Resource-level permissions refer to the ability to specify which resources a user can perform operations on. CBS supports resource-level permissions, meaning that for CBS operations supporting resource-level permissions, it controls when users are allowed to perform operations or which specific resources users can use.
The types of resources that can be authorized in CAM are as follows:
| Resource Type | Resource Description Method in Authorization Policies |
|---|---|
| CBS instance-related | qcs::brc:$region::volume/* |
CBS instance-related introduces the CBS API operations that currently support resource-level permissions and the resources and conditional keys supported by each operation. When setting the resource path, you need to modify variable parameters such as $region and $account to your actual parameter information. You can also use the * wildcard in the path.
Note:
CBS API operations not listed in the table indicate that the API operations do not support resource-level permissions. For API operations that do not support resource-level permissions, you can still grant users permission to use the operation, but the resource element of the policy statement must be specified as
*.
CBS Instance-related
| API Operation | Resource Path | Conditional Key |
|---|---|---|
| Attaching cloud disks (AttachDisks) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Creating cloud disks (CreateDisks) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Querying the list of cloud disk operation logs (DescribeDiskOperationLogs) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Querying the cloud disk list (DescribeDisks) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Detaching cloud disks (DetachDisks) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Modifying cloud disk attributes (ModifyDiskAttributes) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Expanding cloud disks (ResizeDisk) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |
| Returning cloud disks (TerminateDisks) | qcs::cvm:$region:$account:volume/*qcs::cvm:$region:$account:volume/$diskId |
cvm:region cvm:zone cvm:disk_type |