tencent cloud

Virtual Private Cloud

Release Notes and Announcements
Release Notes
Announcements
Tencent Cloud Network Overview
Product Introduction
Overview
Strengths
Use Cases
Concepts
Quota Limit
Service Regions and Service Providers
Purchase Guide
Billing Overview
Payment Overdue
Quick Start
Network Planning
VPC Connections
Building Up an IPv4 VPC
Operation Guide
Network Topology
Network performance dashboard
Virtual Private Cloud (VPC)
Subnets
Route Tables
Elastic IP
HAVIPs
Elastic Network Interface
Bandwidth Package
Network Connection
Security Management
Diagnostic Tools
Alarming and Monitoring
Practical Tutorial
View the Total Bandwidth for Single-Region Traffic-Based Billing
Migrating from the Classic Network to VPC
Best Practices of Security Group Change
Configuring CVM Instance as Public Gateway
Building HA Primary/Secondary Cluster with HAVIP + Keepalived
Hybrid Cloud Primary/Secondary Communication (DC and VPN)
Hybrid Cloud Primary/Secondary Communication (CCN and VPN)
CVM Access to Internet Through EIP
Troubleshooting
VPCs or Subnets Cannot Be Deleted
Network Disconnection After Connecting Two VPCs over CCN
Failed to Ping CVMs in the Same VPC
API Documentation
History
Introduction
API Category
Making API Requests
VPC APIs
Route Table APIs
Elastic Public IP APIs
Elastic IPv6 APIs
Highly Available Virtual IP APIs
ENI APIs
Bandwidth Package APIs
NAT Gateway APIs
Direct Connect Gateway APIs
Cloud Connect Network APIs
Network ACL APIs
Network Parameter Template APIs
Network Detection-Related APIs
Flow Log APIs
Gateway Traffic Monitor APIs
Private Link APIs
Traffic Mirroring APIs
Other APIs
Subnet APIs
VPN Gateway APIs
Security Group APIs
Snapshot Policy APIs
Error Codes
Data Types
FAQs
General
Connection
Security
Contact Us
Glossary
DocumentationVirtual Private CloudOperation GuideSecurity ManagementAccess ManagementVPC Access Management Policy Examples

VPC Access Management Policy Examples

PDF
Focus Mode
Font Size
Last updated: 2024-10-22 16:16:43

Full Read-Write Policy of VPC

The following policy allows you to create and manage VPC instances. You can associate this policy with a group of network admins. The Action element specifies all VPC-related APIs.
{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Read-only Policy of VPC

The following policy allows you to query your VPC instances and relevant resources. However, you cannot create, update, or delete them with this policy. We recommend that you grant the VPC read-only permission for users, because they have to be able to view the resource in order to operate it in the console.
{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:Describe*",
                "name/vpc:Inquiry*",
                "name/vpc:Get*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}

Allowing a Sub-Account to Manage Only a Single VPC

The following policy allows a user to view all VPC instances but only to be able to operate VPC A (for example, VPC A with an ID of vpc-d08sl2zr) and network resources in VPC A (such as subnets and route tables, but excluding cloud virtual machines (CVMs) and databases). In other words, the user is not allowed to manage other VPC instances. This version does not support allowing the user to see A only, which however will be supported in future versions.
{
    "version": "2.0",
    "statement": [
        {
            "action": "name/vpc:*",
            "resource": "*",
            "effect": "allow",
            "condition": {
                "string_equal_if_exist": {
                    "vpc:vpc": [
                    "vpc-d08sl2zr"
                    ],
                    "vpc:accepter_vpc": [
                     "vpc-d08sl2zr"
                    ],
                     "vpc:requester_vpc": [
                     "vpc-d08sl2zr"
                    ]
                }
            }
        }
    ]
}

Allowing a User to Manage VPC Instances But Not Operate Route Tables

The following policy allows a user to read and write VPC instances and relevant resources, but disallows the user to operate route tables.
{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "name/vpc:AssociateRouteTable",
                "name/vpc:CreateRoute",
                "name/vpc:CreateRouteTable",
                "name/vpc:DeleteRoute",
                "name/vpc:DeleteRouteTable",
                "name/vpc:ModifyRouteTableAttribute"
            ],
            "resource": "*",
            "effect": "deny"
        }
    ]
}

Allowing a User to Manage VPN Resources

The following policy allows a user to view all VPC resources, while only allows the user to create, read, update, and delete (CRUD) the resources on VPNs.
{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "name/vpc:Describe*",
                "name/vpc:Inquiry*",
                "name/vpc:Get*"
            ],
            "resource": "*",
            "effect": "allow"
        },
        {
            "action": [
                "name/vpc:*Vpn*",
                "name/vpc:*UserGw*"
            ],
            "resource": "*",
            "effect": "allow"
        }
    ]
}
Previous Topic: Authorizable Resource TypesNext Topic: Resource-Level Permissions Supported by VPC APIs

Help and Support

Was this page helpful?

Help us improve! Rate your documentation experience in 5 mins.

Feedback