grammar description #

You can use logical nonsyntax when defining an action or resource to express "exclusion" semantics for some actions or resources. The specific keywords are as follows:

• **NotAction: **Define the scope of the action to be excluded, which must be used with the Action , meaning that it contains the actions defined in the Action but excludes the actions defined in the NotAction .
• **NotResource: **Define the scope of resources to be excluded and must be used with NotResource , meaning that it contains resources defined in Resource but excludes resources defined in NotResource .

For example, the following policy includes permissions to the Cloud as a Service except for the private network:

{ 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "*" 
      ], 
      "NotAction":[ 
        "vpc:*" 
      ], 
      "Resource": [ 
        "*" 
      ] 
    } 
  ] 
}

The following policies contain permissions to operate on all VPC resources except the private network vpc-bp15zckdt37pq72zv**** :

{ 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "vpc:*" 
      ], 
      "Resource": [ 
        "*" 
      ], 
      "NotResource": [ 
        "trn:vpc:cn-beijing:2000001234:vpc/vpc-bp15zckdt37pq72zv****" 
      ] 
    } 
  ] 
}

Cloud as a Service with NotAction and NotResource support #

At present, only some Cloud as a Service support NotAction and NotResource syntax. For Cloud as a Service that is not supported, you cannot use NotAction or NotResource keywords in policies. Here is a list of supported services: