Permissions Policies and Supported Actions¶
This chapter describes fine-grained permissions management for your APIG.
Note
If your account does not require individual IAM users, skip this section.
Only dedicated gateways support fine-grained permissions management.
By default, new IAM users do not have permissions assigned. You need to add a user to one or more groups, and attach permissions policies or roles (in JSON format) to these groups. Users inherit permissions from the groups to which they are added and can perform specified operations on cloud services based on the permissions.
An account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions. The permissions required for calling an API are determined by the actions supported by the API. Only IAM users who have been granted permissions allowing the actions can call the API successfully. For example, if an IAM user wants to create APIs using an API, the user must have been granted permissions that allow the apig:apis:create action.
Supported Actions¶
Operations supported by policies are specific to APIs. The following are common concepts related to policies:
Permission: A statement in a policy that allows or denies certain operations.
Action: Specific operations that are allowed or denied.
API: REST APIs that can be called by a user who has been granted specific permissions.
Authorization scope: Type of projects in which policies can be used to grant permissions. A policy can be applied to IAM projects, enterprise projects, or both. Policies that contain actions for both IAM and enterprise projects can be used and take effect for both IAM and Enterprise Management. Policies that only contain actions for IAM projects can be used and only take effect for IAM.
APIG supports actions that can be defined in custom policies. Permissions must be obtained before calling APIs provided by APIG.
Description | Action | API | IAM Project | Enterprise Project |
|---|---|---|---|---|
Creating a dedicated gateway | apig:instances:create | POST /v2/{project_id}/apigw/instances | Y | Y |
Deleting a dedicated gateway | apig:instances:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id} | Y | Y |
Updating a dedicated gateway | apig:instances:update | PUT /v2/{project_id}/apigw/instances/{instance_id} | Y | Y |
Querying details of a dedicated gateway | apig:instances:get | GET /v2/{project_id}/apigw/instances/{instance_id} | Y | Y |
Querying a dedicated gateway list | apig:instances:list | GET /v2/{project_id}/apigw/instances | Y | Y |
Creating an API group | apig:groups:create | POST /v2/{project_id}/apigw/instances/{instance_id}/api-groups | Y | Y |
Deleting an API group | apig:groups:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id} | Y | Y |
Querying details of an API group | apig:groups:get | GET /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id} | Y | Y |
Querying an API group list | apig:groups:list | GET /v2/{project_id}/apigw/instances/{instance_id}/api-groups | Y | Y |
Binding a domain name to an API group | apig:domains:create | POST /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains | Y | Y |
Deleting a domain name bound to an API group | apig:domains:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id} | Y | Y |
Adding a certificate to a domain name | apig:domains:bindCertificate | POST /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate | Y | Y |
Deleting a certificate bound to a domain name | apig:domains:unbindCertificate | DELETE /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id} | Y | Y |
Querying details of a certificate bound to a domain name | apig:domains:getCertificate | GET /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id} | Y | Y |
Creating an environment variable | apig:variables:create | POST /v2/{project_id}/apigw/instances/{instance_id}/env-variables | Y | Y |
Deleting an environment variable | apig:variables:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id} | Y | Y |
Querying details of an environment variable | apig:variables:get | GET /v2/{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id} | Y | Y |
Querying an environment variable list | apig:variables:list | GET /v2/{project_id}/apigw/instances/{instance_id}/env-variables | Y | Y |
Creating an API | apig:apis:create | POST /v2/{project_id}/apigw/instances/{instance_id}/apis | Y | Y |
Deleting an API | apig:apis:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id} | Y | Y |
Publishing an API | apig:apis:publish | POST /v2/{project_id}/apigw/instances/{instance_id}/apis/action | Y | Y |
Taking an API offline | apig:apis:offline | POST /v2/{project_id}/apigw/instances/{instance_id}/apis/action | Y | Y |
Debugging an API | apig:apis:debug | POST /v2/{project_id}/apigw/instances/{instance_id}/apis/debug/{api_id} | Y | Y |
Importing an API | apig:apis:import | POST /v2/{project_id}/apigw/instances/{instance_id}/openapi/import | Y | Y |
Exporting an API | apig:apis:export | POST /v2/{project_id}/apigw/instances/{instance_id}/openapi/export | Y | Y |
Authorizing an app to access an API | apig:apis:grantAppAccess | POST /v2/{project_id}/apigw/instances/{instance_id}/app-auths | Y | Y |
Canceling the authorization of an app for accessing an API | apig:apis:relieveAppAccess | DELETE /v2/{project_id}/apigw/instances/{instance_id}/app-auths/{app_auth_id} | Y | Y |
Binding a signature key to an API | apig:apis:bindSigns | POST /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings | Y | Y |
Unbinding a signature key from an API | apig:apis:unbindSigns | DELETE /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/{sign_bindings_id} | Y | Y |
Binding an access control policy to an API | apig:apis:bindAcls | POST /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings | Y | Y |
Unbinding an access control policy from an API | apig:apis:unbindAcls | DELETE /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/{acl_bindings_id} | Y | Y |
Binding a request throttling policy to an API | apig:apis:bindThrottles | POST /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings | Y | Y |
Unbinding a request throttling policy from an API | apig:apis:unbindThrottles | DELETE /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/{throttle_binding_id} | Y | Y |
Querying details of an API | apig:apis:get | GET /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id} | Y | Y |
Querying an API list | apig:apis:list | GET /v2/{project_id}/apigw/instances/{instance_id}/apis | Y | Y |
Querying the list of apps bound to an API | apig:apis:listBindedApps | GET /v2/{project_id}/apigw/instances/{instance_id}/app-auths/binded-apps | Y | Y |
Querying the list of signature keys bound to an API | apig:apis:listBindedSigns | GET /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-signs | Y | Y |
Querying the list of access control policies bound to an API | apig:apis:listBindedAcls | GET /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-acls | Y | Y |
Querying the list of request throttling policies bound to an API | apig:apis:listBindedTrottles | GET /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-throttles | Y | Y |
Creating an environment | apig:envs:create | POST /v2/{project_id}/apigw/instances/{instance_id}/envs | Y | Y |
Deleting an environment | apig:envs:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/envs/{env_id} | Y | Y |
Querying an environment list | apig:envs:list | GET /v2/{project_id}/apigw/instances/{instance_id}/envs | Y | Y |
Creating an app | apig:apps:create | POST /v2/{project_id}/apigw/instances/{instance_id}/apps | Y | Y |
Deleting an app | apig:apps:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id} | Y | Y |
Querying details of an app | apig:apps:get | GET /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id} | Y | Y |
Querying an app list | apig:apps:list | GET /v2/{project_id}/apigw/instances/{instance_id}/apps | Y | Y |
Querying the list of APIs bound to an app | apig:apps:listBindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/app-auths/binded-apis | Y | Y |
Querying the list of APIs not bound to an app | apig:apps:listUnbindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/app-auths/unbinded-apis | Y | Y |
Creating a signature key | apig:signs:create | POST /v2/{project_id}/apigw/instances/{instance_id}/signs | Y | Y |
Deleting a signature key | apig:signs:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/signs/{sign_id} | Y | Y |
Querying a signature key list | apig:signs:list | GET /v2/{project_id}/apigw/instances/{instance_id}/signs | Y | Y |
Querying the list of APIs bound to a signature key | apig:signs:listBindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-apis | Y | Y |
Querying the list of APIs not bound to a signature key | apig:signs:listUnbindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/unbinded-apis | Y | Y |
Creating an access control policy | apig:acls:create | POST /v2/{project_id}/apigw/instances/{instance_id}/acls | Y | Y |
Deleting an access control policy | apig:acls:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/acls/{acl_id} | Y | Y |
Querying details of an access control policy | apig:acls:get | GET /v2/{project_id}/apigw/instances/{instance_id}/acls/{acl_id} | Y | Y |
Querying an access control policy list | apig:acls:list | GET /v2/{project_id}/apigw/instances/{instance_id}/acls | Y | Y |
Querying the list of APIs bound to an access control policy | apig:acls:listBindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-apis | Y | Y |
Querying the list of APIs not bound to an access control policy | apig:acls:listUnbindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/unbinded-apis | Y | Y |
Creating a request throttling policy | apig:throttles:create | POST /v2/{project_id}/apigw/instances/{instance_id}/throttles | Y | Y |
Deleting a request throttling policy | apig:throttles:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id} | Y | Y |
Querying details of a request throttling policy | apig:throttles:get | GET /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id} | Y | Y |
Querying a request control policy list | apig:throttles:list | GET /v2/{project_id}/apigw/instances/{instance_id}/throttles | Y | Y |
Querying the list of APIs bound to a request control policy | apig:throttles:listBindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-apis | Y | Y |
Querying the list of APIs not bound to a request control policy | apig:throttles:listUnbindedApis | GET /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/unbinded-apis | Y | Y |
Creating an excluded request throttling configuration | apig:specialThrottles:create | POST /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials | Y | Y |
Deleting an excluded request throttling configuration | apig:specialThrottles:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id} | Y | Y |
Querying excluded request throttling configurations | apig:specialThrottles:get | GET /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials | Y | Y |
Creating a VPC channel | apig:vpcChannels:create | POST /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels | Y | Y |
Deleting a VPC channel | apig:vpcChannels:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id} | Y | Y |
Updating a VPC channel | apig:vpcChannels:update | PUT /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id} | Y | Y |
Creating a backend instance | apig:vpcChannels:addInstance | POST /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members | Y | Y |
Deleting a backend instance | apig:vpcChannels:deleteInstance | DELETE /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/{member_id} | Y | Y |
Querying details of a VPC channel | apig:vpcs:get | GET /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id} | Y | Y |
Querying a VPC channel list | apig:vpcs:list | GET /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels | Y | Y |
Creating a custom authorizer | apig:authorizers:create | POST /v2/{project_id}/apigw/instances/{instance_id}/authorizers | Y | Y |
Deleting a custom authorizer | apig:authorizers:delete | DELETE /v2/{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id} | Y | Y |
Querying details of a custom authorizer | apig:authorizers:get | GET /v2/{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id} | Y | Y |
Query a custom authorizer list | apig:authorizers:list | GET /v2/{project_id}/apigw/instances/{instance_id}/authorizers | Y | Y |
Querying a tag list | apig:tags:list | GET /v2/{project_id}/apigw/instances/{instance_id}/tags | Y | Y |
Querying an instance feature list | apig:features:list | GET /v2/{project_id}/apigw/instances/{instance_id}/features | Y | Y |
Creating an instance feature | apig:features:create | POST /v2/{project_id}/apigw/instances/{instance_id}/features | Y | Y |