Use GetPolicy to query control policy details - Bastionhost - Alibaba Cloud - Bastionhost

Retrieves the details of a specified control policy.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

yundun-bastionhost:GetPolicy

get

*All Resource

*

None

Request parameters

Parameter	Type	Required	Description	Example
InstanceId	string	Yes	The instance ID of the bastion host to which the control policy belongs. Note You can invoke the DescribeInstances operation to obtain this parameter.	bastionhost-cn-zvp2d3syb0g
RegionId	string	No	The region ID of the bastion host instance to which the control policy belongs. Note For the mapping between region IDs and region names, see Regions and zones.	cn-hangzhou
PolicyId	string	Yes	The ID of the control policy to query. Note You can call the ListPolicies operation to obtain this parameter.	3
ProjectId	integer	No	The project ID.	3

Response elements

Element	Type	Description	Example
	object
Policy	object	The details of the control policy.
AccessTimeRangeConfig	object	The logon time range restriction details.
EffectiveTime	array<object>	The details of the allowed logon time ranges.
	object
Days	array	The allowed logon days.
	string	The day of the week on which logon is allowed. Valid values: 1: Monday 2: Tuesday 3: Wednesday 4: Thursday 5: Friday 6: Saturday 7: Sunday	[2]
Hours	array	The allowed logon hours.
	string	The hour of the day during which logon is allowed. Valid values: 0: 0:00 to 1:00. 1: 1:00 to 2:00. 2: 2:00 to 3:00. 3: 3:00 to 4:00. 4: 4:00 to 5:00. 5: 5:00 to 6:00. 6: 6:00 to 7:00. 7: 7:00 to 8:00. 8: 8:00 to 9:00. 9: 9:00 to 10:00. 10: 10:00 to 11:00. 11: 11:00 to 12:00. 12: 12:00 to 13:00. 13: 13:00 to 14:00. 14: 14:00 to 15:00. 15: 15:00 to 16:00. 16: 16:00 to 17:00. 17: 17:00 to 18:00. 18: 18:00 to 19:00. 19: 19:00 to 20:00. 20: 20:00 to 21:00. 21: 21:00 to 22:00. 22: 22:00 to 23:00. 23: 23:00 to 0:00.	[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23]
CommandConfig	object	The command policy details.
Approval	object	The command approval configuration details.
Commands	array	The array of commands.
	string	The details of commands that require approval.	ls
Deny	object	The command control configuration details.
AclType	string	The command control type. Valid values: white: whitelist mode. black: blacklist mode.	black
Commands	array	The array of commands.
	string	The command details.	ls
Comment	string	The description of the control policy.	comment
IPAclConfig	object	The source IP restriction configuration details.
AclType	string	The source IP restriction mode. Valid values: white: whitelist mode. black: blacklist mode.	black
IPs	array	The IP address information for logon restriction.
	string	The list of restricted IP addresses.	[10.10..]
PolicyName	string	The Policy Name of the control policy.	test
PolicyId	string	The ID of the control policy.	3
Priority	integer	The priority of the control policy. A smaller value indicates a higher priority.	1
ProtocolConfig	object	The protocol control details.
RDP	object	The RDP option configuration details.
ClipboardDownload	string	The clipboard download configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
ClipboardUpload	string	The clipboard upload configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
DiskRedirection	string	The drive/printer mapping configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
RecordKeyboard	string	The keyboard recording configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
DiskRedirectionUpload	string	The RDP disk upload control.	Enable
DiskRedirectionDownload	string	The RDP disk download control.	Enable
SSH	object	The SSH and SFTP option configuration details.
ExecCommand	string	The remote command execution configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPChannel	string	The SFTP channel configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPDownloadFile	string	The SFTP file download configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPMkdir	string	The SFTP folder creation configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPRemoveFile	string	The SFTP file deletion configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPRenameFile	string	The SFTP file rename configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPRmdir	string	The SFTP folder deletion configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SFTPUploadFile	string	The SFTP file upload configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
SSHChannel	string	The SSH channel configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
AllowDirectTcp	string	Specifies whether to allow TCP tunneling.	Enable
X11Forwarding	string	The X11 forwarding configuration. Valid values: Enable: Enabled. Disable: Disabled.	Enable
TcpForwarding	string	Specifies whether to allow TCP forwarding.	Enable
AllowTcpForwarding	string	Specifies whether to allow TCP forwarding.	Enable
ApprovalConfig	object	The O&M approval configuration details.
SwitchStatus	string	The O&M approval configuration in the control policy. Valid values: On: O&M approval is enabled. Off: O&M approval is disabled.	Off
RequestId	string	The unique request ID generated by Alibaba Cloud for this request.	0D29F2C0-8B4B-5861-9474-F3F23D25594B

Examples

Success response

JSON format

{
  "Policy": {
    "AccessTimeRangeConfig": {
      "EffectiveTime": [
        {
          "Days": [
            "[2]"
          ],
          "Hours": [
            "[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23]"
          ]
        }
      ]
    },
    "CommandConfig": {
      "Approval": {
        "Commands": [
          "ls"
        ]
      },
      "Deny": {
        "AclType": "black",
        "Commands": [
          "ls"
        ]
      }
    },
    "Comment": "comment",
    "IPAclConfig": {
      "AclType": "black",
      "IPs": [
        "[10.10.**.**]"
      ]
    },
    "PolicyName": "test",
    "PolicyId": "3",
    "Priority": 1,
    "ProtocolConfig": {
      "RDP": {
        "ClipboardDownload": "Enable",
        "ClipboardUpload": "Enable",
        "DiskRedirection": "Enable",
        "RecordKeyboard": "Enable",
        "DiskRedirectionUpload": "Enable",
        "DiskRedirectionDownload": "Enable"
      },
      "SSH": {
        "ExecCommand": "Enable",
        "SFTPChannel": "Enable",
        "SFTPDownloadFile": "Enable",
        "SFTPMkdir": "Enable",
        "SFTPRemoveFile": "Enable",
        "SFTPRenameFile": "Enable",
        "SFTPRmdir": "Enable",
        "SFTPUploadFile": "Enable",
        "SSHChannel": "Enable",
        "AllowDirectTcp": "Enable",
        "X11Forwarding": "Enable",
        "TcpForwarding": "Enable",
        "AllowTcpForwarding": "Enable"
      }
    },
    "ApprovalConfig": {
      "SwitchStatus": "Off"
    }
  },
  "RequestId": "0D29F2C0-8B4B-5861-9474-F3F23D25594B"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidParameter	The argument is invalid.	The argument is invalid.
500	InternalError	An unknown error occurred.	An unknown error occurred.
404	PolicyNotFound	The policy is not found.	The policy is not found.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.