**Resource (Resource) **element contains the scope of resources defined by the permission declaration, using the **TRN **expression definition. TRN (The Resource Name) is a globally unique identifier of resources on Volcano Engine, which consists of information such as service, region, account, resource path, etc. The format is as follows:
trn:${ServiceCode}:${Region}:${AccountId}:${ResourcePath}
Here are explanations for each part:

trn: Fixed prefix of TRN
${ServiceCode}: The code of Cloud as a Service, for example, the ServiceCode of Cloud as a Service is ecs , and the ServiceCode of different cloud products can be queried from the API documentation of the service.
${RegionCode}: Region to which the resource belongs, Global Resource The field value should be empty. The following are the RegionCodes for different regions.
${AccountId}: The account ID to which the resource belongs
${ResourcePath}: Resource path, for example, the resource path of ECS instance is instance/${InstanceId} , instance is the fixed resource type name of the ECS instance, and ${InstanceId} is the ID of the Cloud as a Service instance. Path formats for different resource types can be found in the table at the end of the document.

Example 1: The account with AccountID 2000000001 created the instance Cloud as a Service with id = i-100 in cn-Beijing, and the corresponding resource TRN is trn: ecs: cn-Beijing: 2000000001: instance/i-100

Example 2: IAM user with the user name Bob created by the account with AccountID 2000000001, and the corresponding resource TRN is trn: i am :: 2000000001: user/Bob (IAM is a global service and does not distinguish between regions, so the region value here is empty)

In some scenarios, you can use the NotResource keyword to exclude resources defined in some Resources . For details, please refer to the NotResource syntax description .

The Resource element supports the overall expression of wild-card * , or the use of wild-card in the TRN from paragraph 2 to every subsequent paragraph:

• Wild-card * : Matches 0, 1, or more characters.
• Wild-card ? : Matches one character (cannot be 0).

The following is a policy that includes Resources:

{ 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "ecs:DeleteInstance" 
      ], 
      "Resource": [ 
        "trn:ecs:cn-beijing:2000000001:instance/i-100", 
        "trn:ecs:cn-beijing:2000000001:instance/i-200" 
      ] 
    }, 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "iam:GetUser" 
      ], 
      "Resource": [ 
        "*" 
      ] 
    } 
  ] 
}

**Interpretation: **This policy defines permissions to allow deletion of Cloud as a Service instances with instance IDs i-100 and i-200 and to allow querying of all IAM users.

Supported Cloud as a Service Resource Types #

You can refer to the specific Cloud as a Service product documentation to learn about the supported resource types. The following are resource TRN formats for some commonly used services: