condition blocks. Each sub-condition block corresponds to a condition operator and several condition keys, and each condition key corresponds to several condition values.

Evaluation Logic

The evaluation logic for the conditions to take effect is as follows.

1. A condition key corresponds to multiple condition values, and the condition takes effect as long as the corresponding key value in the context meets any of the condition values under the action of the associated condition operator.
2. When there are multiple condition keys in a sub-condition block, the sub-condition block takes effect only when all conditions corresponding to each condition key take effect.
3. If a condition contains multiple sub-condition blocks, the condition takes effect only when all sub-condition blocks take effect.
4. For condition operators with the "_if_exist" suffix, the condition takes effect even if the context does not contain the condition key associated with the condition operator.
5. for_all_value: a qualifier-constrained condition operator, applicable in scenarios where a condition key in the context includes multiple values. The condition takes effect only when each value of the condition key in the context takes effect under the action of the associated condition operator.
6. for_any_value: a qualifier-constrained condition operator, applicable in scenarios where a condition key in the context includes multiple values. The condition takes effect as long as any of the values of the condition key in the context take effect under the action of the associated condition operator.

Example

1. The following example indicates that the user should be within the 10.217.182.3/24 or 111.21.33.72/24 IP range to call the cloud API.

   {
    "version": "2.0",
    "statement": {
        "effect": "allow",
        "action": "cos:PutObject",
        "resource": "*",
        "condition": {
            "ip_equal": {
                "qcs:ip": [
                    "10.217.182.3/24",
                    "111.21.33.72/24"
                ]
            }
        }
    }
   }
   

2. The following example describes that a VPC is allowed to bind to the specified NAT gateway, and the VPC should be located in Shanghai.

   {
    "version": "2.0",
    "statement": {
        "effect": "allow",
        "action": "name/vpc:AcceptVpcPeeringConnection",
        "resource": "qcs::vpc:sh::pcx/2341",
        "condition": {
            "string_equal_if_exist": {
                "vpc:region": "ACX01"
            }
        }
    }
   }
   

List of Condition Operators

The following table shows information about condition operators, condition names, and examples. Please refer to the corresponding product documentation for custom condition keys for each product.

Note:

1. The date format should follow the standard ISO 8601, and the UTC time should be adopted.
2. The IP format should conform to the CIDR specification.
3. The condition operator (except null_equal) with the suffix "_if_exist" indicates that the condition still takes effect even if the context does not contain the corresponding key value.
4. for_all_value: a qualifier used with condition operators, indicating that a condition takes effect only when every value of the condition key in the context meets the requirement.
5. for_any_value: a qualifier used with condition operators, indicating that the condition takes effect if any value of the condition key in the context meets the requirement.
6. Some workloads do not support the conditions or only support partial conditions. For details, see the workload documentation.