**Condition **is an optional element that defines the conditions under which a permission declaration takes effect. The key difference between IAM and RBAC model is that it provides attribute-based access control (ABAC). When defining permissions, it is no longer limited to defining "what subject accesses what object through what operation", but can further access control through the attribute information of the subject and object and the attribute information in the request. Based on this feature, you can define very fine access rights to maximize the security of various complex access scenarios on the cloud. For the current supported conditional keys and instructions for use, please refer to the Condition Condition Key Description ;forthesupportofCloudasaServiceforCondition,pleaserefertoListofConditionKeysSupportedbyCloudasaService

request context #

The API requests for users to access Cloud as a Service contain rich request context information, which can be classified into "identity attributes" (subject attributes), "resource attributes" (object attributes), "request attributes", and "environment attributes".

• Identity Attributes: Attributes of the requested identity, such as PrincipalTag (identity tag), PrincipalTrn (identity resource identifier);

• Request properties: The operation information on the resource is defined in the request, which is generally passed through the request parameters. Request parameters are divided into public and non-public parameters. Public parameters are required in the construct signature request (see API Calling Guide - Public Parameters ). Non-public parameters are API parameters provided by Cloud as a Service, usually placed in Query or Body for passing, such as RequestTag (request tags attached to cloud resources);

• Environment Attributes: Environmental information at the time of the request, such as IP (Internet Protocol Address accessed);

• Resource properties: Properties on a resource, such as a ResourceTag.

Permission policy #

Attribute-based access control for IAM is defined through the Condition element in the policy declaration. Here is an example of a policy with Condition:

{ 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "alb:*" 
      ], 
      "Resource": [ 
        "*" 
      ], 
      "Condition": { 
        "IpAddress": { 
          "volc:SourceIp":"8.8.8.8" 
        } 
      } 
    } 
  ] 
}

Interpretation: This policy restricts access to all Application Load Balancer operations only from Internet Protocol Address 8.8.8.8 (for example, not a real IP).

A single condition in the policy consists of **Operator (operator) **, **Condition Key (condition key) **, and **Condition Value (condition value) **. For a multi-valued Condition Key, you need to add a multi-valued matcher before the Operator. When it is determined that the condition needs to satisfy the premise that the Condition Key exists in the request context, the IfExists operator needs to be added before the Operator.

Take the following condition as an example, StringEquals is Operator, volc: RequestTag/apartment is Condition Key, and Finance is Condition Value:

{ 
      "Condition": { 
        "StringEquals": { 
          "Volc: RequestTag/apartment": "Finance" 
        } 
      } 
}

In a policy declaration, there can be multiple conditions, and a condition can have multiple pairs of condition keys. Each condition key can correspond to multiple condition values (expressed as an array), for example:

{ 
      "Condition": { 
        "StringEqualsIgnoreCase": { 
          "Volc: RequestTag/apartment": ["Finance", "Administration", "R & D"], 
          "Volc: ResourceTag/project": ["Game project", "Short video project"] 
        }, 
        "IpAddress": { 
          "volc:SourceIp": "203.0.113.0/24" 
        } 
      } 
}

Condition operation logic can refer to the following figure:

• AND stands for the "logical AND" relationship, and OR stands for the "logical OR" relationship.

In the above policy example, the composition of Condition is as follows:

Operator #

Refers to conditional operators, such as StringEquals for string exact matches. Operators include primitive operators and operation modifiers. The ++ operator is case-sensitive, so you need to ensure that ++ is written correctly in the policy.

Basic Operators #

The basic operators supported are as follows:

operation modifier #

IfExists modifier

In some scenarios, the condition key may not exist in the request context. When you want the condition key to not exist to skip the match, you can add the IfExists modifier in the Operator. For example, the following conditions represent that when the request context contains the volc: UserName condition key, only when the condition value is equal to bob can be matched; when the request context does not contain the volc: UserName condition key, the condition can be directly matched:

{ 
      "Condition": { 
        "StringEqualsIfExists": { 
          "volc:UserName":"bob" 
        } 
      } 
}

multi-valued modifier

In some scenarios, the same attribute may have multiple attribute values in the request context. At this time, it is necessary to use multi-valued modifiers to define multi-valued match types. Multi-valued modifiers include ForAllValues and ForAnyValue :

• ForAllValues : The condition key must be included in the request context and all condition values are matched (note: when the unconditional value is the empty set, the empty set is a subset of any set, so it can also be matched);
• ForAnyValue : The request context must contain a conditional key and at least one conditional value matches.

For example, the following condition uses both IfExists and ForAnyValue , which means that when the request passes the label (RequestTagKeys), the label key must be "department" ( IfExists let the case of not passing the label can still be matched by the condition, ForAnyValue When requiring multiple pairs of labels to be passed in the request, each pair of label keys must be equal to "department". Since the label key cannot be repeated at the time of request, this condition is equivalent to restricting the user to only pass the label with the label key "department" if the label is passed).

{ 
      "Condition": { 
        "ForAnyValue:StringEqualsIfExists": { 
          "volc:RequestTagKeys": "department" 
        } 
      } 
}

Condition key #

The condition key specifies the attribute field to be computed in the request context, such as volc: PrincipalTrn (TRN representing the identity of the request). The identity attribute, the public parameter part in the request attribute, and the environment attribute are usually used as the **global condition key **, and the non-public parameter part in the request attribute and the resource attribute are usually used as the **service condition key **.

• The conditional key format is ${ServiceCode}: ${ConditonKeyName} , $ {ServiceCode} is the service of the specific Cloud as a Service, and the global conditional key uses the'volc 'keyword (that is, the format is'volc: ${ConditionKeyName}'). ++ Condition keys are case-sensitive, you need to ensure that ++ is written correctly in the policy.
• Some condition keys may have multiple values in the context of each request, and such condition keys are called multi-valued type condition keys; some condition keys may have at most one value in the context of each request, and such condition keys are called single-valued type condition keys. Conditional keys of multi-valued types require the use of multi-valued modifiers (refer to the Operational Modifiers section above).

The following are the conditional keys and descriptions for access control support:

Condition value #

Conditional values limit the range of attribute values required for a successful match to take effect. Conditional values can be arrays, and multiple values in the array are "logical or" matches. Wild-card is supported within conditional values:

• Wild-card * : Matches 0, 1, or more characters.
• Wild-card ? : Matches one character (cannot be 0).