Authorization Policy Syntax

Policy Syntax

CAM policy:

{     
        "version":"2.0", 
        "statement": 
        [ 
           { 
              "effect":"effect", 
              "action":["action"], 
              "resource":["resource"], 
               "condition": {"key":{"value"}} 
           } 
       ] 
} 

• version: It is required, currently only allowing a value of 2.0.
• statement: used to describe the detailed information of one or more permissions. This element includes the permissions or permission sets of multiple other elements such as effect, action, resource, condition, etc. A policy has one and only one statement element.
  1. action: used to describe the operations that are allowed or denied. Operations can be APIs (described with a name prefix) or feature sets (a specific set of APIs described with a permid prefix). This element is required.
  2. resource: describes the specific data of the authorization. Resources are described using six paragraphs. The resource definition details will vary for each product. This element is required.
  3. condition: describes the constraints under which the policy takes effect. Conditions consist of operators, operation keys, and operation values. Condition values can include information such as time and IP address. Some services allow you to specify additional values in the condition. This element is optional.
  4. effect: describes whether the statement produces an allow or explicit deny result. There are two situations: allow and deny (explicitly deny). This element is required.

CBS Actions

In CAM policy statements, you can specify any API operation from any services that support CAM. For CBS, use APIs prefixed with name/cvm:. For example: name/cvm:CreateDisks or name/cvm:DescribeDisks.
If you want to specify multiple operations in a single statement, separate them with commas as shown below:

"action":["name/cvm:action1","name/cvm:action2"]

You can also use wildcard characters to specify multiple actions. For example, you can specify all operations whose names begin with the word Describe as follows:

"action":["name/cvm:Describe*"]

To specify all operations for the corresponding CVM, use the * wildcard as follows:

"action":["name/cvm:*"]

CBS Resource Paths

Each CAM policy statement has its own resources that apply to it. The general format of resource paths is as follows:

qcs:project_id:service_type:region:account:resource

• project_id: Describe the project information. It is only for compatibility with early CAM logic and does not need to be filled in.
• service_type: The product abbreviation, such as CVM.
• region: regional information, such as bj.
• account: the root account information of the resource owner, such as uin/164256472.
• resource: The specific resource details of each product, such as volume/diskid1 or volume/*.
  For example, you can specify it in a statement using the specific CBS resource (disk-abcdefg), as follows:

"resource":[ "qcs::cvm:bj:uin/164256472:volume/disk-abcdefg"]

You can also use the * wildcard to specify all CBS resources belonging to a specific account, as follows:

"resource":[ "qcs::cvm:bj:uin/164256472:volume/*"]

If you want to specify all resources, or if a specific API operation does not support resource-level permissions, use the * wildcard in the Resource element, as follows:

"resource": ["*"]

To specify multiple resources in one instruction, separate them with a comma. The following is an example of specifying two resources:

"resource":["resource1","resource2"]

CBS Conditional Key

In a policy statement, you can optionally specify conditions that control when a policy takes effect. Each condition consists of one or more key-value pairs. Conditional keys are not case sensitive.

• If you specify multiple conditions or multiple keys in a single condition, we evaluate them using a logical AND operation.
• If you specify a key with multiple values in a single condition, we will evaluate it using a logical OR operation. Permissions will be granted only if all conditions are met.
  The following table describes the service-specific condition keys used by CBS: