j9九游会登录/ 统一身份认证服务 iam_统一身份认证服务（新版）/ 服务授权参考/ / / iam身份中心 (iam identity center)
更新时间：2025-12-30 gmt 08:00

iam身份中心 (iam identity center)-j9九游会登录

云服务在iam预置了常用的权限，称为系统身份策略。如果iam系统身份策略无法满足授权要求，管理员可以根据各j9九游会登录的服务支持的授权项，创建iam自定义身份策略来进行精细的访问控制，iam自定义身份策略是对系统身份策略的扩展和补充。

除iam服务外，organizations服务中的服务控制策略（service control policy，以下简称scp）也可以使用这些授权项元素设置访问控制策略。

scp不直接进行授权，只划定权限边界。将scp绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。iam身份策略授予权限的有效性受scp限制，只有在scp允许范围内的权限才能生效。

iam服务与organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：iam服务与organizations服务权限访问控制的区别。

本章节介绍iam服务身份策略授权场景中自定义身份策略和组织服务中scp使用的元素，这些元素包含了操作（action）、资源（resource）和条件（condition）。

操作（action）

操作（action）即为身份策略中支持的授权项。

  • “访问级别”列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在身份策略语句的resource元素中指定所有资源类型（“*”）。
    • 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的urn。
    • 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。

    关于identitycenter定义的资源类型的详细信息请参见资源类型（resource）。

  • “条件键”列包括了可以在身份策略语句的condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
    • 如果此列条件键没有值（-），表示此操作不支持指定条件键。

    关于identitycenter定义的条件键的详细信息请参见条件（condition）。

  • “别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的api访问。详细信息请参见身份策略兼容性说明。

您可以在身份策略语句的action元素中指定以下identitycenter的相关操作。

表1 identitycenter支持的授权项

授权项

描述

访问级别

资源类型（*为必须）

条件键

别名

identitycenter:user:create

授予创建用户的权限。

write

-

-

-

identitycenter:user:list

授予查询用户列表的权限。

read

-

-

-

identitycenter:user:describe

授予查询用户详情的权限。

read

-

-

-

identitycenter:user:describeusers

授予批量获取用户详情的权限。

read

-

-

-

identitycenter:user:update

授予更新用户的权限。

write

-

-

-

identitycenter:user:delete

授予删除用户的权限。

write

-

-

-

identitycenter:user:getuserid

授予获取用户id的权限。

read

-

-

-

identitycenter:user:enableuser

授予启用用户的权限。

write

-

-

-

identitycenter:user:disableuser

授予停用用户的权限。

write

-

-

-

identitycenter:group:create

授予创建用户组的权限。

write

-

-

-

identitycenter:group:list

授予查询用户组列表的权限。

read

-

-

-

identitycenter:group:describe

授予查询用户组详情的权限。

read

-

-

-

identitycenter:group:describegroups

授予批量获取用户组详情的权限。

read

-

-

-

identitycenter:group:update

授予更新用户组的权限。

write

-

-

-

identitycenter:group:delete

授予删除用户组的权限。

write

-

-

-

identitycenter:group:getgroupid

授予获取用户组id的权限。

read

-

-

-

identitycenter:groupmembership:create

授予绑定用户与用户组的权限。

write

-

-

-

identitycenter:groupmemberships:list

授予查询用户组的所有成员的权限。

read

-

-

-

identitycenter:groupmembership:listformember

授予查询用户加入的所有用户组的权限。

read

-

-

-

identitycenter:groupmembership:describe

授予查询绑定关系详情的权限。

read

-

-

-

identitycenter:groupmembership:delete

授予解绑用户和用户组的权限。

write

-

-

-

identitycenter:groupmembership:getgroupmembershipid

授予查询绑定关系id的权限。

read

-

-

-

identitycenter:groupmembership:ismembershipingroup

授予查询用户是否绑定在用户组的权限。

read

-

-

-

identitycenter:externalidp:create

授予创建外部身份提供商的权限。

write

-

-

-

identitycenter:externalidp:list

授予获取外部身份提供商身份源配置的权限。

read

-

-

-

identitycenter:externalidp:enable

授予启用外部身份提供商的权限。

write

-

-

-

identitycenter:externalidp:disable

授予停用外部身份提供商的权限。

write

-

-

-

identitycenter:externalidp:getspconfiguration

授予获取iam身份中心服务提供商配置的权限。

read

-

-

-

identitycenter:externalidp:update

授予更新外部身份提供商配置的权限。

write

-

-

-

identitycenter:externalidp:delete

授予删除外部身份提供商配置的权限。

write

-

-

-

identitycenter:externalidp:importcertificate

授予导入证书的权限。

write

-

-

-

identitycenter:externalidp:deletecertificate

授予删除证书的权限。

write

-

-

-

identitycenter:externalidp:listcertificates

授予获取证书列表的权限。

read

-

-

-

identitycenter:externalidp:createprovisioningtenant

授予创建tenant的权限。

write

-

-

-

identitycenter:externalidp:listprovisioningtenant

授予查询tenant列表的权限。

read

-

-

-

identitycenter:externalidp:deleteprovisioningtenant

授予删除tenant的权限。

write

-

-

-

identitycenter:externalidp:createbearertoken

授予创建bearer token的权限。

write

-

-

-

identitycenter:externalidp:listbearertokens

授予查询bearer token列表的权限。

read

-

-

-

identitycenter:externalidp:deletebearertoken

授予删除bearer token的权限。

write

-

-

-

identitycenter:user:updatepassword

授予通过电子邮件发送密码重置链接或者生成一次性密码的方式为用户更新密码的权限。

write

-

-

-

identitycenter:user:deleteusermfadevice

授予为指定用户删除mfa设备的权限。

write

-

-

-

identitycenter:user:updatemfadevice

授予更新mfa设备信息的权限。

write

-

-

-

identitycenter:user:listmfadevice

授予查询mfa设备列表的权限。

read

-

-

-

identitycenter:user:registervirtualmfadevice

授予开始虚拟mfa设备创建过程的权限。

write

-

-

-

identitycenter:user:verifyemail

授予验证用户电子邮件地址的权限。

write

-

-

-

identitycenter:user:batchdeletesession

授予批量删除所选的用户会话的权限。

write

-

-

-

identitycenter:user:listsessions

授予查询用户会话列表的权限。

list

-

-

-

identitycenter:serviceprovider:activecertificate

授予激活身份提供商证书权限。

write

-

-

-

identitycenter:serviceprovider:deletecertificate

授予删除身份提供商证书权限。

write

-

-

-

identitycenter:serviceprovider:createcertificate

授予创建身份提供商证书权限。

write

-

-

-

identitycenter:serviceprovider:listcertificates

授予获取身份提供商证书列表权限。

list

-

-

-

identitycenter:permissionset:create

授予创建权限集的权限。

write

instance *

-

-

permissionset *

-

-

identitycenter:permissionset:attachmanagedpolicy

授予将系统管理策略附加到权限集的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:detachmanagedpolicy

授予从指定权限集中分离附加的系统管理策略的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:update

授予更新指定实例的权限集的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:delete

授予删除指定实例的权限集的权限。

write

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:list

授予列出指定实例的权限集的权限。

list

instance *

-

-

identitycenter:permissionset:listaccountsforprovisioned

授予列出指定权限集已授权的所有账号的权限。

list

permissionset *

g:resourcetag/

-

instance *

-

identitycenter:permissionset:listprovisioningstatus

授予列出指定实例的权限集授权请求的处理状态的权限。

list

instance *

-

-

identitycenter:permissionset:listmanagedpolicies

授予列出附加到指定权限集的系统管理策略的权限。

list

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:listprovisionedtoaccount

授予列出授权给指定账号的所有权限集的权限。

list

account *

-

-

instance *

-

identitycenter:permissionset:describeprovisioningstatus

授予获取权限集授权请求的处理状态详细信息的权限。

read

instance *

-

-

identitycenter:permissionset:describe

授予获取指定实例的权限集详细信息的权限。

read

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:provision

授予将指定权限集授权给指定目标的权限。

write

account *

-

-

instance *

-

permissionset *

g:resourcetag/

identitycenter:instance:getidentitycenterstatus

授予查询iam身份中心服务状态的权限。

read

-

-

-

identitycenter:instance:registerregion

授予注册region的权限。

write

-

-

-

identitycenter:instance:describeregisteredregions

授予查询iam身份中心已开通的region的权限。

read

-

-

-

identitycenter:instance:startidentitycenter

授予开通iam身份中心的权限。

write

-

-

-

identitycenter:instance:deleteidentitycenter

授予关闭iam身份中心的权限。

write

-

-

-

identitycenter:instance:list

授予查询iam身份中心实例列表的权限。

list

-

-

-

identitycenter:instance:describeinstanceaccesscontrolattributeconfiguration

授予查询指定实例的访问控制属性配置的权限。

read

instance *

-

-

identitycenter:instance:updateinstanceaccesscontrolattributeconfiguration

授予更新指定实例的访问控制属性配置的权限。

write

instance *

-

-

identitycenter:instance:deleteinstanceaccesscontrolattributeconfiguration

授予删除指定实例的访问控制属性配置的权限。

write

instance *

-

-

identitycenter:instance:createinstanceaccesscontrolattributeconfiguration

授予启用指定实例的访问控制功能的权限。

write

instance *

-

-

identitycenter:tags:list

授予查询绑定到指定资源的标签列表的权限。

list

instance *

-

-

permissionset

g:resourcetag/

identitycenter:resources:listtags

授予查询指定资源类型标签列表的权限。

list

instance *

-

-

identitycenter:resources:tag

授予为指定资源添加标签的权限。

tagging

instance *

-

-

permissionset

g:resourcetag/

-

identitycenter:resources:untag

授予从指定资源中删除标签的权限。

tagging

instance *

-

-

permissionset

g:resourcetag/

-

identitycenter:resources:listbytag

授予查询指定资源类型及标签的资源列表的权限。

list

instance *

-

-

-

g:tagkeys

identitycenter:resources:countbytag

授予查询指定资源类型及标签的资源数量的权限。

read

instance *

-

-

-

g:tagkeys

identitycenter:accountassignment:create

授予使用指定权限集为指定账号分配对主体的访问权限的权限。

write

instance *

-

-

account *

-

permissionset *

g:resourcetag/

identitycenter:accountassignment:delete

授予使用指定权限集从指定账号删除主体访问权限的权限。

write

instance *

-

-

account *

-

permissionset *

g:resourcetag/

identitycenter:accountassignment:list

授予列出具有指定权限集的指定账号的受让人的权限。

list

instance *

-

-

account *

-

permissionset *

g:resourcetag/

identitycenter:accountassignment:describedeletionstatus

授予获取分配删除请求的处理状态详细信息的权限。

read

instance *

-

-

identitycenter:accountassignment:describecreationstatus

授予获取分配创建请求的处理状态详细信息的权限。

read

instance *

-

-

identitycenter:accountassignment:listcreationstatus

授予列出指定iam身份中心实例的账号分配创建请求的处理状态的权限。

list

instance *

-

-

identitycenter:accountassignment:listdeletionstatus

授予列出指定iam身份中心实例的账号分配删除请求的处理状态的权限。

list

instance *

-

-

identitycenter:accountassignment:listprofileassociation

授予查询账号、权限集关联的所有用户或用户组的权限。

read

-

-

-

identitycenter:accountassignment:disassociationprofile

授予解除用户或用户组绑定的所有授权的权限。

write

-

-

-

identitycenter:instance:listidentitystoreassociations

授予查询关联到iam身份中心的身份源详细信息的权限。

read

-

-

-

identitycenter:ssoconfiguration:update

授予更新当前iam身份中心实例配置的权限。

write

-

-

-

identitycenter:ssoconfiguration:describe

授予获取当前iam身份中心实例配置的权限。

read

-

-

-

identitycenter:mfadevices:describemanagementsettings

授予获取mfa管理设置信息的权限。

read

-

-

-

identitycenter:mfadevices:updatemanagementsettings

授予更新mfa管理设置信息的权限。

write

-

-

-

identitycenter:instance:createalias

授予为指定的身份源创建别名的权限。

write

-

-

-

identitycenter:permissionset:attachcustomrole

授予为指定权限集附加自定义角色的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:attachcustompolicy

授予为指定权限集附加自定义策略的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:getcustomrole

授予获取分配给指定权限集的自定义角色的权限。

read

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:getcustompolicy

授予获取分配给指定权限集的自定义策略的权限。

read

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:detachcustomrole

授予删除指定权限集中的自定义角色的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:permissionset:detachcustompolicy

授予删除指定权限集中的自定义策略的权限。

permission_management

instance *

-

-

permissionset *

g:resourcetag/

identitycenter:application:createapplicationinstance

授予在iam身份中心中添加应用程序实例的权限。

write

-

-

-

identitycenter:application:createapplicationinstancecertificate

授予为应用程序实例添加新证书的权限。

write

-

-

-

identitycenter:application:deleteapplicationinstance

授予删除应用程序实例的权限。

write

-

-

-

identitycenter:application:deleteapplicationinstancecertificate

授予删除应用程序实例的未激活或过期证书的权限。

write

-

-

-

identitycenter:application:deleteprofile

授予删除应用程序实例与用户或用户组关联关系的权限。

write

-

-

-

identitycenter:application:describeapplication

授予获取应用程序信息的权限。

read

application *

-

-

identitycenter:application:getapplicationassignmentconfiguration

授予读取应用程序分配设置的权限。

read

application *

-

-

identitycenter:application:getapplicationinstance

授予检索应用程序实例详细信息的权限。

read

-

-

-

identitycenter:application:importapplicationinstanceserviceprovidermetadata

授予通过上传服务提供商提供的应用程序saml元数据文件来更新应用程序实例的权限。

write

-

-

-

identitycenter:application:listapplicationinstancecertificates

授予查询应用程序实例下的所有证书列表的权限。

list

-

-

-

identitycenter:application:listapplicationinstances

授予查询所有应用程序实例列表的权限。

list

-

-

-

identitycenter:application:listapplicationtemplates

授予查询所有支持的应用程序模板列表的权限。

list

-

-

-

identitycenter:application:listapplications

授予查询与iam身份中心实例关联的所有应用程序列表的权限。

list

-

-

-

identitycenter:application:listprofiles

授予查询应用程序实例是否存在与用户或用户组关联关系的权限。

list

-

-

-

identitycenter:application:updateapplicationinstanceactivecertificate

授予激活应用程序实例证书的权限。

write

-

-

-

identitycenter:application:updateapplicationinstancedisplaydata

授予更新应用程序实例显示详情的权限。

write

-

-

-

identitycenter:application:updateapplicationinstanceresponseconfiguration

授予更新应用程序实例的联邦配置的权限。

write

-

-

-

identitycenter:application:updateapplicationinstanceresponseschemaconfiguration

授予更新应用程序实例的联邦schema配置的权限。

write

-

-

-

identitycenter:application:updateapplicationinstancesecurityconfiguration

授予更新应用程序实例的安全配置的权限。

write

-

-

-

identitycenter:application:updateapplicationinstanceserviceproviderconfiguration

授予更新应用程序实例的服务提供商相关配置的权限。

write

-

-

-

identitycenter:application:updateapplicationinstancestatus

授予更新应用程序实例状态的权限。

write

-

-

-

identitycenter:applicationprovider:describeapplicationprovider

授予描述应用程序提供商的权限。

read

applicationprovider *

-

-

identitycenter:applicationprovider:listapplicationproviders

授予查询应用程序提供商列表的权限。

list

applicationprovider

-

-

identitycenter:applicationassignment:create

授予为应用程序分配用户或用户组的权限。

write

application *

-

-

identitycenter:applicationassignment:delete

授予为应用程序解除已分配用户或用户组的权限。

write

application *

-

-

identitycenter:applicationassignment:list

授予查询应用程序已分配的用户或用户组列表的权限。

list

application *

-

-

identitycenter:applicationassignmentsforprincipal:list

授予查询分配给用户或组的应用程序列表的权限。

list

instance *

-

-

identitycenter的api通常对应着一个或多个授权项。表2展示了api与授权项的关系，以及该api需要依赖的授权项。

表2 api与授权项的关系

api

对应的授权项

依赖的授权项

post /v1/identity-stores/{identity_store_id}/users

identitycenter:user:create

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/users

identitycenter:user:list

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/users/{user_id}

identitycenter:user:describe

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/batch-query

identitycenter:user:describeusers

organizations:delegatedadministrators:list

put /v1/identity-stores/{identity_store_id}/users/{user_id}

identitycenter:user:update

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/users/{user_id}

identitycenter:user:delete

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/retrieve-user-id

identitycenter:user:getuserid

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/enable

identitycenter:user:enableuser

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/disable

identitycenter:user:disableuser

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/groups

identitycenter:group:create

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/groups

identitycenter:group:list

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/groups/{group_id}

identitycenter:group:describe

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/groups/batch-query

identitycenter:group:describegroups

organizations:delegatedadministrators:list

put /v1/identity-stores/{identity_store_id}/groups/{group_id}

identitycenter:group:update

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/groups/{group_id}

identitycenter:group:delete

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/groups/retrieve-group-id

identitycenter:group:getgroupid

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/group-memberships

identitycenter:groupmembership:create

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/group-memberships

identitycenter:groupmemberships:list

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/group-memberships-for-member

identitycenter:groupmembership:listformember

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/group-memberships/{membership_id}

identitycenter:groupmembership:describe

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/group-memberships/{membership_id}

identitycenter:groupmembership:delete

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/group-memberships/retrieve-group-membership-id

identitycenter:groupmembership:getgroupmembershipid

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/is-member-in-groups

identitycenter:groupmembership:ismembershipingroup

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/external-idp

identitycenter:externalidp:create

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/external-idp

identitycenter:externalidp:list

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/enable

identitycenter:externalidp:enable

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/disable

identitycenter:externalidp:disable

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/sp-config

identitycenter:externalidp:getspconfiguration

organizations:delegatedadministrators:list

put /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}

identitycenter:externalidp:update

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}

identitycenter:externalidp:delete

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate

identitycenter:externalidp:importcertificate

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate/{certificate_id}

identitycenter:externalidp:deletecertificate

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/external-idp/{idp_id}/certificate

identitycenter:externalidp:listcertificates

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/provision-tenant

identitycenter:externalidp:createprovisioningtenant

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/provision-tenant

identitycenter:externalidp:listprovisioningtenant

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}

identitycenter:externalidp:deleteprovisioningtenant

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token

identitycenter:externalidp:createbearertoken

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token

identitycenter:externalidp:listbearertokens

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/tenant/{tenant_id}/bearer-token/{token_id}

identitycenter:externalidp:deletebearertoken

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/reset-password

identitycenter:user:updatepassword

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/{device_id}

identitycenter:user:deleteusermfadevice

organizations:delegatedadministrators:list

put /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/{device_id}

identitycenter:user:updatemfadevice

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/retrieve-mfa-devices

identitycenter:user:listmfadevice

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/mfa-devices/register-mfa-device

identitycenter:user:registervirtualmfadevice

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/verify-email

identitycenter:user:verifyemail

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/users/{user_id}/sessions/batch-delete

identitycenter:user:batchdeletesession

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/users/{user_id}/sessions

identitycenter:user:listsessions

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/saml-certificates

identitycenter:serviceprovider:createcertificate

organizations:delegatedadministrators:list

delete /v1/identity-stores/{identity_store_id}/saml-certificates/{certificate_id}

identitycenter:serviceprovider:deletecertificate

organizations:delegatedadministrators:list

get /v1/identity-stores/{identity_store_id}/saml-certificates

identitycenter:serviceprovider:listcertificates

organizations:delegatedadministrators:list

post /v1/identity-stores/{identity_store_id}/saml-certificates/{certificate_id}/active

identitycenter:serviceprovider:activecertificate

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/permission-sets

identitycenter:permissionset:create

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/permission-sets/{permission_set_id}/attach-managed-policy

identitycenter:permissionset:attachmanagedpolicy
  • iam:policies:getv5
  • organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/permission-sets/{permission_set_id}/detach-managed-policy

identitycenter:permissionset:detachmanagedpolicy

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/permission-sets/{permission_set_id}

identitycenter:permissionset:update

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/permission-sets/{permission_set_id}

identitycenter:permissionset:delete

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets

identitycenter:permissionset:list

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/{permission_set_id}/accounts

identitycenter:permissionset:listaccountsforprovisioned

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/provisioning-statuses

identitycenter:permissionset:listprovisioningstatus

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/{permission_set_id}/managed-policies

identitycenter:permissionset:listmanagedpolicies

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/provisioned-to-accounts

identitycenter:permissionset:listprovisionedtoaccount

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/provisioning-status/{request_id}

identitycenter:permissionset:describeprovisioningstatus

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/{permission_set_id}

identitycenter:permissionset:describe

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/permission-sets/{permission_set_id}/provision

identitycenter:permissionset:provision

organizations:delegatedadministrators:list

get /v1/identity-center-service/status

identitycenter:instance:getidentitycenterstatus

organizations:delegatedadministrators:list

post /v1/register-regions

identitycenter:instance:registerregion

-

get /v1/registered-regions

identitycenter:instance:describeregisteredregions

organizations:delegatedadministrators:list

post /v1/service/start

identitycenter:instance:startidentitycenter
  • iam:agencies:createservicelinkedagency
  • organizations:trustedservices:enable

post /v1/service/delete

identitycenter:instance:deleteidentitycenter

iam:agencies:deleteservicelinkedagency

get /v1/instances

identitycenter:instance:list

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/access-control-attribute-configuration

identitycenter:instance:describeinstanceaccesscontrolattributeconfiguration

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/access-control-attribute-configuration

identitycenter:instance:updateinstanceaccesscontrolattributeconfiguration

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/access-control-attribute-configuration

identitycenter:instance:deleteinstanceaccesscontrolattributeconfiguration

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/access-control-attribute-configuration

identitycenter:instance:createinstanceaccesscontrolattributeconfiguration

organizations:delegatedadministrators:list

get /v1/instances/{resource_type}/{resource_id}/tags

identitycenter:tags:list

organizations:delegatedadministrators:list

post /v1/instances/{resource_type}/{resource_id}/tags/create

identitycenter:resources:tag

organizations:delegatedadministrators:list

post /v1/instances/{resource_type}/{resource_id}/tags/delete

identitycenter:resources:untag

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/account-assignments/create

identitycenter:accountassignment:create

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/account-assignments/delete

identitycenter:accountassignment:delete

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/account-assignments

identitycenter:accountassignment:list

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/account-assignments/deletion-status/{request_id}

identitycenter:accountassignment:describedeletionstatus

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/account-assignments/creation-status/{request_id}

identitycenter:accountassignment:describecreationstatus

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/account-assignments/creation-statuses

identitycenter:accountassignment:listcreationstatus

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/account-assignments/deletion-statuses

identitycenter:accountassignment:listdeletionstatus

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/disassociate-profile

identitycenter:accountassignment:disassociationprofile

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/identity-store-associations

identitycenter:instance:listidentitystoreassociations

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/sso-configuration

identitycenter:ssoconfiguration:update

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/sso-configuration

identitycenter:ssoconfiguration:describe

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/mfa-devices/management-settings

identitycenter:mfadevices:describemanagementsettings

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/mfa-devices/management-settings

identitycenter:mfadevices:updatemanagementsettings

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/alias

identitycenter:instance:createalias

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy

identitycenter:permissionset:detachcustompolicy

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role

identitycenter:permissionset:detachcustomrole

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy

identitycenter:permissionset:getcustompolicy

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role

identitycenter:permissionset:getcustomrole

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-policy

identitycenter:permissionset:attachcustompolicy

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/permission-sets/{permission_set_id}/custom-role

identitycenter:permissionset:attachcustomrole

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/application-instances

identitycenter:application:createapplicationinstance

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates

identitycenter:application:createapplicationinstancecertificate

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/application-instances/{application_instance_id}

identitycenter:application:deleteapplicationinstance

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates/{certificate_id}

identitycenter:application:deleteapplicationinstancecertificate

organizations:delegatedadministrators:list

delete /v1/instances/{instance_id}/application-instances/{application_instance_id}/profiles/{profile_id}

identitycenter:application:deleteprofile

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/applications/{application_instance_id}

identitycenter:application:describeapplication

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/applications/{application_instance_id}/assignments-configuration

identitycenter:application:getapplicationassignmentconfiguration

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/application-instances/{application_instance_id}

identitycenter:application:getapplicationinstance

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/application-instances/{application_instance_id}/metadata

identitycenter:application:importapplicationinstanceserviceprovidermetadata

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates

identitycenter:application:listapplicationinstancecertificates

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/application-instances

identitycenter:application:listapplicationinstances
  • organizations:delegatedadministrators:list
  • identitycenter:application:getapplicationinstance

get /v1/application-templates

identitycenter:application:listapplicationtemplates

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/applications

identitycenter:application:listapplications

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/application-instances/{application_instance_id}/profiles

identitycenter:application:listprofiles

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/certificates/{certificate_id}

identitycenter:application:updateapplicationinstanceactivecertificate

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/display-data

identitycenter:application:updateapplicationinstancedisplaydata

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/response-configuration

identitycenter:application:updateapplicationinstanceresponseconfiguration

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/response-schema-configuration

identitycenter:application:updateapplicationinstanceresponseschemaconfiguration

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/security-configuration

identitycenter:application:updateapplicationinstancesecurityconfiguration

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/service-provider-configuration

identitycenter:application:updateapplicationinstanceserviceproviderconfiguration

organizations:delegatedadministrators:list

put /v1/instances/{instance_id}/application-instances/{application_instance_id}/status

identitycenter:application:updateapplicationinstancestatus

organizations:delegatedadministrators:list

get /v1/application-providers/{application_provider_id}

identitycenter:applicationprovider:describeapplicationprovider

organizations:delegatedadministrators:list

get /v1/application-providers

identitycenter:applicationprovider:listapplicationproviders

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/applications/{application_instance_id}/assignments/create

identitycenter:applicationassignment:create

organizations:delegatedadministrators:list

post /v1/instances/{instance_id}/applications/{application_instance_id}/assignments/delete

identitycenter:applicationassignment:delete

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/applications/{application_instance_id}/assignments

identitycenter:applicationassignment:list

organizations:delegatedadministrators:list

get /v1/instances/{instance_id}/application-assignments-for-principals

identitycenter:applicationassignmentsforprincipal:list

organizations:delegatedadministrators:list

资源类型（resource）

资源类型（resource）表示身份策略所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的身份策略语句中指定该资源的urn，身份策略仅作用于此资源；如未指定，resource默认为“*”，则身份策略将应用到所有资源。您也可以在身份策略中设置条件，从而指定资源类型。

identitycenter定义了以下可以在自定义身份策略的resource元素中使用的资源类型。

表3 identitycenter支持的资源类型

资源类型

urn

application

identitycenter:::application:/

account

identitycenter:::account:

instance

identitycenter:::instance:

permissionset

identitycenter:::permissionset:/

applicationprovider

identitycenter:::applicationprovider:

条件（condition）

identitycenter服务不支持在身份策略中的条件键中配置服务级的条件键。identitycenter可以使用适用于所有服务的全局条件键，请参考全局条件键。

父主题：

相关文档

网站地图