Resource Description Methods

The resource element describes one or more operation objects, such as CVM resources, COS buckets, and others. This document mainly introduces the resource description information of CAM.

Six-Segment Format

All resources can adopt the following six-segment description method. Each product has its own resources and corresponding resource definition details. For information on how to specify resources, see the corresponding product documentation. The six-segment definition method is as follows:

qcs:project_id:service_type:region:account:resource

Where:

• qcs is the abbreviation of qcloud service, indicating that it is the cloud resource of the cloud platform. This field is required.
• project_id describes project information and is only compatible with early CAM logic. The current policy syntax prohibits entering this information.
• service_type describes the abbreviation of the product, such as CVM and CDN. For product test details, see the corresponding product documentation. The value * indicates all products. This field is required.
• region describes the region information. If the value is empty, it represents all regions. For the cloud platform's new unified region naming method, see Region and AZ. The existing region naming method of the cloud platform is defined as follows.

• account describes the root account information of the resource owner. Currently, there are two ways to describe the resource owner: UIN and UID.
• UIN refers to the QQ number of the root account and is expressed as uin/${uin}, such as uin/12345678;
• UID refers to the app ID of the root account and is expressed as uid/${appid}, such as uid/10001234.
• When the value is empty, it represents the root account to which the CAM user who created the policy belongs. Currently, the resource owners of COS and CAS workloads can only be described in UID (you can ignore this step if it is not involved). The resource owners of other workloads can only be described in UIN.
• resource describes the resource details of each product.

1. There are several description methods, and this field is required.

2. Represents the resource ID under a specific resource subclass. For example, instance/ins-abcdefg under VPC products.

   <resource_type>/<resource_id> 
   

3. Represents the path-included resource ID under a specific resource subclass, such as prefix//10001234/bucket1/object2 under COS products. This method supports directory-level prefix matching. For example, prefix//10001234/bucket1/* indicates all objects under bucket1.

   <resource_type>/<resource_path>
   

4. Represents all resources under a specific resource subclass, such as instance/*.

   <resource_type>/*
   

5. Represents all resources under a specific product. ```

6. In some scenarios, the resource element can also be described as `*`. The meaning is defined as follows. For details, see the corresponding product documentation.
7.  When the action requires association with the resource, the resource is defined as `*`, which represents the association with all resources.
8.  When the action does not require association with the resource, the resource needs to be defined as `*`.

### CAM Resource Definition

CAM contains resources such as users, groups, and policies. The description methods of CAM resources are as follows: 

#### Root account:

``` bash
qcs::cam::uin/164256472:uin/164256472

Or

qcs::cam::uin/164256472:root 

Sub-account:

qcs::cam::uin/164256472:uin/73829520

Group:

qcs::cam::uin/164256472:groupid/2340

All users:

qcs::cam::anonymous:anonymous

Or

*

Policies:

qcs::cam:: uin/12345678:policyid/*

Or

qcs::cam:: uin/12345678:policyid/12423

Important Resource Notes

• The resource owner needs to be the root account. If a sub-account creates the resource, it will not automatically have the access permission to the resource unless it obtains authorization from the resource owner.
• COS, CAS, and other workloads support cross-account authorization of resource access permissions. The authorized account can authorize resources to its sub-accounts by means of permission transfer.