{
"version":"2.0",
"statement":
[
{
"effect":"effect",
"action":["action"],
"resource":["resource"],
"condition": {"key":{"value"}}
}
]
}
In a CAM policy statement, you can specify any API operation from any service that supports CAM. APIs prefixed with "redis:" should be used for Redis, such as redis:CreateRedis or redis:DeleteInstance.
To specify multiple actions in a single statement, separate them with commas, as shown below:
"action":["redis:action1","redis:action2"]
You can also specify multiple actions using a wildcard. For example, you can specify all actions whose name begins with "Describe", as shown below:
"action":["redis:Describe*"]
If you want to specify all operations in Redis, use a wildcard "*" as shown below:
"action":["redis:*"]
Each CAM policy statement has its own resources.
The general form of resource path is as follows:
qcs:project_id:service_type:region:account:resource
For example, you can specify a resource for a specific instance (crs-psllioc8) in a statement as shown below:
"resource":[ "qcs::redis:bj:uin/12345678:instance/crs-psllioc8"]
You can also use the wildcard "*" to specify all instances that belong to a specific account as shown below:
"resource":[ "qcs::redis:bj:uin/12345678:instance/*"]
If you want to specify all resources or if a specific API operation does not support resource-level permission control, you can use the wildcard "*" in the "resource" element as shown below:
"resource": ["*"]
To specify multiple resources in a single command, separate them with commas. Below is an example where two resources are specified:
"resource":["resource1","resource2"]
The table below describes the resources that can be used by Redis and the corresponding resource description methods, where words prefixed with $ are placeholders, "region" refers to a region, and "account" refers to an account ID.
Resource | Resource Description Method in Authorization Policy |
---|---|
Instance | qcs::redis:$region:$account:instance/$instanceId |
VPC | qcs::vpc:$region:$account:vpc/$vpcId |
Security group | qcs::cvm:$region:$account:sg/$sgId |
Was this page helpful?