Authorization Policy Syntax

Policy Syntax

CAM policy:

{     
        "version":"2.0", 
        "statement": 
        [ 
           { 
              "effect":"effect", 
              "action":["action"], 
              "resource":["resource"], 
               "condition": {"key":{"value"}} 
           } 
       ] 
} 

• The version is required, currently only allowing a value of "2.0".
• statement is used to describe the detailed information of one or more permissions. This element includes the permissions or permission sets of multiple other elements such as effect, action, resource, and condition. A policy has one and only one statement element.
• action used to describe the operations that are allowed or denied. Operations can be APIs (described with a name prefix) or feature sets (a specific set of APIs described with a permid prefix). This element is required.
• resource describes the detailed data authorized. Resources are described using six paragraphs. The resource definition details will vary for each product. For information on how to specify resources, please refer to the product documentation corresponding to the resource declaration you have written. This element is required.
• conditions describes the constraints under which the policy takes effect. Conditions consist of operators, operation keys, and operation values. Condition values can include information such as time and IP address. Some services allow you to specify additional values in the condition. This element is optional.
• effect describes whether the statement produces an allow or explicit deny result. It includes allow and deny. This element is required.

CVM Operations

In the CAM policy statement, you can specify any API operation from any service that supports CAM. For CVM, please use name/cvm: as the prefix of APIs. For example: name/cvm:RunInstances or name/cvm:ResetInstancesPassword.
If you want to specify multiple actions in a single statement, separate them with commas as follows:

"action":["name/cvm:action1","name/cvm:action2"]

You can also use wildcard characters to specify multiple actions. For example, you can specify all actions whose names begin with the word " Describe " as follows:

action:["name/cvm:Describe*"]

To specify all operations in a CVM, please use a wildcard * as follows:

action:["name/cvm:*"]

CVM Resource Paths

Each CAM policy statement has its own resources that apply to it.
The general format of resource paths is as follows:

qcs:project_id:service_type:region:account:resource

project_id: describes the project information. It is only for compatibility with early CAM logic and does not need to be filled in.
service_type: the product abbreviation, such as VPC
region: regional information, such as bj
account: the root account information of the resource owner, such as uin/164256472
resource: specific resource details of each product, such as instance/instance_id1 or instance/*
For example, you can specify an instance (i-15931881scv4) in the statement, as shown below:

"resource":[ "qcs::cvm:bj:uin/164256472:instance/i-15931881scv4"]

You can also use the * wildcard character to specify all instances belonging to a specific account, as follows:

resource:[ "qcs::cvm:bj:uin/164256472:instance/*"]

If you want to specify all resources, or if a specific API operation does not support resource-level permissions, use the * wildcard in the Resource element as shown:

"resource": "*"

To specify multiple resources in one instruction, please separate them with a comma. The following is an example of specifying two resources:

resource:["resource1","resource2"]

The following table describes the resources that can be used by CVM and the corresponding methods of describing these resources. In the following table, words prefixed with $ are aliases.

• Among them, project refers to the project ID.
• Region refers to the region.
• Account refers to the account ID.

Conditional Key for CVM

In a policy statement, you can optionally specify conditions that control when a policy takes effect. Each condition consists of one or more key-value pairs. Condition keys are not case sensitive.

• If you specify multiple conditions or multiple keys in a single condition, we evaluate them using a logical AND operation.
• If you specify a key with multiple values in a single condition, we evaluate them using a logical OR operation. All conditions must be matched for permission to be granted.
  The following table describes the service-specific condition keys that CVM uses.