Authorizable Resource Type

Policy Syntax

CAM policy:

{     
        "version":"2.0", 
        "statement": 
        [ 
           { 
              "effect":"effect", 
              "action":["action"], 
              "resource":["resource"], 
               "condition": {"key":{"value"}} 
           } 
       ] 
}

• The version is required, currently only allowing a value of "2.0".
• Statement is used to describe the detailed information of one or more permissions. This element includes the permissions or permission sets of multiple other elements such as effect, action, resource, and condition. A policy has one and only one statement element.

1. action used to describe the operations that are allowed or denied. Operations can be APIs (described with a name prefix) or feature sets (a specific set of APIs described with a permid prefix). This element is required.
2. resource describes the detailed data authorized. Resources are described using six paragraphs. The resource definition details will vary for each product. For information on how to specify resources, please refer to the product documentation corresponding to the resource declaration you have written. This element is required.
3. conditions describes the constraints under which the policy takes effect. Conditions consist of operators, operation keys, and operation values. Condition values can include information such as time and IP address. Some services allow you to specify additional values in the condition. This element is optional.
4. effect describes whether the statement produces an "allow" or "explicit deny" result. It includes allow and deny. This element is required.

VPC Operations

In the CAM policy statement, you can specify any API operation from any service that supports CAM. For VPC, use APIs prefixed with name/vpc:. For example, name/vpc:Describe or name/vpc:CreateRoute.
If you want to specify multiple actions in a single statement, separate them with commas as follows:

"action":["name/vpc:action1","name/vpc:action2"]

You can also use wildcard characters to specify multiple actions. For example, you can specify all actions whose names begin with the word Describe as follows:

"action":["name/vpc:Describe*"]

To specify all operations in a VPC, use a wildcard (*) as follows:

"action":["name/vpc:*"]

VPC Resource Paths

Each CAM policy statement has its own resources that apply to it.
The general format of resource paths is as follows:

**qcs:project_id:service_type:region:account:resource**

• project_id: Describe the project information. It is only for compatibility with early CAM logic and does not need to be filled in.
• service_type: the product abbreviation, such as VPC.
• region: regional information, such as bj.
• account: the root account information of the resource owner, such as uin/164256472.
• resource: the specific resource details of each product, such as vpc/vpc_id1 or vpc/*.
  For example, you can specify an instance (vpc-d08sl2zr in this case) in the statement, as shown below:

"resource":[ "qcs::vpc:bj:uin/164256472:instance/vpc-d08sl2zr"]

You can also use the * wildcard character to specify all instances belonging to a specific account, as follows:

"resource":[ "qcs::vpc:bj:uin/164256472:instance/*"]

If you want to specify all resources, or if a specific API operation does not support resource-level permissions, use the * wildcard in the Resource element as shown:

"resource": ["*"]

To specify multiple resources in one instruction, separate them with a comma. The following is an example of specifying two resources:

"resource":["resource1","resource2"]

The following table describes the resources that can be used by VPC and the corresponding methods of describing these resources.

In the following table, words prefixed with $ are aliases.

• Here, project refers to the Project ID.
• Here, region refers to the Region.
• Here, account refers to the Account ID.