All Documents
Current Document
Content is empty
If you don't find the content you expect, please try another search term
Content is empty
If you don't find the content you expect, please try another search term
Last updated：2023-05-24 17:06:32
Kingsoft Cloud IAM policy documents adopt the syntax and standards of AWS IAM policy documents but contain fewer elements.
| Element | Required | Description |
|---|---|---|
| Version | No | The version of the policy document. Example: "Version":"2015-11-01". Currently, all Kingsoft Cloud IAM policy documents have only one version: 2015-11-01. If a policy document does not contain this element, its version is set to 2015-11-01 by default. |
| Statement | Yes | The rules of granting permissions. Example: "Statement":[{...},{...},{...}]. This element is the main element of a policy document. This element can contain multiple statements. Each statement must be enclosed in braces ( {}). |
| Sid | No | The statement ID. Example: "Sid":"1". It must be unique in a policy. This element is optional. |
| Effect | Yes | Specifies whether the statement results in an explicit allow or deny. Example: "Effect":"Allow". This element is required for each statement.(1) You can set this element to either Allow or Deny. (2) If a statement allows an action but another statement in the same policy denies the action, the action is denied. |
| Action | Yes | The action to be allowed or denied. Example: "Action":"iam:CreateUser". This element is required for each statement. (1) This element can contain multiple values, which are the names of API operations from Kingsoft Cloud services. (2) Each value is organized in the format of (3) The values of service-name and action-name are case-insensitive, and the value of action-name can contain asterisks ( *) as the wildcards. |
| Resource | Yes | The one or more resources that the statement covers. Example: "Resource":"KRN". (1) Services provide different resources. You can use an asterisk ( *) as the wildcard to indicate all resources. (2) The resource names conform to the naming rules of KRNs. For more information, see KRNs. |
policy = {
<version_block?>
<statment_block>
}
<version_block> = "Version" : "2015-11-01"
<statement_block> = "Statement" : [<statement>, <statement>, ...]
<statement> = {
<sid_block?>,
<effect_block>,
<action_block>,
<resoure_block>
}
<sid_block> = "Sid" : <sid_string>
<effect_block> = "Effect" : ("Allow" | "Deny")
<action_block> = "Action" : ( "*" | [<action_string>, <action_string>, ...])
<resoure_block> = "Resource" : ( "*" | [<resoure_string>, <resoure_string>, ...])
<action_string> = "service_name : action_name"
<resource_string> = "KRN" The following policy document is used to grant permissions to the Kingsoft Cloud Elastic Compute (KEC) administrator:
{
"Version" : "2015-11-01",
"Statement" : [
{
"Effect" : "Allow",
"Action" : "KEC:*",
"Resource" : "*"
}
]
}Pure Mode