j9九游会登录/ 统一身份认证服务 iam_统一身份认证服务（新版）/ 服务授权参考/ / / 配置审计 config
更新时间：2025-12-02 gmt 08:00

配置审计 config-j9九游会登录

云服务在iam预置了常用授权项，称为系统身份策略。如果iam系统身份策略无法满足授权要求，管理员可以根据各j9九游会登录的服务支持的授权项，创建iam自定义身份策略来进行精细的访问控制，iam自定义身份策略是对系统身份策略的扩展和补充。

除iam服务外，organizations服务中的服务控制策略（service control policy，以下简称scp）也可以使用这些授权项元素设置访问控制策略。

scp不直接进行授权，只划定权限边界。将scp绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。iam身份策略授予权限的有效性受scp限制，只有在scp允许范围内的权限才能生效。

iam服务与organizations服务在使用这些元素进行访问控制时，存在着一些区别，详情请参见：iam服务与organizations服务权限访问控制的区别。

本章节介绍iam服务身份策略授权场景中自定义身份策略和组织服务中scp使用的元素，这些元素包含了操作（action）、资源（resource）和条件（condition）。

操作（action）

操作（action）即为身份策略中支持的授权项。

  • “访问级别”列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在身份策略中相应操作对应的访问级别。
  • “资源类型”列指每个操作是否支持资源级权限。
    • 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在身份策略语句的resource元素中指定所有资源类型（“*”）。
    • 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的urn。
    • 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。

    关于config定义的资源类型的详细信息请参见资源类型（resource）。

  • “条件键”列包括了可以在身份策略语句的condition元素中支持指定的键值。
    • 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
    • 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
    • 如果此列条件键没有值（-），表示此操作不支持指定条件键。

    关于config定义的条件键的详细信息请参见条件（condition）。

  • “别名”列包括了可以在身份策略中配置的策略授权项。通过这些授权项，可以控制支持策略授权的api访问。详细信息请参见身份策略兼容性说明。

您可以在身份策略语句的action元素中指定以下config的相关操作。

表1 config支持的授权项

授权项

描述

访问级别

资源类型（*为必须）

条件键

别名

rms:organizationconformancepacks:create

授予权限创建组织合规规则包。

write

-

-

-

rms:organizationconformancepacks:get

授予权限查看组织合规规则包。

read

organizationconformancepacks *

-

-

rms:organizationconformancepacks:delete

授予权限删除组织合规规则包。

write

organizationconformancepacks *

-

-

rms:organizationconformancepacks:update

授予权限更新组织合规规则包。

write

organizationconformancepacks *

-

-

rms:organizationconformancepacks:list

授予权限查询组织合规规则包列表。

list

-

-

-

rms:conformancepacks:create

授予权限创建合规规则包。

write

-

-

-

rms:conformancepacks:get

授予权限查看合规规则包。

read

conformancepacks *

-

-

rms:conformancepacks:delete

授予权限删除合规规则包。

write

conformancepacks *

-

-

rms:conformancepacks:update

授予权限更新合规规则包。

write

conformancepacks *

-

-

rms:conformancepacks:list

授予权限查询合规规则包列表。

list

-

-

-

rms:storedqueries:create

授予权限保存新的高级查询语句。

write

-

-

-

rms:storedqueries:update

授予权限更新已存在的高级查询语句。

write

storedqueries *

-

-

rms:storedqueries:delete

授予权限删除已存在的高级查询语句。

write

storedqueries *

-

-

rms:storedqueries:get

授予权限查看已存在的高级查询语句详情。

read

storedqueries *

-

-

rms:storedqueries:list

授予权限查看已存在的高级查询语句列表。

list

-

-

-

rms:policyassignments:create

授予权限创建新的合规规则以评估你的资源。

write

-

-

rms:policyassignments:update

授予权限更新已存在的合规规则以评估你的资源。

write

policyassignments *

g:resourcetag/

-

-

rms:policyassignments:delete

授予权限删除已存在的合规规则和相应的评估状态结果。

write

policyassignments *

g:resourcetag/

-

rms:policyassignments:get

授予权限查看已存在的合规规则详情。

read

policyassignments *

g:resourcetag/

-

rms:organizationpolicyassignments:put

授予权限对整个组织创建或更新合规规则以评估你的资源。

write

-

-

-

rms:organizationpolicyassignments:delete

授予权限删除指定的组织合规规则和组织内所有成员账号的合规评估状态结果。

write

organizationpolicyassignments *

-

-

rms:organizationpolicyassignments:get

授予权限查看组织合规规则详情。

read

organizationpolicyassignments *

-

-

rms:organizationpolicyassignments:list

授予权限查看组织合规规则列表。

list

-

-

-

rms:policystates:runevaluation

授予权限运行指定的合规规则以评估你的资源。

write

policyassignments

g:resourcetag/

-

rms:policystates:update

授予权限functiongraph函数将评估结果传输到config。

write

-

-

-

rms:aggregators:create

授予权限创建聚合器聚合指定租户资源。

write

-

-

-

rms:aggregators:update

授予权限更新已存在的聚合器。

write

aggregators *

-

-

rms:aggregators:delete

授予权限删除指定聚合器并删除被聚合的租户资源。

write

aggregators *

-

-

rms:aggregators:list

授予权限查看已存在的聚合器列表。

list

-

-

-

rms:aggregators:get

授予权限查看已存在的聚合器详情。

read

aggregators *

-

-

rms:aggregatorresources:list

授予权限查看已被聚合的资源。

list

-

-

-

rms:aggregatorresources:runquery

授予权限执行高级查询语句返回被聚合的资源属性。

list

-

-

-

rms:aggregatorresources:get

授予权限查看用户指定被聚合的资源详情。

read

-

-

-

rms:aggregationauthorizations:create

授予权限创建聚合授权。

write

aggregationauthorizations *

-

-

-

rms:authorizedaccountorgpath

rms:aggregationauthorizations:list

授予权限查看已存在的聚合授权列表。

list

-

-

-

rms:aggregationauthorizations:delete

授予权限删除已存在聚合授权并删除被聚合的租户资源。

write

aggregationauthorizations *

-

-

-

rms:authorizedaccountorgpath

rms:aggregationrequests:delete

授予权限删除来自其他账号的聚合请求。

write

-

-

-

rms:aggregationrequests:list

授予权限查看来自其他账号的聚合请求列表。

list

-

-

-

rms:trackerconfig:put

授予权限创建或更新资源记录器配置以记录指定资源类型的资源历史数据。

write

-

-

rms:trackerconfig:delete

授予权限删除资源记录器配置以停止记录指定资源类型的资源历史数据。

write

-

-

-

rms:trackerconfig:get

授予权限查看资源记录器配置。

read

-

-

-

rms:schemas:list

授予权限查看高级查询资源schema。

list

-

-

-

rms:policydefinitions:get

授予权限查看预定义合规策略。

list

-

-

-

rms:resources:gethistory

授予权限查看指定资源的历史配置数据。

list

-

-

-

rms:resources:getrelation

授予权限查看资源关系。

list

-

-

-

rms:resources:get

授予权限查看用户指定的资源详情。

read

-

-

-

rms:resources:list

授予权限查看用户所有的资源列表。

list

-

-

-

rms:resources:runquery

授予权限执行高级查询语句。

list

-

-

-

rms::tagresource

授予权限批量创建资源标签。

tagging

policyassignments

g:resourcetag/

rms:resources:tagresource

-

rms::untagresource

授予权限批量删除资源标签。

tagging

policyassignments

g:resourcetag/

rms:resources:untagresource

-

rms::listtagsforresource

授予权限查询资源标签。

list

policyassignments

g:resourcetag/

rms:resources:listtagsforresource

rms::listtags

授予权限查询项目标签。

list

-

-

rms:resources:listtags

rms::listresourcesbytag

授予权限查询资源实例。

list

-

g:tagkeys

rms:resources:listresourcesbytag

rms:policyassignmentsremediation:putremediationconfiguration

授予权限创建合规修正配置。

write

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:deleteremediationconfiguration

授予权限删除合规修正配置。

write

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:getremediationconfiguration

授予权限查看合规修正配置。

read

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:runremediation

授予权限执行合规修正配置。

write

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:listremediationexecutionstatuses

授予权限查看合规修正执行状态。

list

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:createremediationexceptions

授予权限创建合规修正例外。

write

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:deleteremediationexceptions

授予权限删除合规修正例外。

write

policyassignmentsremediation *

-

-

rms:policyassignmentsremediation:listremediationexceptions

授予权限查看合规修正例外。

list

policyassignmentsremediation *

-

-

config的api通常对应着一个或多个授权项。表2展示了api与授权项的关系，以及该api需要依赖的授权项。

表2 api与授权项的关系

api

对应的授权项

依赖的授权项

post /v1/resource-manager/organizations/{organization_id}/conformance-packs

rms:organizationconformancepacks:create
  • organizations:organizations:get
  • organizations:accounts:list
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:enable
  • organizations:trustedservices:list

delete /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}

rms:organizationconformancepacks:delete

organizations:organizations:get

put /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}

rms:organizationconformancepacks:update
  • organizations:organizations:get
  • organizations:accounts:list
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:enable
  • organizations:trustedservices:list

get /v1/resource-manager/organizations/{organization_id}/conformance-packs

rms:organizationconformancepacks:list

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/conformance-packs/{conformance_pack_id}

rms:organizationconformancepacks:get

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/conformance-packs/statuses

rms:organizationconformancepacks:list

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/conformance-packs/detailed-statuses

rms:organizationconformancepacks:get

organizations:organizations:get

post /v1/resource-manager/domains/{domain_id}/conformance-packs

rms:conformancepacks:create
  • rf:stack:createstack
  • rf:stack:getstackmetadata
  • rf:stack:liststackresources

delete /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}

rms:conformancepacks:delete
  • rf:stack:deletestack
  • rf:stack:getstackmetadata

put /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}

rms:conformancepacks:update
  • rf:stack:deploystack
  • rf:stack:getstackmetadata
  • rf:stack:liststackresources

get /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}

rms:conformancepacks:get

-

get /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance

rms:conformancepacks:get

-

get /v1/resource-manager/domains/{domain_id}/conformance-packs/{conformance_pack_id}/compliance/details

rms:conformancepacks:get

-

get /v1/resource-manager/domains/{domain_id}/conformance-packs

rms:conformancepacks:list

-

get /v1/resource-manager/domains/{domain_id}/conformance-packs/compliance/summary

rms:conformancepacks:list

-

get /v1/resource-manager/domains/{domain_id}/conformance-packs/scores

rms:conformancepacks:list

-

post /v1/resource-manager/domains/{domain_id}/stored-queries

rms:storedqueries:create

-

put /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}

rms:storedqueries:update

-

delete /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}

rms:storedqueries:delete

-

get /v1/resource-manager/domains/{domain_id}/stored-queries/{query_id}

rms:storedqueries:get

-

get /v1/resource-manager/domains/{domain_id}/stored-queries

rms:storedqueries:list

-

put /v1/resource-manager/domains/{domain_id}/policy-assignments

rms:policyassignments:create

-

delete /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyassignments:delete

-

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyassignments:get

-

get /v1/resource-manager/domains/{domain_id}/policy-assignments

rms:policyassignments:get

-

put /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}

rms:policyassignments:update

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/disable

rms:policyassignments:update

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/enable

rms:policyassignments:update

-

put /v1/resource-manager/organizations/{organization_id}/policy-assignments

rms:organizationpolicyassignments:put
  • organizations:organizations:get
  • organizations:accounts:list
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:enable
  • organizations:trustedservices:list

get /v1/resource-manager/organizations/{organization_id}/policy-assignments

rms:organizationpolicyassignments:list

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}

rms:organizationpolicyassignments:get

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/policy-assignment-statuses

rms:organizationpolicyassignments:list

organizations:organizations:get

get /v1/resource-manager/organizations/{organization_id}/policy-assignment-detailed-status

rms:organizationpolicyassignments:list

organizations:organizations:get

delete /v1/resource-manager/organizations/{organization_id}/policy-assignments/{organization_policy_assignment_id}

rms:organizationpolicyassignments:delete

organizations:organizations:get

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states

rms:policystates:get

-

get /v1/resource-manager/domains/{domain_id}/policy-states

rms:policystates:get

-

get /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/policy-states

rms:policystates:get

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/run-evaluation

rms:policystates:runevaluation

-

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/policy-states/evaluation-state

rms:policystates:get

-

put /v1/resource-manager/domains/{domain_id}/policy-states

rms:policystates:update

-

put /v1/resource-manager/domains/{domain_id}/aggregators

rms:aggregators:create
  • organizations:organizations:get
  • organizations:accounts:list
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:enable
  • organizations:trustedservices:list

put /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}

rms:aggregators:update
  • organizations:organizations:get
  • organizations:accounts:list
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:enable
  • organizations:trustedservices:list

delete /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}

rms:aggregators:delete

-

get /v1/resource-manager/domains/{domain_id}/aggregators

rms:aggregators:list

-

get /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}

rms:aggregators:get

-

get /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/aggregator-sources-status

rms:aggregators:get

-

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-summary

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignments/compliance

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-states/compliance-details

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/policy-assignment/detail

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-resource-config

rms:aggregatorresources:get

-

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resources

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

post /v1/resource-manager/domains/{domain_id}/aggregators/{aggregator_id}/run-query

rms:aggregatorresources:runquery

-

post /v1/resource-manager/domains/{domain_id}/aggregators/aggregate-data/aggregate-discovered-resource-counts

rms:aggregatorresources:list
  • organizations:organizations:get
  • organizations:delegatedadministrators:list
  • organizations:trustedservices:list

get /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization

rms:aggregationauthorizations:list

-

put /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization

rms:aggregationauthorizations:create

-

delete /v1/resource-manager/domains/{domain_id}/aggregators/aggregation-authorization/{authorized_account_id}

rms:aggregationauthorizations:delete

-

delete /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request/{requester_account_id}

rms:aggregationrequests:delete

-

get /v1/resource-manager/domains/{domain_id}/aggregators/pending-aggregation-request

rms:aggregationrequests:list

-

put /v1/resource-manager/domains/{domain_id}/tracker-config

rms:trackerconfig:put

-

delete /v1/resource-manager/domains/{domain_id}/tracker-config

rms:trackerconfig:delete

-

get /v1/resource-manager/domains/{domain_id}/tracker-config

rms:trackerconfig:get

-

get /v1/resource-manager/domains/{domain_id}/schemas

rms:schemas:list

-

get /v1/resource-manager/policy-definitions

rms:policydefinitions:get

-

get /v1/resource-manager/policy-definitions/{policy_definition_id}

rms:policydefinitions:get

-

get /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/history

rms:resources:gethistory

-

get /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id}/relations

rms:resources:getrelation

-

get /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources/{resource_id}

rms:resources:get

-

get /v1/resource-manager/domains/{domain_id}/all-resources

rms:resources:list

-

get /v1/resource-manager/domains/{domain_id}/provider/{provider}/type/{type}/resources

rms:resources:list

-

post /v1/resource-manager/domains/{domain_id}/run-query

rms:resources:runquery

-

get /v1/resource-manager/domains/{domain_id}/all-resources/summary

rms:resources:list

-

get /v1/resource-manager/domains/{domain_id}/all-resources/tags

rms:resources:list

-

get /v1/resource-manager/domains/{domain_id}/all-resources/count

rms:resources:list

-

get /v1/resource-manager/domains/{domain_id}/all-resources/{resource_id}

rms:resources:get

-

get /v1/resource-manager/domains/{domain_id}/resources/{resource_id}/relations

rms:resources:summarize

-

post /v1/resource-manager/{resource_type}/{resource_id}/tags/create

rms::tagresource

-

post /v1/resource-manager/{resource_type}/{resource_id}/tags/delete

rms::untagresource

-

get /v1/resource-manager/{resource_type}/{resource_id}/tags

rms::listtagsforresource

-

get /v1/resource-manager/{resource_type}/tags

rms::listtags

-

post /v1/resource-manager/{resource_type}/resource-instances/count

rms::listresourcesbytag

-

post /v1/resource-manager/{resource_type}/resource-instances/filter

rms::listresourcesbytag

-

put /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyassignmentsremediation:putremediationconfiguration
  • iam:agencies:pass
  • iam:agencies:createservicelinkedagencyv5

delete /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyassignmentsremediation:deleteremediationconfiguration

-

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-configuration

rms:policyassignmentsremediation:getremediationconfiguration

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution

rms:policyassignmentsremediation:runremediation
  • functiongraph:function:invokeasync
  • functiongraph:function:getfunctionconfig
  • rf:stack:create
  • rf:stack:delete
  • rf:stack:gettemplate
  • rf:stack:getmetadata
  • rf:privatetemplate:showmetadata

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses

rms:policyassignmentsremediation:listremediationexecutionstatuses

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-execution-statuses/summary

rms:policyassignmentsremediation:listremediationexecutionstatuses

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/create

rms:policyassignmentsremediation:createremediationexceptions

-

post /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception/delete

rms:policyassignmentsremediation:deleteremediationexceptions

-

get /v1/resource-manager/domains/{domain_id}/policy-assignments/{policy_assignment_id}/remediation-exception

rms:policyassignmentsremediation:listremediationexceptions

-

资源类型（resource）

资源类型（resource）表示身份策略所作用的资源。如表3中的某些操作指定了可以在该操作指定的资源类型，则必须在具有该操作的身份策略语句中指定该资源的urn，身份策略仅作用于此资源；如未指定，resource默认为“*”，则身份策略将应用到所有资源。您也可以在身份策略中设置条件，从而指定资源类型。

config定义了以下可以在自定义身份策略的resource元素中使用的资源类型。

表3 config支持的资源类型

资源类型

urn

policyassignments

rms:::policyassignments:

aggregationauthorizations

rms:::aggregationauthorizations:

policyassignmentsremediation

rms:::policyassignmentsremediation:

aggregators

rms:::aggregators:

organizationconformancepacks

rms:::organizationconformancepacks:/

conformancepacks

rms:::conformancepacks:

storedqueries

rms:::storedqueries:

organizationpolicyassignments

rms:::organizationpolicyassignments:/

条件（condition）

条件键概述

条件（condition）是身份策略生效的特定条件，包括条件键和运算符。

  • 条件键表示身份策略语句的condition元素中的键值。根据适用范围，分为全局级条件键和服务级条件键。
    • 全局级条件键（前缀为g:）适用于所有操作，在鉴权过程中，云服务不需要提供用户身份信息，系统将自动获取并鉴权。详情请参见：全局条件键。
    • 服务级条件键（前缀通常为服务缩写，如config:）仅适用于对应服务的操作，详情请参见表4。
    • 单值/多值表示api调用时请求中与条件关联的值数。单值条件键在api调用时的请求中最多包含一个值，多值条件键在api调用时请求可以包含多个值。例如：g:sourcevpce是单值条件键，表示仅允许通过某个vpc终端节点发起请求访问某资源，一个请求最多包含一个vpc终端节点id值。g:tagkeys是多值条件键，表示请求中携带的所有标签的key组成的列表，当用户在调用api请求时传入标签可以传入多个值。
  • 运算符与条件键、条件值一起构成完整的条件判断语句，当请求信息满足该条件时，身份策略才能生效。支持的运算符请参见：运算符。

config支持的服务级条件键

config定义了以下可以在自定义身份策略的condition元素中使用的条件键，您可以使用这些条件键进一步细化身份策略语句应用的条件。

表4 config支持的服务级条件键

服务级条件键

类型

单值/多值

说明

rms:authorizedaccountorgpath

string

单值

根据指定的资源聚合授权账号的 organizations path 过滤访问。

rms:trackerbucketname

string

单值

根据指定的转储目标桶名称进行过滤访问。

rms:trackerbucketpathprefix

string

单值

根据指定的转储目标桶桶前缀进行过滤访问。

条件键示例

  • rms:authorizedaccountorgpath

    示例：禁止组织内账号给组织外的账号进行聚合授权。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
    		 
    {
"version":"5.0",
"statement":[
{
"effect":"deny",
"action":[
"rms:aggregationauthorizations:create"
],
"resource":[
"*"
],
"condition":{
"stringnotmatch":{
"rms:authorizedaccountorgpath":[
"organization_id/root_id/ou_id"【备注：此处需填写组织的路径id】
]
}
}
}
]
}
  • rms:trackerbucketname

    示例：禁止资源记录器转储到非预期的obs桶。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
    		 
    {
"version":"5.0",
"statement":[
{
"effect":"deny",
"action":[
"rms:trackerconfig:put"
],
"resource":[
"*"
],
"condition":{
"stringnotmatch":{
"rms:trackerbucketname":[
"bucketname"
]
}
}
}
]
}
  • rms:trackerbucketpathprefix

    示例：禁止资源记录器转储到非预期的obs路径下。

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
    		 
    {
"version":"5.0",
"statement":[
{
"effect":"deny",
"action":[
"rms:trackerconfig:put"
],
"resource":[
"*"
],
"condition":{
"stringnotmatch":{
"rms:trackerbucketpathprefix":[
"bucketfolder"
]
}
}
}
]
}
父主题：

相关文档

网站地图