tencent cloud

Tencent Cloud Distributed Cache (Redis OSS-Compatible)

Release Notes and Announcements
Release Notes
Announcements
User Tutorial
Product Introduction
Overview
Product Strengths
Use Cases
Storage Engine
Product Series
Product Versions
Specifications and Performance
Read/Write Separation
Multi-AZ Deployment
Regions and AZs
Terms
Service Regions and Service Providers
Purchase Guide
Billing Overview
Pricing Center
Instance Purchasing
Renewal (Yearly/Monthly Subscription)
Refund (Yearly/Monthly Subscription)
Overdue Payments
Switching from Pay-as-You-Go to Yearly/Monthly Subscription
Getting Started
Quickly Creating an Instance
Connecting to Redis Instance
Operation Guide
Operation Overview
Connecting to a Database Instance
Managing Instances
Upgrade Instance
Management Node (Redis/ValKey Edition)
Multi-AZ Deployment Management
Backup and Restoration
Managing Accounts
Parameter Configuration
Slow Query
Access Management
Network and Security
Monitoring and Alarms
Event Management (Redis/ValKey Edition)
Data Migration
Global Replication for Redis Edition
Database Audit
Performance Optimization
Sentinel Mode
Development Guidelines
Naming Rules
Basic Usage Guidelines
Design Principles of Key and Value
Command Usage Guidelines
Design Principles of Client Programs
Connection Pool Configuration
Command Reference
Command Reference Overview
Redis Edition and Valkey Edition Command Compatibility
Version Command Usage Differences
Differences Between the Proxy Architecture and Direct Connection Mode
More Command Operations (Redis/Valkey Edition)
Memcached Edition Command Compatibility
Practical Tutorial
Building TencentDB for Redis® Client Monitoring Based on Spring Boot
Redis Client Connection Configuration Policy and Practice
Global SCAN Guide for Cluster Architecture
Eliminating Instances Securely
Hot Key and Big Key
AZ Migration Scheme
Troubleshooting
Connection Exception
Exception Analysis and Solution of Redisson Client Timeout Reconnection
Performance Troubleshooting and Fine-Tuning
API Documentation
History
Introduction
API Category
Making API Requests
Instance APIs
Parameter Management APIs
Other APIs
Backup and Restoration APIs
Region APIs
Monitoring and Management APIs
Log APIs
Data Types
Error Codes
FAQs
General
Connection and Login
Purchase
Service Agreement
Service Level Agreement
Terms of Service
Glossary
Contact Us
문서Tencent Cloud Distributed Cache (Redis OSS-Compatible)Operation GuideAccess ManagementAuthorization Policy Syntax

Authorization Policy Syntax

PDF
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-03-17 17:45:59

CAM Policy Syntax

{     
        "version":"2.0", 
        "statement": 
        [ 
           { 
              "effect":"effect", 
              "action":["action"], 
              "resource":["resource"], 
               "condition": {"key":{"value"}} 
           } 
       ] 
}
version: it is required. Currently, only "2.0" is allowed.
statement: describes the details of one or more privileges. This element contains a privilege or privilege set of other elements such as effect, action, resource, and condition. One policy has only one statement.
effect: describes whether the result produced by the statement is "allowed" (allow) or "denied" (deny). This element is required.
action: describes the allowed or denied operation. An operation can be an API or a feature set (a set of specific APIs prefixed with "permid"). This element is required.
resource: describes the details of authorization. A resource is described in a six-piece format. Detailed resource definitions vary by product. This element is required.
condition: describes the condition for the policy to take effect. A condition consists of operator, action key, and action value. A condition value may contain information such as time and IP address. Some services allow you to specify additional values in a condition. This element is optional.

Distributed Cache Operations

In CAM policy statements, you can specify any API operation from any service that supports CAM. For Distributed Cache, use APIs prefixed with "redis:", such as redis:CreateRedis or redis:DeleteInstance.
If you need to specify multiple operations in a single statement, separate them with commas, as shown below:
"action":["redis:action1","redis:action2"]
You can also specify multiple actions using a wildcard. For example, you can specify all actions whose name begins with "Describe", as shown below:
"action":["redis:Describe*"]
Distributed Cache operations are performed using the * wildcard, as shown below:
"action"：["redis:*"]

Distributed Cache resource path

Each CAM policy statement has its own resources. The general form of resource path is as follows:
qcs:project_id:service_type:region:account:resource
project_id: describes the project information, which is only used to enable compatibility with legacy CAM logic and can be left empty.
service_type: describes the product abbreviation such as Redis. -region: region information, for example, bj.
region: It indicates regional information, such as bj.
account: the root account of the resource owner, such as uin/653339763.
resource: describes detailed resource information of each product, such as instanceId/instance_id1 or instanceId/*.
For example, you can specify a resource for a specific instance (crs-psllioc8) in a statement as shown below:
"resource":[ "qcs::redis:bj:uin/12345678:instance/crs-psllioc8"]
You can also use the wildcard "*" to specify all instances that belong to a specific account as shown below:
"resource":[ "qcs::redis:bj:uin/12345678:instance/*"]
If you want to specify all resources or if a specific API operation does not support resource-level permission control, you can use the wildcard "*" in the "resource" element as shown below:
"resource": ["*"]
To specify multiple resources in a single command, separate them with commas. Below is an example where two resources are specified:
"resource":["resource1","resource2"]
The following table describes the resources available for Distributed Cache and their corresponding description methods. Words prefixed with "$" are placeholders, where region indicates the region and account indicates the account ID.
Resource
Resource Description Method in Authorization Policy
Instance
qcs::redis:$region:$account:instance/$instanceId
VPC
qcs::vpc:$region:$account:vpc/$vpcId
Security group
qcs::cvm:$region:$account:sg/$sgId
이전 주제: Overview다음 주제: Authorizable Resource Types

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백