/ / / 权限策略和授权项
更新时间:2025-01-17 gmt 08:00

权限策略和授权项-九游平台

如果您需要对您所拥有的api网关服务进行精细的权限管理,您可以使用统一身份认证服务(identity and access management,简称iam)。

  • 如果华为云账号已经能满足您的要求,不需要创建独立的iam用户,您可以跳过本章节,不影响您使用api网关服务的其它功能。
  • 仅api网关专享版支持精细的细粒度授权。

默认情况下,新建的iam用户没有任何权限,您需要将其加入用户组,并给用户组授予策略(以json格式描述权限集的语言),才能使用户组中的用户获得策略定义的权限,这一过程称为授权。授权后,用户就可以基于策略对云服务进行操作。关于策略的语法结构及示例,请参见章节。

华为云账号具备所有接口的调用权限,如果使用账号下的iam用户发起api请求时,该iam用户必须具备调用该接口所需的权限,否则,api请求将调用失败。每个接口所需要的权限,与各个接口所对应的授权项相对应,只有发起请求的iam用户被授予授权项所对应的策略,该用户才能成功调用该接口。例如,iam用户要调用接口来创建api,那么这个iam用户被授予的策略中必须包含允许“apig:apis:create”的授权项,该接口才能调用成功。

支持的授权项

细粒度策略支持的操作与api相对应,授权项列表说明如下:

  • 权限:自定义策略中授权项定义的内容即为权限。
  • 授权项:自定义策略中支持的action,在自定义策略中的action中写入授权项,可以实现授权项对应的权限功能。
  • 对应api接口:自定义策略实际调用的api接口。
  • 授权范围:自定义策略的授权范围,包括iam项目与企业项目。授权范围如果同时支持iam项目和企业项目,表示此授权项对应的自定义策略,可以在iam和企业管理两个服务中给用户组授权并生效。如果仅支持iam项目,不支持企业项目,表示仅能在iam中给用户组授权并生效,如果在企业管理中授权,则该自定义策略不生效。关于iam项目与企业项目的区别,详情请参见:。

api网关服务管理控制操作相关的授权项,明细如下表所示。用户调用如下api时,需要获取对应的权限。权限获取请参考统一身份认证服务(iam)的帮助指导。

表1 api网关权限明细

权限

对应的api接口

授权项(action)

依赖的授权项

iam项目(project)

企业项目(enterprise project)

创建api网关专享版实例

post /v2/{project_id}/apigw/instances

apig:instances:create

-

删除api网关专享版实例

delete /v2/{project_id}/apigw/instances/{instance_id}

apig:instances:delete

-

更新api网关专享版实例

put

/v2/{project_id}/apigw/instances/{instance_id}

apig:instances:update

-

查看api网关专享版实例

get

/v2/{project_id}/apigw/instances/{instance_id}

apig:instances:get

-

查看api网关专享版实例列表

get /v2/{project_id}/apigw/instances

apig:instances:list

-

获取实例自定义入方向端口绑定的域名信息列表

get

/v2/{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}/domains

apig:instance:listcustomingressportdomain

apig:groups:get

apig:instance:listcustomingressport

apig:instances:get

获取实例自定义入方向端口列表

get

/v2/{project_id}/apigw/instances/{instance_id}/custom-ingress-ports

apig:instance:listcustomingressport

apig:instances:get

新增实例自定义入方向端口

post

/v2/{project_id}/apigw/instances/{instance_id}/custom-ingress-ports

apig:instance:addcustomingressport

apig:instances:get

删除实例自定义入方向端口

delete

/v2/{project_id}/apigw/instances/{instance_id}/custom-ingress-ports/{ingress_port_id}

apig:instance:deletecustomingressport

apig:instance:listcustomingressport

apig:instances:get

通过标签查询实例列表

post

/v2/{project_id}/apigw/resource-instances/filter

apig:instance:listbytags

-

x

通过标签查询实例数量

post

/v2/{project_id}/apigw/resource-instances/count

apig:instance:getnumbytags

-

x

查看实例标签列表

get /v2/{project_id}/apigw/instance-tags

apig:instancetags:list

-

x

删除实例标签

post /v2/{project_id}/apigw/instances/{instance_id}/instance-tags/action

apig:instancetags:delete

apig:instances:get

创建实例标签

post

/v2/{project_id}/apigw/instances/{instance_id}/instance-tags/action

apig:instancetags:create

apig:instances:get

创建api分组

post /v2/{project_id}/apigw/instances/{instance_id}/api-groups

apig:groups:create

apig:instances:get

删除api分组

delete /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:groups:delete

apig:instances:get

查看api分组

get

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:groups:get

apig:instances:get

查看api分组列表

get

/v2/{project_id}/apigw/instances/{instance_id}/api-groups

apig:groups:list

apig:instances:get

更新api分组

put

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}

apig:groups:update

apig:instances:get

创建分组域名

post

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains

apig:domains:create

apig:instances:get

apig:groups:get

删除分组域名

delete

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}

apig:domains:delete

apig:instances:get

apig:groups:get

分组域名绑定证书

post

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate

apig:domains:bindcertificate

apig:instances:get

apig:groups:get

apig:domains:get

分组域名解绑证书

delete

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}

apig:domains:unbindcertificate

apig:instances:get

apig:groups:get

apig:domains:get

查看分组域名绑定的证书

get

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/domains/{domain_id}/certificate/{certificate_id}

apig:domains:getcertificate

apig:instances:get

apig:groups:get

apig:domains:get

设置调试域名是否可以访问

put /v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/sl-domain-access-settings

apig:domains:updatesldomainsetting

apig:instances:get

apig:groups:get

创建环境变量

post

/v2/{project_id}/apigw/instances/{instance_id}/env-variables

apig:variables:create

apig:instances:get

apig:groups:get

apig:envs:list

删除环境变量

delete

/v2/{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}

apig:variables:delete

apig:instances:get

apig:groups:get

apig:envs:list

查看环境变量

get

/v2/{project_id}/apigw/instances/{instance_id}/env-variables/{env_variable_id}

apig:variables:get

apig:instances:get

apig:groups:get

apig:envs:list

查看环境变量列表

get

/v2/{project_id}/apigw/instances/{instance_id}/env-variables

apig:variables:list

apig:instances:get

apig:groups:get

apig:envs:list

创建api

post

/v2/{project_id}/apigw/instances/{instance_id}/apis

apig:apis:create

apig:instances:get

apig:groups:get

删除api

delete /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:apis:delete

apig:instances:get

apig:groups:get

发布api

post /v2/{project_id}/apigw/instances/{instance_id}/apis/action

apig:apis:publish

apig:instances:get

apig:groups:get

apig:envs:list

下线api

post /v2/{project_id}/apigw/instances/{instance_id}/apis/action

apig:apis:offline

apig:instances:get

apig:groups:get

apig:envs:list

调试api

post /v2/{project_id}/apigw/instances/{instance_id}/apis/debug/{api_id}

apig:apis:debug

apig:instances:get

apig:groups:get

导入api

post /v2/{project_id}/apigw/instances/{instance_id}/openapi/import

apig:apis:import

apig:instances:get

apig:apis:create

apig:apis:bindacls

apig:apis:bindthrottles

apig:groups:get

apig:acls:create

apig:throttles:create

导出api

post /v2/{project_id}/apigw/instances/{instance_id}/openapi/export

apig:apis:export

apig:instances:get

apig:apis:list

apig:apis:get

apig:apis:listbindedtrottles

apig:apis:listbindedacls

apig:groups:get

apig:acls:get

apig:throttles:get

更新api

put

/v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:apis:update

apig:instances:get

apig:groups:get

授权api

post /v2/{project_id}/apigw/instances/{instance_id}/app-auths

apig:apis:grantappaccess

apig:instances:get

apig:apps:get

apig:apis:get

解授权api

delete /v2/{project_id}/apigw/instances/{instance_id}/app-auths/{app_auth_id}

apig:apis:relieveappaccess

apig:instances:get

apig:apps:get

apig:apis:get

api绑定签名

post /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings

apig:apis:bindsigns

apig:instances:get

apig:apis:get

apig:signs:list

api解绑签名

delete /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/{sign_bindings_id}

apig:apis:unbindsigns

apig:instances:get

apig:apis:get

apig:signs:list

api绑定访问控制

post /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings

apig:apis:bindacls

apig:instances:get

apig:apis:get

apig:acls:get

api解绑访问控制

delete /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/{acl_bindings_id}

apig:apis:unbindacls

apig:instances:get

apig:apis:get

apig:acls:get

api绑定流量控制

post /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings

apig:apis:bindthrottles

apig:instances:get

apig:apis:get

apig:throttles:get

api解绑流量控制

delete /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/{throttle_binding_id}

apig:apis:unbindthrottles

apig:instances:get

apig:apis:get

apig:throttles:get

查看api

get /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id}

apig:apis:get

apig:instances:get

apig:groups:get

查看api列表

get /v2/{project_id}/apigw/instances/{instance_id}/apis

apig:apis:list

apig:instances:get

apig:groups:get

查看api绑定的应用列表

get /v2/{project_id}/apigw/instances/{instance_id}/app-auths/binded-apps

apig:apis:listbindedapps

apig:instances:get

apig:apis:get

查看api绑定的签名列表

get /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-signs

apig:apis:listbindedsigns

apig:instances:get

apig:apis:get

查看api绑定的访问控制列表

get /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-acls

apig:apis:listbindedacls

apig:instances:get

apig:apis:get

查看api绑定的流量控制列表

get /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-throttles

apig:apis:listbindedthrottles

apig:instances:get

apig:apis:get

查看api绑定的插件列表

get /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id}/attached-plugins

apig:apis:listbindedplugins

apig:instances:get

apig:apis:get

api绑定插件

post /v2/{project_id}/apigw/instances/{instance_id}/apis/{api_id}/plugins/attach

apig:apis:bindplugins

apig:instances:get

apig:plugins:get

apig:apis:get

api解绑插件

put /v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/detach

apig:apis:unbindplugins

apig:instances:get

apig:plugins:get

apig:apis:get

创建环境

post /v2/{project_id}/apigw/instances/{instance_id}/envs

apig:envs:create

apig:instances:get

删除环境

delete /v2/{project_id}/apigw/instances/{instance_id}/envs/{env_id}

apig:envs:delete

apig:instances:get

查看环境列表

get /v2/{project_id}/apigw/instances/{instance_id}/envs

apig:envs:list

apig:instances:get

更新环境

put

/v2/{project_id}/apigw/instances/{instance_id}/envs/{env_id}

apig:envs:update

apig:instances:get

创建应用

post /v2/{project_id}/apigw/instances/{instance_id}/apps

apig:apps:create

apig:instances:get

删除应用

delete /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:apps:delete

apig:instances:get

查看应用

get /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:apps:get

apig:instances:get

查看应用列表

get /v2/{project_id}/apigw/instances/{instance_id}/apps

apig:apps:list

apig:instances:get

查看应用绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/app-auths/binded-apis

apig:apps:listbindedapis

apig:instances:get

apig:apps:get

查看应用未绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/app-auths/unbinded-apis

apig:apps:listunbindedapis

apig:instances:get

apig:apps:get

更新应用

put

/v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}

apig:apps:update

apig:instances:get

创建签名

post /v2/{project_id}/apigw/instances/{instance_id}/signs

apig:signs:create

apig:instances:get

删除签名

delete /v2/{project_id}/apigw/instances/{instance_id}/signs/{sign_id}

apig:signs:delete

apig:instances:get

查看签名列表

get /v2/{project_id}/apigw/instances/{instance_id}/signs

apig:signs:list

apig:instances:get

查看签名绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/binded-apis

apig:signs:listbindedapis

apig:instances:get

apig:signs:list

查看签名未绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/sign-bindings/unbinded-apis

apig:signs:listunbindedapis

apig:instances:get

apig:signs:list

更新签名

put

/v2/{project_id}/apigw/instances/{instance_id}/signs/{sign_id}

apig:signs:update

apig:instances:get

创建访问控制

post /v2/{project_id}/apigw/instances/{instance_id}/acls

apig:acls:create

apig:instances:get

删除访问控制

delete /v2/{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acls:delete

apig:instances:get

查看访问控制

get /v2/{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acls:get

apig:instances:get

查看访问控制列表

get /v2/{project_id}/apigw/instances/{instance_id}/acls

apig:acls:list

apig:instances:get

查看访问控制绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/binded-apis

apig:acl:listboundapi

apig:instances:get

apig:acls:get

查看访问控制未绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/acl-bindings/unbinded-apis

apig:acls:listunbindedapis

apig:instances:get

apig:acls:get

更新访问控制

put

/v2/{project_id}/apigw/instances/{instance_id}/acls/{acl_id}

apig:acls:update

apig:instances:get

创建流量控制

post /v2/{project_id}/apigw/instances/{instance_id}/throttles

apig:throttles:create

apig:instances:get

删除流量控制

delete /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:throttles:delete

apig:instances:get

查看流量控制详情

get /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:specialthrottles:get

apig:instances:get

查看流量控制列表

get /v2/{project_id}/apigw/instances/{instance_id}/throttles

apig:throttles:list

apig:instances:get

查看流量控制绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/binded-apis

apig:throttles:listbindedapis

apig:instances:get

apig:throttles:get

查看流量控制未绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/throttle-bindings/unbinded-apis

apig:throttles:listunbindedapis

apig:instances:get

apig:throttles:get

更新流量控制

put

/v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}

apig:throttles:update

apig:instances:get

创建特殊流量控制

post /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials

apig:specialthrottles:create

apig:instances:get

apig:throttles:get

删除特殊流量控制

delete /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}

apig:specialthrottles:delete

apig:instances:get

apig:throttles:get

查看特殊流量控制

get /v2/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials

apig:specialthrottles:get

apig:instances:get

apig:throttles:get

更新特殊流量控制

put

/{project_id}/apigw/instances/{instance_id}/throttles/{throttle_id}/throttle-specials/{strategy_id}

apig:specialthrottles:update

apig:instances:get

apig:throttles:get

创建负载通道

post /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels

apig:vpcchannels:create

apig:instances:get

删除负载通道

delete /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:vpcchannels:delete

apig:instances:get

更新负载通道

put /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:vpcchannels:update

apig:instances:get

负载通道添加后端实例

post /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members

apig:vpcchannels:addinstance

apig:instances:get

apig:vpcchannels:get

删除后端实例

delete /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/{member_id}

apig:vpcchannels:deleteinstance

apig:instances:get

apig:vpcchannels:get

查看负载通道详情

get /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}

apig:vpcchannels:get

apig:instances:get

查看负载通道列表

get /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels

apig:vpcchannels:list

apig:instances:get

更新vpc通道后端服务器组

put /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}

apig:vpcchannels:updatemembergroup

apig:instances:get

apig:vpcchannels:get

添加或更新vpc通道后端服务器组

post /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups

apig:vpcchannels:addorupdatemembergroups

apig:instances:get

apig:vpcchannels:get

批量修改后端服务器状态不可用

post /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-disable

apig:vpcchannels:batchenableinstance

apig:instances:get

apig:vpcchannels:get

删除vpc通道后端服务器组

delete /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/member-groups/{member_group_id}

apig:vpcchannels:deletemembergroup

apig:instances:get

apig:vpcchannels:get

批量修改后端服务器状态可用

post /v2/{project_id}/apigw/instances/{instance_id}/vpc-channels/{vpc_channel_id}/members/batch-enable

apig:vpcchannels:batchdisableinstance

apig:instances:get

apig:vpcchannels:get

创建自定义认证

post /v2/{project_id}/apigw/instances/{instance_id}/authorizers

apig:authorizers:create

functiongraph:function:getconfig

apig:instances:get

删除自定义认证

delete /v2/{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:authorizers:delete

apig:instances:get

查看自定义认证详情

get /v2/{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:authorizers:get

apig:instances:get

查看自定义认证列表

get /v2/{project_id}/apigw/instances/{instance_id}/authorizers

apig:authorizers:list

apig:instances:get

更新自定义认证

put

/v2/{project_id}/apigw/instances/{instance_id}/authorizers/{authorizer_id}

apig:authorizers:update

apig:instances:get

查看标签列表

get /v2/{project_id}/apigw/instances/{instance_id}/tags

apig:tags:list

apig:instances:get

查看实例特性列表

get /v2/{project_id}/apigw/instances/{instance_id}/features

apig:features:list

apig:instances:get

创建实例特性

post /v2/{project_id}/apigw/instances/{instance_id}/features

apig:features:create

apig:instances:get

查看监控数据

get /v2/{project_id}/apigw/instances/{instance_id}/metric-data

apig:metricdata:get

apig:instances:get

创建网关响应

post

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses

apig:gatewayresponses:create

apig:instances:get

apig:groups:get

查看网关响应

get

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:gatewayresponses:get

apig:instances:get

apig:groups:get

更新网关响应

put

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:gatewayresponses:update

apig:instances:get

apig:groups:get

删除网关响应

delete

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses/{response_id}

apig:gatewayresponses:delete

apig:instances:get

apig:groups:get

查看网关响应列表

get

/v2/{project_id}/apigw/instances/{instance_id}/api-groups/{group_id}/gateway-responses

apig:gatewayresponses:list

apig:instances:get

apig:groups:get

创建应用的appcode

post /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:appcodes:create

apig:instances:get

apig:apps:get

查看应用的appcode列表

get /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:appcodes:list

apig:instances:get

apig:apps:get

查看应用的appcode

get /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}

apig:appcodes:get

apig:instances:get

apig:apps:get

更新应用的appcode

put

/v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes

apig:appcodes:update

apig:instances:get

apig:apps:get

删除应用的appcode

delete /v2/{project_id}/apigw/instances/{instance_id}/apps/{app_id}/app-codes/{app_code_id}

apig:appcodes:delete

apig:instances:get

apig:apps:get

创建插件

post /v2/{project_id}/apigw/instances/{instance_id}/plugins

apig:plugins:create

apig:instances:get

更新插件

put

/v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugins:update

apig:instances:get

查看插件列表

get /v2/{project_id}/apigw/instances/{instance_id}/plugins

apig:plugins:list

apig:instances:get

查看插件绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attached-apis

apig:plugins:listbindedapis

apig:instances:get

apig:plugins:get

查看插件

get /v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugins:get

apig:instances:get

查看插件未绑定的api列表

get /v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}/attachable-apis

apig:plugins:listunbindedapis

apig:instances:get

apig:plugins:get

删除插件

delete /v2/{project_id}/apigw/instances/{instance_id}/plugins/{plugin_id}

apig:plugins:delete

apig:instances:get

相关文档

网站地图