VPC CAM Policy Examples

Full Read-Write Policy of VPC

The following policy allows you to create and manage VPC. You can associate this policy with a group of network administrators. The Action element specifies all VPC-related APIs.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Read-only Policy of VPC

The following policy allows you to query your VPC and relevant resources. However, you cannot create, update, or delete them with this policy.
In the console, the premise of operating a resource is that it can be viewed, so it is recommended you open VPC read-only permissions for users.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:Describe*",
                "name/vpc:Inquiry*",
                "name/vpc:Get*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Only sub-accounts are allowed to manage a single VPC

The following policies allow users to see all VPCs but only operate VPC A (assuming that the ID of A is vpc-d08sl2zr) and network resources under A (such as subnets and routing tables, excluding CVM and databases) and do not allow users to manage other VPCs.
This version does not support Only Allowing Users to View A, which will be supported in subsequent versions.

{
    "version": "2.0",
    "statement": [
        {
            "action": "name/vpc:*",
            "resource": "*",
            "effect": "allow",
            "condition": {
                "string_equal_if_exist": {
                    "vpc:vpc": [
                    "vpc-d08sl2zr"
                    ],
                    "vpc:accepter_vpc": [
                     "vpc-d08sl2zr"
                    ],
                     "vpc:requester_vpc": [
                     "vpc-d08sl2zr"
                    ]
                }
            }
        }
    ]
}

Users are allowed to manage VPC but cannot operate routing table

The following policies allow users to read and write the VPC and its related resources but do not allow users to perform related operations on routing tables.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "name/vpc:AssociateRouteTable",
                "name/vpc:CreateRoute",
                "name/vpc:CreateRouteTable",
                "name/vpc:DeleteRoute",
                "name/vpc:DeleteRouteTable",
                "name/vpc:ModifyRouteTableAttribute"
            ],
            "resource": "*",
            "effect": "deny"
        }
    ]
}

Users are allowed to manage VPC resources

This policy allows users to view all VPC resources but only allows them to add, delete, modify, and check VPNs.

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:Describe*",
                "name/vpc:Inquiry*",
                "name/vpc:Get*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "name/vpc:*Vpn*",
                "name/vpc:*UserGw*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}