Policy Variable

Use Cases

Scenario assumption: You want to grant each CAM user access to the resources they create. For example, you want to set that the creator of a COS resource has access to that resource by default.
If the resource owner (root account) authorizes each resource individually to the resource creator, the authorization cost is high, requiring writing policies for each resource type and authorizing them to the creator. In this case, you can achieve your requirement by using policy variables. Add placeholder information describing the creator in the resource definition of the policy, and this placeholder is the policy variable. During authentication, the policy variable will be replaced with context information from the request itself.

You can grant resource read permissions to the resource creator as follows.

{     
        "version":"2.0", 
        "statement":        
         { 
            "effect":"allow", 
            "action":"name/cos:Read*", 
            "resource":"qcs::cos::uid/1238423:prefix/${uin}/*" 
         }
}

• Policy variable includes the creator's UIN in the path of each resource. For example, if a user (UIN is 12356) creates a bucket (name is test), the corresponding resource description is as follows.

qcs::cos::uid/1238423:prefix/12356/test

• When a user (UIN is 12356) accesses the resource, during authentication, the placeholders in the corresponding policy information will be replaced with the visitor.

qcs::cos::uid/1238423:prefix/12356/

• Based on the prefix of the resource (qcs::cos::uid/1238423:prefix/12356/) in the policy, you can access the resource qcs::cos::uid/1238423:prefix/12356/test.

Policy Variable Location

Resource element location: Policy variables can be used in the last segment of the six-segment resource.
Conditional element location: Policy variables can be used in condition values.

The following policy indicates that the VPC creator has access to the resource.

{  
        "version":"2.0", 
        "statement":        
         { 
            "effect":"allow", 
            "action":"name/vpc:*", 
            "resource":"qcs::vpc::uin/12357:vpc/*"
            "condition":{"string_equal":{"qcs:create_uin":"${uin}"}} 
         }
}

Policy Variable List

The list of the currently supported policy variables is as follows: