IP-based Access Restriction

Scenarios

This document describes how to restrict sub-accounts' access actions based on IP through custom policies. After successful setting, the sub-account will be allowed for or denied from managing resources under the root account based on the set IP.

Prerequisites

The involved product supports IP-based workload access restriction. For details, see the FAQs.

Operation Steps

1. Enter the Policy Management page and click Create Custom Policy in the upper left corner.
2. In the pop-up window for selecting a creation method, click Create by Policy Generator to enter the page of selecting services and operations.
3. On the page of selecting services and operations, provide the following information.

• Effect (required): Select "Allow". If you select "Deny", the user or user group cannot obtain authorization.
• Service (required): Select the product to be added.
• Action (required): Select the product permissions as needed.
• Resource (required): You can enter it by referring to the Resource Description Method.
• Condition: Select conditions as needed and enter the IP address. Multiple restrictions can be added. For example, if Allow is selected for Effect, authorization is only granted to users or groups using the specified IP address.

Use Case

The policy syntax is as follows.

{
    "version": "2.0",
    "statement": [
        {
            "effect": "allow",
            "action": "cos:PutObject",
            "resource": "*",
            "condition": {
                "ip_equal": {
                    "qcs:ip": [
                        "10.217.182.3/24",
                        "111.21.33.72/24"
                    ]
                }
            }
        }
    ]
}