Authorizable Resource Types
Last updated: 2024-01-08 09:12:28
Resource-level permission refers to the ability to specify which resources users are allowed to operate on. Cloud Virtual Machine(CVM) has partial support for resource-level permission. This means that for certain CVMs, you can control when users are allowed to operate on them, and what specific resources users are allowed to use. For example, you authorize users to perform operations on specific CVMs in Guangzhou.
The types of resources can be authorized in Cloud Access Management (CAM) are as follows:
Resource Type | Resource Description Method in Authorization Policy |
qcs::cvm:$region::instance/* | |
qcs::cvm:$region::keypair/* | |
qcs::cvm:$region:$account:image/* |
CVM Instance, CVM Key and CVM Image introduce CVM API operations that currently support resource-level permission, as well as resources and condition keys supported by these CVM API operations. When configuring the resource path, you need to change variable parameters such as
$ region, $ account into your actual parameter information. You can also use wildcard * in the path. For more information, see Operation Examples.Note:
CVM API operations not listed in the table do not support resource-level permission. You can still authorize a user to perform these operations, but you must specify * as the resource element in the policy statement.
CVM Instance
API Operation | Resource Path | Condition Key |
DescribeInstanceInternetBandwidthConfigs | qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type |
ModifyInstanceInternetChargeType | qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
ModifyInstancesRenewFlag | qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
RenewInstances | qcs::cvm:$region:$account:instance/* qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceIdqcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageIdqcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyIdqcs::cvm:$region:$account:systemdisk/* | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/* qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageIdqcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyIdqcs::cvm:$region:$account:sg/*qcs::cvm:$region:$account:sg/$sgIdqcs::vpc:$region:$account:subnet/* qcs::vpc:$region:$account:subnet/$subnetIdqcs::cvm:$region:$account:systemdisk/*qcs::cvm:$region:$account:datadisk/*qcs::vpc:$region:$account:vpc/* qcs::vpc:$region:$account:vpc/$vpcId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type | |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceId | cvm:region cvm:zone cvm:instance_type |
CVM Key
API Operation | Resource Path | Condition Key |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceIdqcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyId | - | |
qcs::cvm:$region:$account:keypair/* | - | |
qcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyId | - | |
qcs::cvm:$region:$account:keypair/* | - | |
DescribeKeyPairsAttribute | qcs::cvm:$region:$account:keypair/* qcs::cvm:$region:$account:keypair/$keyId | - |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceIdqcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyId | - | |
qcs::cvm:$region:$account:keypair/* | - | |
qcs::cvm:$region:$account:keypair/*qcs::cvm:$region:$account:keypair/$keyId | - |
CVM Image
API Operation | Resource Path | Condition Key |
qcs::cvm:$region:$account:instance/*qcs::cvm:$region:$account:instance/$instanceIdqcs::cvm:$region:$account:image/* | cvm:region | |
qcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageId | cvm:region | |
qcs::cvm:$region:$account:image/* | cvm:region | |
DescribeImagesAttribute | qcs::cvm:$region:$account:image/* qcs::cvm:$region:$account:image/$imageId | cvm:region |
qcs::cvm:$region:$account:image/* | cvm:region | |
qcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageId | cvm:region | |
qcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageId | cvm:region | |
qcs::cvm:$region:$account:image/*qcs::cvm:$region:$account:image/$imageId | cvm:region |
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No
Feedback