The types of CLB resources that can be authorized in CAM are
| Resource Type | Resource Description Method in Authorization Policies |
|---|---|
| CLB Instance | qcs::clb:$region::clb/$loadbalancerid |
| CLB Listener | qcs::clb:$region::listener/$loadbalancerlistenerid |
| CLB backend server | qcs::cvm:$region:$account:instance/$cvminstanceid |
Where:
- All
$regionshould be the ID of a region and can be empty. - All
$accountshould be the AccountId of the resource owner, or "*". - All
$loadbalanceridshould be the ID of a loadbalancer, or "*".
And so on.
API in CAM that can authorize CLB
In CAM, the following actions can be authorized for a CLB resource.
Instance related
| API Operations | Resource Description | API Description |
|---|---|---|
| DescribeLoadBalancers | Query the list of CLB instances | * authenticate only the API. |
| CreateLoadBalancer | Purchase a CLB | qcs:$projectid:clb:$region:$account:clb/* |
| DeleteLoadBalancers | Delete a CLB | qcs::clb:$region:$account:clb/$loadbalancerid |
| ModifyLoadBalancerAttributes | Modify CLB attribute information | qcs::clb:$region:$account:clb/$loadbalancerid |
| ModifyForwardLBName | Change the name of the CLB | qcs::clb:$region:$account:clb/$loadbalancerid |
Listener related
| API Operations | Resource Description | API Description |
|---|---|---|
| DeleteLoadBalancerListeners | Delete CLB listeners | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| DescribeLoadBalancerListeners | Get the list of CLB listeners | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/* |
| ModifyLoadBalancerListener | Modify the CLB listener attributes | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| CreateLoadBalancerListeners | Create a CLB listener | qcs::clb:$region:$account:clb/$loadbalancerid |
| DeleteForwardLBListener | Delete CLB listeners (layer-4 and layer-7) | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| ModifyForwardLBSeventhListener | Modify the attributes of the CLB layer-7 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| ModifyForwardLBFourthListener | Modify the attributes of the CLB layer-4 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| DescribeForwardLBListeners | Query the CLB listener list | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/* |
| CreateForwardLBSeventhLayerListeners | Create a layer-7 CLB listener | qcs::clb:$region:$account:clb/$loadbalancerid |
| CreateForwardLBFourthLayerListeners | Create a layer-4 CLB listener | qcs::clb:$region:$account:clb/$loadbalancerid |
Load balancing domain name + URL related
| API Operations | Resource Description | API Description |
|---|---|---|
| ModifyForwardLBRulesDomain | Modify the domain name of the CLB listener forwarding rule | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| CreateForwardLBListenerRules | Create a CLB listener forwarding rule | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| DeleteForwardLBListenerRules | Delete the layer-7 CLB listener rule | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
| DeleteRewrite | Delete the redirection relationship between CLB forwarding rules | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$sourceloadbalancerlistenerid``qcs::clb:$region:$account:listener/$targetloadbalancerlistenerid |
| ManualRewrite | Manually add a redirection relationship for a CLB forwarding rule | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$sourceloadbalancerlistenerid``qcs::clb:$region:$account:listener/$targetloadbalancerlistenerid |
| AutoRewrite | Automatically generate redirection relationships for CLB forwarding rules | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |
Backend server related
| API Operations | Resource Description | API Description |
|---|---|---|
| ModifyLoadBalancerBackends | Modify the backend server weight of the CLB | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::cvm:$region:$account:instance/$loadbalancerlistenerid |
| DescribeLoadBalancerBackends | Get the list of backend servers bound to the CLB | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/* |
| DeregisterInstancesFromLoadBalancer | Unbind the backend server | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| RegisterInstancesWithLoadBalancer | Bind the backend server to the CLB | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| DescribeLBHealthStatus | Query the health status of the CLB | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/* |
| ModifyForwardFourthBackendsPort | Modify the port of the CVM in the forwarding rule of the layer-4 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| ModifyForwardFourthBackendsWeight | Modify the weight of the CVM in the forwarding rule of the layer-4 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| RegisterInstancesWithForwardLBSeventhListener | Bind the CVM to the forwarding rules of the CLB layer-7 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| RegisterInstancesWithForwardLBFourthListener | Bind the CVM to the forwarding rules of the CLB layer-4 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| DeregisterInstancesFromForwardLBFourthListener | Unbind the CVM from the forwarding rule of the CLB layer-4 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| DeregisterInstancesFromForwardLB | Unbind the CVM from the forwarding rule of the CLB layer-7 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| ModifyForwardSeventhBackends | Modify the weight of the CVM in the forwarding rule of the layer-7 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| ModifyForwardSeventhBackendsPort | Modify the port of the CVM in the forwarding rule of the layer-7 listener | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid``qcs::cvm:$region:$account:instance/$cvminstanceid |
| DescribeForwardLBBackends | Query the CLB CVM list | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::cvm:$region:$account:instance/* |
| DescribeForwardLBHealthStatus | Query the health check status of the CLB | qcs::clb:$region:$account:clb/* |
| ModifyLoadBalancerRulesProbe | Modify the health check and forwarding path of the CLB listener forwarding rule | qcs::clb:$region:$account:clb/$loadbalancerid``qcs::clb:$region:$account:listener/$loadbalancerlistenerid |