Query Conditional Access Policies by Network Zone - EIAM - Alibaba Cloud - Identity as a Service

Retrieves the list of conditional access policies associated with a network zone.

Operation description

Retrieves the list of conditional access policies associated with a network zone.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

eiam:ListConditionalAccessPoliciesForNetworkZone

list

*ConditionalAccessPolicy

acs:eiam:{#regionId}:{#accountId}:instance/{#InstanceId}/conditionalaccesspolicy/*

*NetworkZone

acs:eiam:{#regionId}:{#accountId}:instance/{#InstanceId}/networkzone/{#NetworkZoneId}

None

Request parameters

Parameter	Type	Required	Description	Example
InstanceId	string	Yes	The instance ID.	idaas_ue2jvisn35ea5lmthk267xxxxx
NetworkZoneId	string	Yes	The network zone ID associated with the conditional access policy.	app_11111

Response elements

Element	Type	Description	Example
	object
RequestId	string	The request ID.	0441BD79-92F3-53AA-8657-F8CE4A2B912A
ConditionalAccessPolicies	array<object>	The collection of conditional access policies.
	array<object>	The collection of conditional access policies.
InstanceId	string	The instance ID.	idaas_oynbcyaaejuik6b37eldz4pinu
ConditionalAccessPolicyId	string	The conditional access policy ID.	cp_xxxxx
ConditionalAccessPolicyName	string	The conditional access policy name.	My policy
Description	string	The description of the conditional access policy.	terraform-example
ConditionalAccessPolicyType	string	The type of the conditional access policy.	arn:alibaba:idaas:authn:access:policy:system
Status	string	The enabled or disabled status of the conditional access policy.	disabled
DecisionType	string	The decision type of the conditional access policy.	enforcement
EvaluateAt	string	The evaluation point of the conditional access policy.	arn:alibaba:idaas:authn:access:rule:eval_at:after_step1
Priority	integer	The priority.	10
DecisionConfig	object	The decision action configuration of the conditional access policy.
Effect	string	Decision action of the conditional access policy	allow
MfaType	string	MFA type of the conditional access policy	directly_access
MfaAuthenticationIntervalSeconds	integer	Re-authentication interval for conditional access policy (seconds)	300
MfaAuthenticationMethods	array	MFA types allowed by the conditional access policy
	string	MFA types allowed by the conditional access policy, with selectable values including: ia_otp_sms: SMS verification code ia_otp_email: Email verification code ia_totp: OTP dynamic password ia_webauthn: WebAuthn	ia_totp
ActiveSessionReuseStatus	string	Whether session reuse is enabled	enabled
ConditionsConfig	object	The conditions configuration of the conditional access policy.
Applications	object	Target applications of the conditional access policy
IncludeApplications	array	Selected applications
	string	Application ID	app_xxxxx
ExcludeApplications	array	Excluded applications
	string	Application ID	app_xxxxx
Users	object	Target users of the conditional access policy
IncludeUsers	array	Selected users
	string	User ID	user_xxxxx
ExcludeUsers	array	Excluded Users
	string	User ID	user_xxxxx
IncludeGroups	array	Selected user groups
	string	User group ID	group_xxxxx
ExcludeGroups	array	Excluded user groups
	string	User group ID	group_xxxxx
IncludeOrganizationalUnits	array	Selected organizations
	string	Organization ID	ou_xxxxx
ExcludeOrganizationalUnits	array	Excluded organizations
	string	Organization ID	ou_xxxxx
NetworkZones	object	Network zones for conditional access policies
IncludeNetworkZones	array	Included network zones
	string	Network zone ID	network_xxxxx
ExcludeNetworkZones	array	Excluded network zones
	string	Network Zone ID	network_xxxxx
CreateTime	integer	The creation time.	1741857554000
LastUpdatedTime	integer	The last updated time.	1741857554000

Examples

Success response

JSON format

{
  "RequestId": "0441BD79-92F3-53AA-8657-F8CE4A2B912A",
  "ConditionalAccessPolicies": [
    {
      "InstanceId": "idaas_oynbcyaaejuik6b37eldz4pinu",
      "ConditionalAccessPolicyId": "cp_xxxxx",
      "ConditionalAccessPolicyName": "My policy",
      "Description": "terraform-example",
      "ConditionalAccessPolicyType": "arn:alibaba:idaas:authn:access:policy:system",
      "Status": "disabled",
      "DecisionType": "enforcement",
      "EvaluateAt": "arn:alibaba:idaas:authn:access:rule:eval_at:after_step1",
      "Priority": 10,
      "DecisionConfig": {
        "Effect": "allow",
        "MfaType": "directly_access",
        "MfaAuthenticationIntervalSeconds": 300,
        "MfaAuthenticationMethods": [
          "ia_totp"
        ],
        "ActiveSessionReuseStatus": "enabled"
      },
      "ConditionsConfig": {
        "Applications": {
          "IncludeApplications": [
            "app_xxxxx"
          ],
          "ExcludeApplications": [
            "app_xxxxx"
          ]
        },
        "Users": {
          "IncludeUsers": [
            "user_xxxxx"
          ],
          "ExcludeUsers": [
            "user_xxxxx"
          ],
          "IncludeGroups": [
            "group_xxxxx"
          ],
          "ExcludeGroups": [
            "group_xxxxx"
          ],
          "IncludeOrganizationalUnits": [
            "ou_xxxxx"
          ],
          "ExcludeOrganizationalUnits": [
            "ou_xxxxx"
          ]
        },
        "NetworkZones": {
          "IncludeNetworkZones": [
            "network_xxxxx"
          ],
          "ExcludeNetworkZones": [
            "network_xxxxx"
          ]
        }
      },
      "CreateTime": 1741857554000,
      "LastUpdatedTime": 1741857554000
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.