| Product |
Abbreviation in CAM |
Console |
Authorization by Tag |
Authorization Granularity |
IP Restriction |
| Secrets Manager |
ssm |
Supported |
Supported |
Resource level |
Partially supported |
Note：
The authorization granularity of cloud products is divided into three levels: service level, operation level, and resource level, based on the degree of granularity.
- Service level: It defines whether a user has the permission to access the service as a whole. A user can have either full access or no access to the service. For the authorization granularity of cloud products at service level, the authorization of specific APIs are not supported.
- Operation level: It defines whether a user has the permission to call a specific API of the service. For example, granting an account read-only access to the CVM service is an authorization at the operation level.
- Resource level: It is the finest authorization granularity which defines whether a user has the permission to access specific resources. For example, granting an account read/write access to a specific CVM instance is an authorization at the resource level.
API authorization granularity
Two authorization granularity levels of API are supported: resource level, and operation level.
- Resource level: It supports the authorization of a specific resource.
- Operation level: It does not support the authorization of a specific resource. If the policy syntax restricts a specific resource during authorization, CAM will determine that this API is not within the scope of authorization, and deem it as unauthorized.
Write operations
| API |
API Description |
Authorization Granularity |
Six-segment Resource Description |
IP Restriction |
| BatchUpdateSecretEncryptType |
BatchUpdateSecretEncryptType |
Resource level |
qcs::ssm::uin/:secret/creatorUin/$creatorUin/$secretName |
Supported |
| CreateAccessKeySecret |
Create AccessKey Secret |
Resource level |
qcs::ssm::uin/${uin}:secret/* |
Supported |
| CreateDBSecret |
Create DB Secret |
Resource level |
qcs::ssm::uin/${uin}:secret/* |
Supported |
| CreateProductSecret |
Create Product Secret |
Resource level |
qcs::ssm::uin/${uin}:secret/* |
Supported |
| CreateSSHKeyPairSecret |
Create SSH Key Pair Secret |
Resource level |
qcs::ssm::uin/${uin}:secret/* |
Supported |
| CreateSecret |
create secret |
Resource level |
qcs::ssm::uin/${uin}:secret/* |
Supported |
| DeleteSecret |
Delete secret information |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DeleteSecretVersion |
Delete secret for a specified version |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DisableSecret |
Disable secret |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| EnableSecret |
EnableSecret |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| PutSecretValue |
Add new version secret |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| RestoreSecret |
Recover secret from scheduled deletion |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| RotateProductSecret |
Rotate Product Secret |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| SyncDBSecretMetadata |
SyncDBSecretMetadata |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| UpdateDescription |
Update secret Description |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| UpdateRotationStatus |
Update Rotation Status |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| UpdateSecret |
Update secret content |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| UpdateSecretEncryptType |
UpdateSecretEncryptType |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
Read operations
| API |
API Description |
Authorization Granularity |
Six-segment Resource Description |
IP Restriction |
| DescribeAccessKeyRotateResult |
Describe AccessKey Rotate Result |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DescribeAsyncRequestInfo |
Describe Async Request Info |
Operation level |
* |
Supported |
| DescribeRotationDetail |
Describe Product Secret Rotation Detail |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DescribeRotationHistory |
Describe Product Secret Rotation History |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DescribeSecret |
get secret details |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| DescribeSupportedProducts |
Describe Supported Products |
Operation level |
* |
Supported |
| GetSSHKeyPairValue |
Get SSH Key Pair Value |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| GetSecretValue |
get plain text of secret |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| GetServiceStatus |
GetServiceStatus |
Operation level |
* |
Supported |
| ListAvailableSecretKeys |
ListAvailableSecretKeys |
Resource level |
qcs::ssm::uin/:secret/creatorUin/$creatorUin/$secretName |
not supported |
| ListSecretVersionIds |
get version list information under specified secret |
Resource level |
qcs::ssm:${region}:uin/${uin}:secret/creatorUin/$creatorUin/$secretName |
Supported |
| ListSecrets |
get list of secret details |
Operation level |
* |
Supported |
List Operations
| API |
API Description |
Authorization Granularity |
Six-segment Resource Description |
IP Restriction |
| DescribeMonitorActionList |
DescribeMonitorActionList |
Operation level |
* |
Supported |
| DescribeResourceIds |
Describe ResourceIds |
Resource level |
qcs::ssm::uin/${uin}:secret/creatorUin/* |
Supported |
| DescribeServiceList |
describe service list |
Resource level |
qcs::ssm::uin/:ssmservice/* |
Supported |
| GetRegions |
Get region display list in console |
Operation level |
* |
Supported |