更新时间:2025-12-02 gmt 08:00

api网关 apig-j9九游会登录

云服务在iam预置了常用的权限,称为系统身份策略。如果iam系统身份策略无法满足授权要求,管理员可以根据各j9九游会登录的服务支持的授权项,创建iam自定义身份策略来进行精细的访问控制,iam自定义身份策略是对系统身份策略的扩展和补充。

除iam服务外,organizations服务中的服务控制策略(service control policy,以下简称scp)也可以使用这些授权项元素设置访问控制策略。

scp不直接进行授权,只划定权限边界。将scp绑定到组织单元或者成员账号时,并没有直接对组织单元或成员账号授予操作权限,而是规定了成员账号或组织单元包含的成员账号的授权范围。iam身份策略授予权限的有效性受scp限制,只有在scp允许范围内的权限才能生效。

iam服务与organizations服务在使用这些元素进行访问控制时,存在着一些区别,详情请参见:iam服务与organizations服务权限访问控制的区别

本章节介绍iam服务身份策略授权场景中自定义身份策略和组织服务中scp使用的元素,这些元素包含了操作(action)、资源(resource)和条件(condition)。

操作(action)

操作(action)即为身份策略中支持的授权项。

  • “访问级别”列描述如何对操作进行分类(list、read和write等)。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值(-),则必须在身份策略语句的resource元素中指定所有资源类型(“*”)。
    • 如果该列包含资源类型,则必须在具有该操作的语句中指定该资源的urn。
    • 资源类型列中必需资源在表中用星号(*)标识,表示使用此操作必须指定该资源类型。

    关于apig定义的资源类型的详细信息请参见资源类型(resource)

  • “条件键”列包括了可以在身份策略语句的condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值,则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值(-),则表示条件键对整个授权项生效。
    • 如果此列条件键没有值(-),表示此操作不支持指定条件键。

    关于apig定义的条件键的详细信息请参见条件(condition)

  • “别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项,可以控制支持策略授权的api访问。详细信息请参见身份策略兼容性说明

您可以在身份策略语句的action元素中指定以下apig的相关操作。

表1 apig支持的授权项

授权项

描述

访问级别

资源类型(*为必须)

条件键

别名

apig:acl:list

授予权限以查看acl策略列表。

list

instance *

g:resourcetag/

  • apig:acls:list

apig:acl:create

授予权限以创建acl策略。

write

instance *

g:resourcetag/

  • apig:acls:create

apig:acl:batchdelete

授予权限以批量删除acl策略。

write

instance *

g:resourcetag/

  • apig:acls:delete

apig:acl:delete

授予权限以删除acl策略。

write

instance *

g:resourcetag/

  • apig:acls:delete

apig:acl:get

授予权限以查看acl策略详情。

read

instance *

g:resourcetag/

  • apig:acls:get

apig:acl:update

授予权限以修改acl策略。

write

instance *

g:resourcetag/

  • apig:acls:update

apig:api:bindacl

授予权限以绑定api和acl策略。

write

instance *

g:resourcetag/

  • apig:apis:bindacls

apig:api:batchunbindacl

授予权限以批量解除api和acl策略的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:unbindacls

apig:api:unbindacl

授予权限以解除api和acl策略的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:unbindacls

apig:api:listboundacl

授予权限以获取api绑定的acl策略列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedacls

apig:acl:listboundapi

授予权限以获取acl策略绑定的api列表。

list

instance *

g:resourcetag/

  • apig:acls:listbindedapis

apig:acl:listunboundapi

授予权限以获取acl策略未绑定的api列表。

list

instance *

g:resourcetag/

  • apig:acls:listunbindedapis

apig:api:bindrequestthrottling

授予权限以绑定api和流控策略。

write

instance *

g:resourcetag/

  • apig:apis:bindthrottles

apig:api:batchunbindrequestthrottling

授予权限以批量解除api和流控策略的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:unbindthrottles

apig:api:unbindrequestthrottling

授予权限以解除api和流控策略的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:unbindthrottles

apig:requestthrottling:listboundapi

授予权限以获取流控策略绑定的api列表。

list

instance *

g:resourcetag/

  • apig:throttles:listbindedapis

apig:api:listboundrequestthrottling

授予权限以获取api绑定的流控策略列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedthrottles

apig:requestthrottling:listunboundapi

授予权限以获取流控策略未绑定的api列表。

list

instance *

g:resourcetag/

  • apig:throttles:listunbindedapis

apig:apigroup:list

授予权限以获取api分组列表。

list

instance *

g:resourcetag/

  • apig:groups:list

apig:apigroup:create

授予权限以创建api分组。

write

instance *

g:resourcetag/

  • apig:groups:create

apig:apigroup:delete

授予权限以删除api分组。

write

instance *

g:resourcetag/

  • apig:groups:delete

apig:apigroup:get

授予权限以查询api分组详情。

read

instance *

g:resourcetag/

  • apig:groups:get

apig:apigroup:update

授予权限以修改api分组。

write

instance *

g:resourcetag/

  • apig:groups:update

apig:apigroup:checkapigroupnameexistornot

授予权限以校验api分组名称是否存在。

read

instance *

g:resourcetag/

  • apig:groups:get

apig:api:list

授予权限以获取api列表。

list

instance *

g:resourcetag/

  • apig:apis:list

apig:api:create

授予权限以创建api。

write

instance *

g:resourcetag/

  • apig:apis:create

apig:api:delete

授予权限以删除api。

write

instance *

g:resourcetag/

  • apig:apis:delete

apig:api:get

授予权限以查询api详情。

read

instance *

g:resourcetag/

  • apig:apis:get

apig:api:update

授予权限以修改api。

write

instance *

g:resourcetag/

  • apig:apis:update

apig:api:onlineoroffline

授予权限以发布或下线api。

write

instance *

g:resourcetag/

  • apig:apis:publish
  • apig:apis:offline

apig:api:batchdelete

授予权限以批量删除api。

write

instance *

g:resourcetag/

  • apig:apis:delete

apig:api:checkapipathorapinameexistornot

授予权限以校验api定义。

read

instance *

g:resourcetag/

  • apig:apis:get

apig:api:debug

授予权限以调试api。

write

instance *

g:resourcetag/

  • apig:apis:debug

apig:api:batchonlineoroffline

授予权限以批量发布或下线api。

write

instance *

g:resourcetag/

  • apig:apis:publish
  • apig:apis:offline

apig:api:listhistoryversion

授予权限以查询api历史版本列表。

list

instance *

g:resourcetag/

  • apig:apis:get

apig:api:switchversion

授予权限以切换api版本。

write

instance *

g:resourcetag/

  • apig:apis:publish

apig:api:getruntimedefinition

授予权限以查询api运行时定义。

read

instance *

g:resourcetag/

  • apig:apis:get

apig:api:deletehistoryversion

授予权限以根据版本编号下线api。

write

instance *

g:resourcetag/

  • apig:apis:offline

apig:api:gethistoryversion

授予权限以获取版本详情。

read

instance *

g:resourcetag/

  • apig:apis:get

apig:app:list

授予权限以获取app列表。

list

instance *

g:resourcetag/

  • apig:apps:list

apig:app:create

授予权限以创建app。

write

instance *

g:resourcetag/

  • apig:apps:create

apig:app:delete

授予权限以删除app。

write

instance *

g:resourcetag/

  • apig:apps:delete

apig:app:get

授予权限以查看app详情。

read

instance *

g:resourcetag/

  • apig:apps:get

apig:app:update

授予权限以修改app信息。

write

instance *

g:resourcetag/

  • apig:apis:update

apig:app:listappcode

授予权限以查询app code列表。

list

instance *

g:resourcetag/

  • apig:appcodes:list

apig:app:createappcode

授予权限以创建app code。

write

instance *

g:resourcetag/

  • apig:appcodes:create

apig:app:generateappcode

授予权限以自动生成app code。

write

instance *

g:resourcetag/

  • apig:appcodes:update

apig:app:deleteappcode

授予权限以删除app code。

write

instance *

g:resourcetag/

  • apig:appcodes:delete

apig:app:getappcode

授予权限以获取app code详情。

read

instance *

g:resourcetag/

  • apig:appcodes:get

apig:app:resetsecret

授予权限以重置app的密钥。

write

instance *

g:resourcetag/

  • apig:apps:update

apig:app:validate

授予权限以校验app是否存在。

read

instance *

g:resourcetag/

  • apig:apps:get

apig:app:getboundquota

授予权限以查询app关联的凭据配额策略。

read

instance *

g:resourcetag/

  • apig:apps:get

apig:app:bindapi

授予权限以绑定api和app。

write

instance *

g:resourcetag/

  • apig:apis:grantappaccess

apig:app:unbindapi

授予权限以解除api和app的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:relieveappaccess

apig:app:listboundapi

授予权限以查看app已绑定的api列表。

list

instance *

g:resourcetag/

  • apig:apps:listbindedapis

apig:api:listboundapp

授予权限以查看api已绑定的app列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedapps

apig:app:listunboundapi

授予权限以查看app未绑定的api列表。

list

instance *

g:resourcetag/

  • apig:apps:listunbindedapis

apig:api:export

授予权限以导出api。

read

instance *

g:resourcetag/

  • apig:apis:export

apig:api:import

授予权限以导入api。

write

instance *

g:resourcetag/

  • apig:apis:import

apig:asynctask:get

授予权限以查看异步任务结果详情。

read

instance *

g:resourcetag/

  • apig:apis:export
  • apig:apis:import

apig:certificate:list

授予权限以获取ssl证书列表。

list

instance

g:resourcetag/

-

apig:certificate:create

授予权限以创建ssl证书。

write

instance

g:resourcetag/

-

apig:certificate:delete

授予权限以删除ssl证书。

write

instance

g:resourcetag/

-

apig:certificate:get

授予权限以获取ssl证书详情。

read

instance

g:resourcetag/

-

apig:certificate:update

授予权限以修改ssl证书。

write

instance

g:resourcetag/

-

apig:certificate:listbounddomain

授予权限以获取ssl证书已绑定的域名列表。

list

instance

g:resourcetag/

-

apig:certificate:batchbinddomain

授予权限以绑定域名到ssl证书。

write

instance

g:resourcetag/

-

apig:certificate:batchunbinddomain

授予权限以解绑ssl证书绑定的域名。

write

instance

g:resourcetag/

-

apig:apigroup:batchbindcertificatetodomain

授予权限以绑定ssl证书到域名。

write

instance *

g:resourcetag/

  • apig:domains:bindcertificate

apig:apigroup:batchunbindcertificatefromdomain

授予权限以解绑域名绑定的证书。

write

instance *

g:resourcetag/

  • apig:domains:unbindcertificate

apig:loadbalancechannel:list

授予权限以获取负载通道列表。

list

instance *

g:resourcetag/

  • apig:vpcchannels:list

apig:loadbalancechannel:create

授予权限以创建负载通道。

write

instance *

g:resourcetag/

  • apig:vpcchannels:create

apig:loadbalancechannel:delete

授予权限以删除负载通道。

write

instance *

g:resourcetag/

  • apig:vpcchannels:delete

apig:loadbalancechannel:get

授予权限以获取负载通道详情。

read

instance *

g:resourcetag/

  • apig:vpcchannels:get

apig:loadbalancechannel:update

授予权限以更新负载通道。

write

instance *

g:resourcetag/

  • apig:vpcchannels:update

apig:loadbalancechannel:updatehealthcheckconfig

授予权限以修改负载通道健康检查配置。

write

instance *

g:resourcetag/

  • apig:vpcchannels:update

apig:loadbalancechannel:listservergroup

授予权限以查询负载通道后端服务器组列表。

list

instance *

g:resourcetag/

  • apig:vpcchannels:get

apig:loadbalancechannel:createservergroup

授予权限以添加或更新vpc通道后端服务器组。

write

instance *

g:resourcetag/

  • apig:vpcchannels:addorupdatemembergroups

apig:loadbalancechannel:deleteservergroup

授予权限以删除vpc通道后端服务器组。

write

instance *

g:resourcetag/

  • apig:vpcchannels:deletemembergroup

apig:loadbalancechannel:getservergroup

授予权限以查看指定的vpc通道后端服务器组详情。

read

instance *

g:resourcetag/

  • apig:vpcchannels:get

apig:loadbalancechannel:updateservergroup

授予权限以更新vpc通道后端服务器组。

write

instance *

g:resourcetag/

  • apig:vpcchannels:updatemembergroup

apig:loadbalancechannel:listbackendserveraddress

授予权限以获取负载通道后端实例列表。

list

instance *

g:resourcetag/

  • apig:vpcchannels:get

apig:loadbalancechannel:createbackendserveraddress

授予权限以添加或更新负载通道后端实例。

write

instance *

g:resourcetag/

  • apig:vpcchannels:addinstance

apig:loadbalancechannel:updatebackendserveraddress

授予权限以更新负载通道后端实例。

write

instance *

g:resourcetag/

  • apig:vpcchannels:addinstance

apig:loadbalancechannel:deletebackendserveraddress

授予权限以删除负载通道后端实例。

write

instance *

g:resourcetag/

  • apig:vpcchannels:deleteinstance

apig:loadbalancechannel:batchdisablebackendserveraddress

授予权限以批量修改后端服务器状态不可用。

write

instance *

g:resourcetag/

  • apig:vpcchannels:batchdisableinstance

apig:loadbalancechannel:batchenablebackendserveraddress

授予权限以批量修改后端服务器状态可用。

write

instance *

g:resourcetag/

  • apig:vpcchannels:batchenableinstance

apig:instance:listtag

授予权限以获取标签列表。

list

instance *

g:resourcetag/

  • apig:tags:list

apig:api:listunboundplugin

授予权限以获取api可绑定的插件列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedplugins

apig:api:listboundplugin

授予权限以获取api已绑定的插件列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedplugins

apig:api:bindplugin

授予权限以绑定插件到api。

write

instance *

g:resourcetag/

  • apig:apis:bindplugins

apig:api:unbindplugin

授予权限以解绑api绑定的插件。

write

instance *

g:resourcetag/

  • apig:apis:unbindplugins

apig:plugin:list

授予权限以获取插件列表。

list

instance *

g:resourcetag/

  • apig:plugins:list

apig:plugin:create

授予权限以创建插件。

write

instance *

g:resourcetag/

  • apig:plugins:create

apig:plugin:delete

授予权限以删除插件。

write

instance *

g:resourcetag/

  • apig:plugins:delete

apig:plugin:get

授予权限以获取插件详情。

read

instance *

g:resourcetag/

  • apig:plugins:get

apig:plugin:update

授予权限以修改插件。

write

instance *

g:resourcetag/

  • apig:plugins:update

apig:plugin:bindapi

授予权限以绑定api到插件。

write

instance *

g:resourcetag/

  • apig:apis:bindplugins

apig:plugin:listunbindapi

授予权限以获取插件可绑定的api列表。

list

instance *

g:resourcetag/

  • apig:plugins:listunbindedapis

apig:plugin:listboundapi

授予权限以获取插件已绑定的api列表。

list

instance *

g:resourcetag/

  • apig:plugins:listbindedapis

apig:plugin:unbindapi

授予权限以解绑插件绑定的api。

write

instance *

g:resourcetag/

  • apig:apis:unbindplugins

apig:apigroup:listgatewayresponse

授予权限以获取分组自定义响应列表。

list

instance *

g:resourcetag/

  • apig:gatewayresponses:list

apig:apigroup:creategatewayresponse

授予权限以创建分组自定义响应。

write

instance *

g:resourcetag/

  • apig:gatewayresponses:create

apig:apigroup:deletegatewayresponse

授予权限以删除分组自定义响应。

write

instance *

g:resourcetag/

  • apig:gatewayresponses:delete

apig:apigroup:getgatewayresponse

授予权限以获取分组自定义响应详情。

read

instance *

g:resourcetag/

  • apig:gatewayresponses:get

apig:apigroup:updategatewayresponse

授予权限以修改分组自定义响应。

write

instance *

g:resourcetag/

  • apig:gatewayresponses:updat

apig:apigroup:deletegatewayresponsetype

授予权限以删除分组指定错误类型的自定义响应配置。

write

instance *

g:resourcetag/

  • apig:gatewayresponses:update

apig:apigroup:getgatewayresponsetype

授予权限以获取分组下指定错误类型的自定义响应。

read

instance *

g:resourcetag/

  • apig:gatewayresponses:get

apig:apigroup:updategatewayresponsetype

授予权限以修改分组下指定错误类型的自定义响应。

write

instance *

g:resourcetag/

  • apig:gatewayresponses:update

apig:instance:listapioutline

授予权限以获取api概况。

list

instance *

g:resourcetag/

  • apig:apis:get

apig:instance:listappoutline

授予权限以获取app概况。

list

instance *

g:resourcetag/

  • apig:apps:get

apig:instance:listapigroupoutline

授予权限以获取api分组概况。

list

instance *

g:resourcetag/

  • apig:groups:get

apig:environmentvariable:list

授予权限以查询环境变量列表。

list

instance *

g:resourcetag/

  • apig:variables:list

apig:environmentvariable:create

授予权限以新建环境变量。

write

instance *

g:resourcetag/

  • apig:variables:create

apig:environmentvariable:delete

授予权限以删除环境变量。

write

instance *

g:resourcetag/

  • apig:variables:delete

apig:environmentvariable:get

授予权限以获取环境变量详情。

read

instance *

g:resourcetag/

  • apig:variables:get

apig:environmentvariable:update

授予权限以修改环境变量。

write

instance *

g:resourcetag/

  • apig:variables:update

apig:environment:list

授予权限以获取环境列表。

list

instance *

g:resourcetag/

  • apig:envs:list

apig:environment:create

授予权限以创建环境。

write

instance *

g:resourcetag/

  • apig:envs:create

apig:environment:delete

授予权限以删除环境。

write

instance *

g:resourcetag/

  • apig:envs:delete

apig:environment:update

授予权限以修改环境。

write

instance *

g:resourcetag/

  • apig:envs:update

apig:instance:listmetricdata

授予权限以查询实例监控数据。

list

instance *

g:resourcetag/

  • apig:metricdata:get

apig:instance:listapimonitoring

授予权限以查询最近一段时间api的统计信息。

list

instance *

g:resourcetag/

  • apig:apis:get

apig:instance:listapigroupmonitoring

授予权限以查询最近一小时内api分组的统计信息。

list

instance *

g:resourcetag/

  • apig:groups:get

apig:requestthrottling:list

授予权限以获取流控策略列表。

list

instance *

g:resourcetag/

  • apig:throttles:list

apig:requestthrottling:create

授予权限以创建流控策略。

write

instance *

g:resourcetag/

  • apig:throttles:create

apig:requestthrottling:delete

授予权限以删除流控策略。

write

instance *

g:resourcetag/

  • apig:throttles:delete

apig:requestthrottling:get

授予权限以获取流控策略详情。

read

instance *

g:resourcetag/

  • apig:throttles:get

apig:requestthrottling:update

授予权限以修改流控策略。

write

instance *

g:resourcetag/

  • apig:throttles:update

apig:requestthrottling:batchdelete

授予权限以批量删除流控策略。

write

instance *

g:resourcetag/

  • apig:throttles:delete

apig:api:bindsignaturekey

授予权限以绑定签名密钥和api。

write

instance *

g:resourcetag/

  • apig:apis:bindsigns

apig:api:unbindsignaturekey

授予权限以解除签名密钥和api的绑定关系。

write

instance *

g:resourcetag/

  • apig:apis:unbindsigns

apig:signaturekey:listboundapi

授予权限以获取签名密钥绑定的api列表。

list

instance *

g:resourcetag/

  • apig:signs:listbindedapis

apig:api:listboundsignaturekey

授予权限以获取api绑定的签名密钥列表。

list

instance *

g:resourcetag/

  • apig:apis:listbindedsigns

apig:signaturekey:listunboundapi

授予权限以查询所有未绑定到该签名密钥上的api列表。

list

instance *

g:resourcetag/

  • apig:signs:listunbindedapis

apig:signaturekey:list

授予权限以获取签名密钥列表。

list

instance *

g:resourcetag/

  • apig:signs:list

apig:signaturekey:create

授予权限以创建签名密钥。

write

instance *

g:resourcetag/

  • apig:signs:create

apig:signaturekey:delete

授予权限以删除签名密钥。

write

instance *

g:resourcetag/

  • apig:signs:delete

apig:signaturekey:update

授予权限以修改签名密钥。

write

instance *

g:resourcetag/

  • apig:signs:update

apig:requestthrottling:listspecial

授予权限以获取流控特殊设置列表。

list

instance *

g:resourcetag/

  • apig:specialthrottles:get

apig:requestthrottling:createspecial

授予权限以创建流控特殊设置。

write

instance *

g:resourcetag/

  • apig:specialthrottles:create

apig:requestthrottling:deletespecial

授予权限以删除流控特殊设置。

write

instance *

g:resourcetag/

  • apig:specialthrottles:delete

apig:requestthrottling:updatespecial

授予权限以修改某个流控策略下的某个特殊设置。

write

instance *

g:resourcetag/

  • apig:specialthrottles:update

apig:instance:listsingleinstancetag

授予权限以查询指定的实例标签列表。

list

instance *

  • apig:instancetags:list

apig:instance:batchcreateordeletetag

授予权限以实现批量添加或删除实例标签的功能。

write

instance *

  • apig:instancetags:create
  • apig:instancetags:delete

-

apig::listtag

授予权限以获取项目下所有实例标签。

list

-

-

  • apig:instancetags:list

apig:instance:getnumbytags

授予权限以实现通过标签查询实例数量的功能。

read

instance *

-

-

-

g:tagkeys

apig:instance:listbytags

授予权限以实现通过标签查询实例列表的功能。

list

instance *

-

-

-

g:tagkeys

apig:instance:list

授予权限以获取专享版实例列表。

list

-

-

  • apig:instances:list

apig:instance:create

授予权限以创建专享版实例。

write

-

  • apig:instances:create

apig:instance:delete

授予权限以删除专享版实例。

write

instance *

  • apig:instances:delete

apig:instance:get

授予权限以查看专享版实例详情。

read

instance *

  • apig:instances:get

apig:instance:update

授予权限以更新专享版实例。

write

instance *

  • apig:instances:update

apig:instance:unbindeip

授予权限以解绑专享版实例的eip。

write

instance *

  • apig:instances:update

apig:instance:bindorchangeeip

授予权限以添加或更换专享版实例的eip。

write

instance *

  • apig:instances:update

apig:instance:deleteoutboundeip

授予权限以关闭专享版实例的公网出口。

write

instance *

  • apig:instances:update

apig:instance:createoutboundeip

授予权限以开启专享版实例的公网出口。

write

instance *

  • apig:instances:update

apig:instance:changeoutboundeipbandwidth

授予权限以修改专享版实例公网出口的带宽。

write

instance *

  • apig:instances:update

apig:instance:getcreateprogress

授予权限以获取专享版实例的创建进度。

read

instance *

-

apig:instance:deleteingresseip

授予权限以关闭专享版实例的公网入口。

write

instance *

  • apig:instances:update

apig:instance:createingresseip

授予权限以开启专享版实例的公网入口。

write

instance *

  • apig:instances:update

apig:instance:changeingresseipbindwidth

授予权限以更新专享版实例的入公网带宽。

write

instance *

  • apig:instances:update

apig::createprepayorder

授予权限以创建包周期专享版实例订单。

write

-

  • apig:instances:create

apig:instance:createprepayresizeorder

授予权限以创建包周期专享版实例规格变更订单。

write

instance *

  • apig:instances:update

apig:instance:resize

授予权限以创建按需专享版实例规格变更订单。

write

instance *

-

apig:instance:getrestriction

授予权限以获取实例约束信息。

read

instance *

  • apig:instances:get

apig:instance:listparameter

授予权限以获取实例参数列表。

list

instance *

  • apig:features:list

apig:instance:updateparameter

授予权限以编辑实例参数。

write

instance *

  • apig:features:create

apig:instance:listfeature

授予权限以获取实例支持的特性列表。

list

instance *

-

apig:instance:importmicroservice

授予权限以导入微服务到专享版实例。

write

instance *

g:resourcetag/

  • apig:apis:import

apig:apigroup:binddomain

授予权限以绑定独立域名。

write

instance *

g:resourcetag/

  • apig:domains:create

apig:apigroup:unbinddomain

授予权限以解绑独立域名。

write

instance *

g:resourcetag/

  • apig:domains:delete

apig:apigroup:updatedomainconfig

授予权限以修改独立域名。

write

instance *

g:resourcetag/

  • apig:domains:update

apig:apigroup:createandbindcertificatetodomain

授予权限以创建并绑定证书到独立域名。

write

instance *

g:resourcetag/

  • apig:domains:bindcertificate

apig:apigroup:unbindanddeletecertificatefromdomain

授予权限以解绑并删除独立域名的证书。

write

instance *

g:resourcetag/

  • apig:domains:unbindcertificate

apig:apigroup:getcertificateofdomain

授予权限以查看独立域名的证书。

read

instance *

g:resourcetag/

  • apig:domains:getcertificate

apig:apigroup:updatesldomainsetting

授予权限以设置调试域名是否可以访问。

write

instance *

g:resourcetag/

  • apig:domains:updatesldomainsetting

apig:customauthorizer:list

授予权限以获取自定义认证列表。

list

instance *

g:resourcetag/

  • apig:authorizers:list

apig:customauthorizer:create

授予权限以创建自定义认证。

write

instance *

g:resourcetag/

  • apig:authorizers:create

apig:customauthorizer:delete

授予权限以删除自定义认证。

write

instance *

g:resourcetag/

  • apig:authorizers:delete

apig:customauthorizer:get

授予权限以获取自定义认证详情。

read

instance *

g:resourcetag/

  • apig:authorizers:get

apig:customauthorizer:update

授予权限以修改自定义认证。

write

instance *

g:resourcetag/

  • apig:authorizers:update

apig:instance:listvpcendpoint

授予权限以获取实例终端节点列表。

list

instance *

-

apig:instance:acceptorrejectvpcendpointconnection

授予权限以接受或拒绝终端节点连接。

write

instance *

-

apig:instance:listvpcendpointpermission

授予权限以获取实例终端节点服务的白名单列表。

list

instance *

-

apig:instance:batchaddvpcendpointpermission

授予权限以批量添加实例终端节点连接白名单。

write

instance *

-

apig:instance:batchdeletevpcendpointpermission

授予权限以批量删除实例终端节点连接白名单。

write

instance *

-

apig:app:deleteacl

授予权限以删除凭据的访问控制规则。

write

instance *

g:resourcetag/

  • apig:apps:get

apig:app:getacl

授予权限以获取凭据的访问控制规则。

read

instance *

g:resourcetag/

  • apig:apps:get

apig:app:updateacl

授予权限以设置凭据的访问控制规则。

write

instance *

g:resourcetag/

  • apig:apps:get

apig:clientquota:list

授予权限以获取凭据配额策略列表。

list

instance *

g:resourcetag/

-

apig:clientquota:create

授予权限以创建凭据配额策略。

write

instance *

g:resourcetag/

-

apig:clientquota:delete

授予权限以删除凭据配额策略。

write

instance *

g:resourcetag/

-

apig:clientquota:get

授予权限以获取凭据配额策略详情。

read

instance *

g:resourcetag/

-

apig:clientquota:update

授予权限以修改凭据配额策略。

write

instance *

g:resourcetag/

-

apig:clientquota:listboundapp

授予权限以查询凭据配额策略已绑定的凭据列表。

list

instance *

g:resourcetag/

-

apig:clientquota:bindapp

授予权限以绑定凭据配额和凭据。

write

instance *

g:resourcetag/

-

apig:clientquota:unbindapp

授予权限以解除凭据配额和凭据的绑定关系。

write

instance *

g:resourcetag/

-

apig:clientquota:listunboundapp

授予权限以查询凭据配额可绑定的凭据列表。

list

instance *

g:resourcetag/

-

apig:instance:listfeaturehistory

授予权限以查询特性的历史记录列表。

list

instance *

g:resourcetag/

-

apig:instance:addcustomingressport

授予权限以新增实例自定义入方向端口。

write

instance *

-

apig:instance:listcustomingressport

授予权限以获取实例自定义入方向端口列表。

list

instance *

-

apig:instance:deletecustomingressport

授予权限以删除实例自定义入方向端口。

write

instance *

-

apig:instance:listcustomingressportdomain

授予权限以获取实例自定义入方向端口绑定的域名信息列表。

list

instance *

-

apig的api通常对应着一个或多个授权项。表2展示了api与授权项的关系,以及该api需要依赖的授权项。

表2 api与授权项的关系

api

对应的授权项

依赖的授权项

get /{project_id}/apigw/instances/{instance_id}/acls

apig:acl:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/acls

apig:acl:create

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/acls

apig:acl:batchdelete

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acl:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acl:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acl:update

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/acl-bindings

apig:api:bindacl

  • apig:instance:get
  • apig:api:get
  • apig:acl:get

put /{project_id}/apigw/instances/{instance_id}/acl-bindings

apig:api:batchunbindacl

  • apig:instance:get
  • apig:api:get
  • apig:acl:get

delete /{project_id}/apigw/instances/{instance_id}/acl-bindings/{acl_bindings_id}

apig:api:unbindacl

  • apig:instance:get
  • apig:api:get
  • apig:acl:get

get /{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-acls

apig:api:listboundacl

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-apis

apig:acl:listboundapi

  • apig:instance:get
  • apig:acl:get

get /{project_id}/apigw/instances/{instance_id}/acl-bindings/unbinded-apis

apig:acl:listunboundapi

  • apig:instance:get
  • apig:acl:get

post /{project_id}/apigw/instances/{instance_id}/throttle-bindings

apig:api:bindrequestthrottling

  • apig:instance:get
  • apig:api:get
  • apig:requestthrottling:get

put /{project_id}/apigw/instances/{instance_id}/throttle-bindings

apig:api:batchunbindrequestthrottling

  • apig:instance:get
  • apig:api:get
  • apig:requestthrottling:get

delete /{project_id}/apigw/instances/{instance_id}/throttle-bindings/{throttle_binding_id}

apig:api:unbindrequestthrottling

  • apig:instance:get
  • apig:api:get
  • apig:requestthrottling:get

get /{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-apis

apig:requestthrottling:listboundapi

  • apig:instance:get
  • apig:requestthrottling:get

get /{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-throttles

apig:api:listboundrequestthrottling

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/throttle-bindings/unbinded-apis

apig:requestthrottling:listunboundapi

  • apig:instance:get
  • apig:requestthrottling:get

get /{project_id}/apigw/instances/{instance_id}/api-groups

apig:apigroup:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/api-groups

apig:apigroup:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:apigroup:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:apigroup:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:apigroup:update

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/api-groups/check

apig:apigroup:checkapigroupnameexistornot

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/apis

apig:api:list

  • apig:instance:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/apis

apig:api:create

  • apig:instance:get
  • apig:apigroup:get
  • apig:loadbalancechannel:get
  • apig:customauthorizer:get
  • functiongraph:function:getfunctionconfig

delete /{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:api:delete

  • apig:instance:get
  • apig:apigroup:get

get /{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:api:get

  • apig:instance:get
  • apig:apigroup:get

put /{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:api:update

  • apig:instance:get
  • apig:apigroup:get
  • apig:loadbalancechannel:get
  • apig:customauthorizer:get
  • functiongraph:function:getfunctionconfig

post /{project_id}/apigw/instances/{instance_id}/apis/action

apig:api:onlineoroffline

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

post /{project_id}/apigw/instances/{instance_id}/apis/check

apig:api:checkapipathorapinameexistornot

  • apig:instance:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/apis/debug/{api_id}

apig:api:debug

  • apig:instance:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/apis/publish

apig:api:batchonlineoroffline

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

get /{project_id}/apigw/instances/{instance_id}/apis/publish/{api_id}

apig:api:listhistoryversion

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/apis/publish/{api_id}

apig:api:switchversion

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/apis/runtime/{api_id}

apig:api:getruntimedefinition

  • apig:instance:get
  • apig:environment:list

delete /{project_id}/apigw/instances/{instance_id}/apis/versions/{version_id}

apig:api:deletehistoryversion

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

get /{project_id}/apigw/instances/{instance_id}/apis/versions/{version_id}

apig:api:gethistoryversion

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/apps

apig:app:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/apps

apig:app:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:app:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:app:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:app:update

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:app:listappcode

  • apig:instance:get
  • apig:app:get

post /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:app:createappcode

  • apig:instance:get
  • apig:app:get

put /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:app:generateappcode

  • apig:instance:get
  • apig:app:get

delete /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}

apig:app:deleteappcode

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}

apig:app:getappcode

  • apig:instance:get
  • apig:app:get

put /{project_id}/apigw/instances/{instance_id}/apps/secret/{app_id}

apig:app:resetsecret

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/apps/validation/{app_id}

apig:app:validate

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/bound-quota

apig:app:getboundquota

  • apig:instance:get
  • apig:app:get

post /{project_id}/apigw/instances/{instance_id}/app-auths

apig:app:bindapi

  • apig:instance:get
  • apig:app:get
  • apig:api:get

delete /{project_id}/apigw/instances/{instance_id}/app-auths/{app_auth_id}

apig:app:unbindapi

  • apig:instance:get
  • apig:app:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/app-auths/binded-apis

apig:app:listboundapi

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/app-auths/binded-apps

apig:api:listboundapp

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/app-auths/unbinded-apis

apig:app:listunboundapi

  • apig:instance:get
  • apig:app:get

post /{project_id}/apigw/instances/{instance_id}/openapi/export

apig:api:export

  • apig:instance:get
  • apig:api:list
  • apig:api:get
  • apig:api:listboundacl
  • apig:acl:get
  • apig:api:listboundrequestthrottling
  • apig:requestthrottling:get
  • apig:apigroup:get
  • apig:apigroup:getgatewayresponse
  • apig:environment:list
  • apig:api:listboundplugin
  • apig:plugin:get

post /{project_id}/apigw/instances/{instance_id}/openapi/async-export

apig:api:export

  • apig:instance:get
  • apig:api:list
  • apig:api:get
  • apig:api:listboundacl
  • apig:acl:get
  • apig:api:listboundrequestthrottling
  • apig:requestthrottling:get
  • apig:apigroup:get
  • apig:apigroup:getgatewayresponse
  • apig:environment:list
  • apig:api:listboundplugin
  • apig:plugin:get

post /{project_id}/apigw/instances/{instance_id}/openapi/import

apig:api:import

  • apig:instance:get
  • apig:api:get
  • apig:acl:get
  • apig:requestthrottling:get
  • apig:apigroup:get
  • apig:apigroup:getgatewayresponse
  • apig:environment:list
  • apig:plugin:get

post /{project_id}/apigw/instances/{instance_id}/openapi/async-import

apig:api:import

  • apig:instance:get
  • apig:api:get
  • apig:acl:get
  • apig:requestthrottling:get
  • apig:apigroup:get
  • apig:apigroup:getgatewayresponse
  • apig:environment:list
  • apig:plugin:get

get /{project_id}/apigw/instances/{instance_id}/async-tasks/{task_id}

apig:asynctask:get

apig:instance:get

get /{project_id}/apigw/certificates

apig:certificate:list

-

post /{project_id}/apigw/certificates

apig:certificate:create

apig:instance:get

delete /{project_id}/apigw/certificates/{certificate_id}

apig:certificate:delete

-

get /{project_id}/apigw/certificates/{certificate_id}

apig:certificate:get

-

put /{project_id}/apigw/certificates/{certificate_id}

apig:certificate:update

apig:instance:get

get /{project_id}/apigw/certificates/{certificate_id}/attached-domains

apig:certificate:listbounddomain

-

post /{project_id}/apigw/certificates/{certificate_id}/domains/attach

apig:certificate:batchbinddomain

  • apig:certificate:get
  • apig:apigroup:get

post /{project_id}/apigw/certificates/{certificate_id}/domains/detach

apig:certificate:batchunbinddomain

  • apig:certificate:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificates/attach

apig:apigroup:batchbindcertificatetodomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:certificate:get

post /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificates/detach

apig:apigroup:batchunbindcertificatefromdomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:certificate:get

get /{project_id}/apigw/instances/{instance_id}/vpc-channels

apig:loadbalancechannel:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/vpc-channels

apig:loadbalancechannel:create

  • apig:instance:get
  • cce:cluster:getcluster
  • ecs:cloudservers:showserver
  • cce:cluster:generateclientcredential

delete /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:loadbalancechannel:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:loadbalancechannel:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:loadbalancechannel:update

  • apig:instance:get
  • cce:cluster:getcluster
  • ecs:cloudservers:showserver
  • cce:cluster:generateclientcredential

put /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/health-config

apig:loadbalancechannel:updatehealthcheckconfig

  • apig:instance:get
  • apig:loadbalancechannel:get

get /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups

apig:loadbalancechannel:listservergroup

  • apig:instance:get
  • apig:loadbalancechannel:get

post /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups

apig:loadbalancechannel:createservergroup

  • apig:instance:get
  • apig:loadbalancechannel:get

delete /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}

apig:loadbalancechannel:deleteservergroup

  • apig:instance:get
  • apig:loadbalancechannel:get

get /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}

apig:loadbalancechannel:getservergroup

  • apig:instance:get
  • apig:loadbalancechannel:get

put /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}

apig:loadbalancechannel:updateservergroup

  • apig:instance:get
  • apig:loadbalancechannel:get

get /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members

apig:loadbalancechannel:listbackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get

post /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members

apig:loadbalancechannel:createbackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get
  • ecs:cloudservers:showserver

put /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members

apig:loadbalancechannel:updatebackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get
  • ecs:cloudservers:showserver

delete /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/{member_id}

apig:loadbalancechannel:deletebackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get

post /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-disable

apig:loadbalancechannel:batchdisablebackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get

post /{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-enable

apig:loadbalancechannel:batchenablebackendserveraddress

  • apig:instance:get
  • apig:loadbalancechannel:get

get /{project_id}/apigw/instances/{instance_id}/tags

apig:instance:listtag

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/attachable-plugins

apig:api:listunboundplugin

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/attached-plugins

apig:api:listboundplugin

  • apig:instance:get
  • apig:api:get

post /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/plugins/attach

apig:api:bindplugin

  • apig:instance:get
  • apig:api:get
  • apig:plugin:get

put /{project_id}/apigw/instances/{instance_id}/apis/{api_id}/plugins/detach

apig:api:unbindplugin

  • apig:instance:get
  • apig:api:get
  • apig:plugin:get

get /{project_id}/apigw/instances/{instance_id}/plugins

apig:plugin:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/plugins

apig:plugin:create

  • apig:instance:get
  • apig:loadbalancechannel:get
  • functiongraph:function:getfunctionconfig

delete /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugin:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugin:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugin:update

  • apig:instance:get
  • apig:loadbalancechannel:get
  • functiongraph:function:getfunctionconfig

post /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attach

apig:plugin:bindapi

  • apig:instance:get
  • apig:api:get
  • apig:plugin:get

get /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attachable-apis

apig:plugin:listunbindapi

  • apig:instance:get
  • apig:plugin:get

get /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attached-apis

apig:plugin:listboundapi

  • apig:instance:get
  • apig:plugin:get

put /{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/detach

apig:plugin:unbindapi

  • apig:instance:get
  • apig:api:get
  • apig:plugin:get

get /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses

apig:apigroup:listgatewayresponse

  • apig:instance:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses

apig:apigroup:creategatewayresponse

  • apig:instance:get
  • apig:apigroup:get

delete /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:apigroup:deletegatewayresponse

  • apig:instance:get
  • apig:apigroup:get

get /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:apigroup:getgatewayresponse

  • apig:instance:get
  • apig:apigroup:get

put /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:apigroup:updategatewayresponse

  • apig:instance:get
  • apig:apigroup:get

delete /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}

apig:apigroup:deletegatewayresponsetype

  • apig:instance:get
  • apig:apigroup:get

get /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}

apig:apigroup:getgatewayresponsetype

  • apig:instance:get
  • apig:apigroup:get

put /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}/{response_type}

apig:apigroup:updategatewayresponsetype

  • apig:instance:get
  • apig:apigroup:get

get /{project_id}/apigw/instances/{instance_id}/resources/outline/apis

apig:instance:listapioutline

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/resources/outline/apps

apig:instance:listappoutline

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/resources/outline/groups

apig:instance:listapigroupoutline

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/env-variables

apig:environmentvariable:list

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

post /{project_id}/apigw/instances/{instance_id}/env-variables

apig:environmentvariable:create

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

delete /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}

apig:environmentvariable:delete

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

get /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}

apig:environmentvariable:get

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

put /{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}

apig:environmentvariable:update

  • apig:instance:get
  • apig:apigroup:get
  • apig:environment:list

get /{project_id}/apigw/instances/{instance_id}/envs

apig:environment:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/envs

apig:environment:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/envs/{env_id}

apig:environment:delete

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/envs/{env_id}

apig:environment:update

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/metric-data

apig:instance:listmetricdata

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/statistics/api/latest

apig:instance:listapimonitoring

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/statistics/group/latest

apig:instance:listapigroupmonitoring

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/throttles

apig:requestthrottling:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/throttles

apig:requestthrottling:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:requestthrottling:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:requestthrottling:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:requestthrottling:update

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/sign-bindings

apig:api:bindsignaturekey

  • apig:instance:get
  • apig:api:get
  • apig:signaturekey:list

delete /{project_id}/apigw/instances/{instance_id}/sign-bindings/{sign_bindings_id}

apig:api:unbindsignaturekey

  • apig:instance:get
  • apig:api:get
  • apig:signaturekey:list

get /{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-apis

apig:signaturekey:listboundapi

  • apig:instance:get
  • apig:signaturekey:list

get /{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-signs

apig:api:listboundsignaturekey

  • apig:instance:get
  • apig:api:get

get /{project_id}/apigw/instances/{instance_id}/sign-bindings/unbinded-apis

apig:signaturekey:listunboundapi

  • apig:instance:get
  • apig:signaturekey:list

get /{project_id}/apigw/instances/{instance_id}/signs

apig:signaturekey:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/signs

apig:signaturekey:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/signs/{sign_id}

apig:signaturekey:delete

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/signs/{sign_id}

apig:signaturekey:update

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials

apig:requestthrottling:listspecial

  • apig:instance:get
  • apig:requestthrottling:get

post /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials

apig:requestthrottling:createspecial

  • apig:instance:get
  • apig:requestthrottling:get

delete /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}

apig:requestthrottling:deletespecial

  • apig:instance:get
  • apig:requestthrottling:get

put /{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}

apig:requestthrottling:updatespecial

  • apig:instance:get
  • apig:requestthrottling:get

get /{project_id}/apigw/instances/{instance_id}/instance-tags

apig:instance:listsingleinstancetag

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/instance-tags/action

apig:instance:batchcreateordeletetag

apig:instance:get

get /{project_id}/apigw/instance-tags

apig::listtag

apig:instance:get

post /{project_id}/apigw/resource-instances/count

apig:instance:getnumbytags

-

post /{project_id}/apigw/resource-instances/filter

apig:instance:listbytags

-

get /{project_id}/apigw/instances

apig:instance:list

-

post /{project_id}/apigw/instances

apig:instance:create

  • vpc:securitygroups:get
  • vpc:ports:create
  • vpc:ports:update
  • eip:publicips:get
  • eip:publicips:update
  • eps:enterpriseprojects:list

delete /{project_id}/apigw/instances/{instance_id}

apig:instance:delete

  • eip:publicips:get
  • eip:publicips:update
  • vpc:ports:delete

get /{project_id}/apigw/instances/{instance_id}

apig:instance:get

-

put /{project_id}/apigw/instances/{instance_id}

apig:instance:update

  • vpc:securitygroups:get
  • vpc:ports:update

delete /{project_id}/apigw/instances/{instance_id}/eip

apig:instance:unbindeip

  • apig:instance:get
  • eip:publicips:update

put /{project_id}/apigw/instances/{instance_id}/eip

apig:instance:bindorchangeeip

  • apig:instance:get
  • eip:publicips:update

delete /{project_id}/apigw/instances/{instance_id}/nat-eip

apig:instance:deleteoutboundeip

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/nat-eip

apig:instance:createoutboundeip

  • apig:instance:get
  • vpc:ports:get

put /{project_id}/apigw/instances/{instance_id}/nat-eip

apig:instance:changeoutboundeipbandwidth

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/progress

apig:instance:getcreateprogress

-

delete /{project_id}/apigw/instances/{instance_id}/ingress-eip

apig:instance:deleteingresseip

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/ingress-eip

apig:instance:createingresseip

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/ingress-eip

apig:instance:changeingresseipbindwidth

apig:instance:get

post /{project_id}/apigw/prepay-instances

apig::createprepayorder

bss:order:update

post /{project_id}/apigw/instances/{instance_id}/prepay-resize

apig:instance:createprepayresizeorder

  • apig:instance:get
  • bss:order:update

post /{project_id}/apigw/instances/{instance_id}/postpaid-resize

apig:instance:resize

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/restriction

apig:instance:getrestriction

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/features

apig:instance:listparameter

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/features

apig:instance:updateparameter

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/instance-features

apig:instance:listfeature

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/microservice/import

apig:instance:importmicroservice

  • apig:instance:get
  • apig:api:create
  • apig:apigroup:get
  • apig:apigroup:create
  • apig:loadbalancechannel:get
  • apig:loadbalancechannel:create
  • cce:cluster:getcluster
  • cce:cluster:generateclientcredential

post /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains

apig:apigroup:binddomain

  • apig:instance:get
  • apig:apigroup:get

delete /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}

apig:apigroup:unbinddomain

  • apig:instance:get
  • apig:apigroup:get

put /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}

apig:apigroup:updatedomainconfig

  • apig:instance:get
  • apig:apigroup:get

post /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate

apig:apigroup:createandbindcertificatetodomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:certificate:get

delete /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}

apig:apigroup:unbindanddeletecertificatefromdomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:certificate:get

get /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}

apig:apigroup:getcertificateofdomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:certificate:get

put /{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/sl-domain-access-settings

apig:apigroup:updatesldomainsetting

  • apig:instance:get
  • apig:apigroup:get

get /{project_id}/apigw/instances/{instance_id}/authorizers

apig:customauthorizer:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/authorizers

apig:customauthorizer:create

  • apig:instance:get
  • functiongraph:function:getfunctionconfig

delete /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:customauthorizer:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:customauthorizer:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:customauthorizer:update

  • apig:instance:get
  • functiongraph:function:getfunctionconfig

get /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/connections

apig:instance:listvpcendpoint

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/connections/action

apig:instance:acceptorrejectvpcendpointconnection

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions

apig:instance:listvpcendpointpermission

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions/batch-add

apig:instance:batchaddvpcendpointpermission

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/vpc-endpoint/permissions/batch-delete

apig:instance:batchdeletevpcendpointpermission

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl

apig:app:deleteacl

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl

apig:app:getacl

  • apig:instance:get
  • apig:app:get

put /{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-acl

apig:app:updateacl

  • apig:instance:get
  • apig:app:get

get /{project_id}/apigw/instances/{instance_id}/app-quotas

apig:clientquota:list

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/app-quotas

apig:clientquota:create

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}

apig:clientquota:delete

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}

apig:clientquota:get

apig:instance:get

put /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}

apig:clientquota:update

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bound-apps

apig:clientquota:listboundapp

apig:instance:get

post /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/binding-apps

apig:clientquota:bindapp

  • apig:instance:get
  • apig:clientquota:get

delete /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bound-apps/{app_id}

apig:clientquota:unbindapp

  • apig:instance:get
  • apig:app:get
  • apig:clientquota:get

get /{project_id}/apigw/instances/{instance_id}/app-quotas/{app_quota_id}/bindable-apps

apig:clientquota:listunboundapp

  • apig:instance:get
  • apig:clientquota:get

post /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports

apig:instance:addcustomingressport

apig:instance:get

get /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports

apig:instance:listcustomingressport

apig:instance:get

delete /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}

apig:instance:deletecustomingressport

  • apig:instance:get
  • apig:instance:listcustomingressport

get /{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}/domains

apig:instance:listcustomingressportdomain

  • apig:instance:get
  • apig:apigroup:get
  • apig:instance:listcustomingressport

资源类型(resource)

资源类型(resource)表示身份策略所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型,则必须在具有该操作的身份策略语句中指定该资源的urn,身份策略仅作用于此资源;如未指定,resource默认为“*”,则身份策略将应用到所有资源。您也可以在身份策略中设置条件,从而指定资源类型。

apig定义了以下可以在自定义身份策略的resource元素中使用的资源类型。

表3 apig支持的资源类型

资源类型

urn

instance

apig:::instance:

条件(condition)

apig服务不支持在身份策略中的条件键中配置服务级的条件键。apig可以使用适用于所有服务的全局条件键,请参考全局条件键

相关文档

网站地图