Edge Security Acceleration:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のDynamic Content Delivery Network (DCDN)リソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のDynamic Content Delivery Network (DCDN)リソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のDynamic Content Delivery Network (DCDN)アクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dcdn:DescribeApp",
          "dcdn:DescribeAppConfigs",
          "dcdn:DescribeAppState",
          "dcdn:DescribeAppTenant",
          "dcdn:DescribeAppVersion",
          "dcdn:DescribeAppVersions",
          "dcdn:DescribeApps",
          "dcdn:DescribeBackOriginAreas",
          "dcdn:DescribeCustomDomainSampleRate",
          "dcdn:DescribeCustomScenePolicies",
          "dcdn:DescribeCustomScenePolicyObject",
          "dcdn:DescribeDcdnAclFields",
          "dcdn:DescribeDcdnActivationHistory",
          "dcdn:DescribeDcdnActiveVersionOfConfigGroup",
          "dcdn:DescribeDcdnBgpBpsData",
          "dcdn:DescribeDcdnBgpTrafficData",
          "dcdn:DescribeDcdnBlockedRegions",
          "dcdn:DescribeDcdnCcSignatureArgList",
          "dcdn:DescribeDcdnCcSignatureObjectList",
          "dcdn:DescribeDcdnCertificateDetail",
          "dcdn:DescribeDcdnCertificateDetailById",
          "dcdn:DescribeDcdnConditionIPBInfo",
          "dcdn:DescribeDcdnConfigGroupDetail",
          "dcdn:DescribeDcdnConfigGroupList",
          "dcdn:DescribeDcdnConfigOfVersion",
          "dcdn:DescribeDcdnConfigOfVersionForDiff",
          "dcdn:DescribeDcdnContainerStats",
          "dcdn:DescribeDcdnDdosService",
          "dcdn:DescribeDcdnDdosSpecInfo",
          "dcdn:DescribeDcdnDeletedDomains",
          "dcdn:DescribeDcdnDeliverList",
          "dcdn:DescribeDcdnDomainByCertificate",
          "dcdn:DescribeDcdnDomainCcActivityLog",
          "dcdn:DescribeDcdnDomainMax95BpsData",
          "dcdn:DescribeDcdnDomainMd5Info",
          "dcdn:DescribeDcdnDomainNamesOfVersion",
          "dcdn:DescribeDcdnDomainVerifyData",
          "dcdn:DescribeDcdnDomainsBySource",
          "dcdn:DescribeDcdnErUsageData",
          "dcdn:DescribeDcdnFullDomainsBlockIPConfig",
          "dcdn:DescribeDcdnFullDomainsBlockIPHistory",
          "dcdn:DescribeDcdnHttpsDomainList",
          "dcdn:DescribeDcdnIpInfo",
          "dcdn:DescribeDcdnIpaDomainCidr",
          "dcdn:DescribeDcdnIpaService",
          "dcdn:DescribeDcdnKvAccount",
          "dcdn:DescribeDcdnKvAccountStatus",
          "dcdn:DescribeDcdnKvNamespace",
          "dcdn:DescribeDcdnL2Ips",
          "dcdn:DescribeDcdnL2Vips",
          "dcdn:DescribeDcdnRealTimeDeliveryField",
          "dcdn:DescribeDcdnRefreshQuota",
          "dcdn:DescribeDcdnRefreshTaskById",
          "dcdn:DescribeDcdnRegionAndIsp",
          "dcdn:DescribeDcdnReportList",
          "dcdn:DescribeDcdnResourcesProperty",
          "dcdn:DescribeDcdnSLSRealTimeLogType",
          "dcdn:DescribeDcdnSLSRealtimeLogDelivery",
          "dcdn:DescribeDcdnSMCertificateDetail",
          "dcdn:DescribeDcdnSecFuncInfo",
          "dcdn:DescribeDcdnSecSpecInfo",
          "dcdn:DescribeDcdnService",
          "dcdn:DescribeDcdnStagingIp",
          "dcdn:DescribeDcdnSubList",
          "dcdn:DescribeDcdnTopDomainsByFlow",
          "dcdn:DescribeDcdnUserBillHistory",
          "dcdn:DescribeDcdnUserBillType",
          "dcdn:DescribeDcdnUserCertificateExpireCount",
          "dcdn:DescribeDcdnUserConfigs",
          "dcdn:DescribeDcdnUserQuota",
          "dcdn:DescribeDcdnUserRealTimeDeliveryField",
          "dcdn:DescribeDcdnUserResourcePackage",
          "dcdn:DescribeDcdnUserSecDrop",
          "dcdn:DescribeDcdnUserSecDropByMinute",
          "dcdn:DescribeDcdnUserTags",
          "dcdn:DescribeDcdnVerifyContent",
          "dcdn:DescribeDcdnVersionInfo",
          "dcdn:DescribeDcdnVersionOfConfigGroup",
          "dcdn:DescribeDcdnWafBotAppKey",
          "dcdn:DescribeDcdnWafDefaultRules",
          "dcdn:DescribeDcdnWafDomains",
          "dcdn:DescribeDcdnWafFilterInfo",
          "dcdn:DescribeDcdnWafGeoInfo",
          "dcdn:DescribeDcdnWafGroup",
          "dcdn:DescribeDcdnWafGroups",
          "dcdn:DescribeDcdnWafList",
          "dcdn:DescribeDcdnWafLists",
          "dcdn:DescribeDcdnWafPolicies",
          "dcdn:DescribeDcdnWafPolicy",
          "dcdn:DescribeDcdnWafPolicyDomains",
          "dcdn:DescribeDcdnWafPolicyValidDomains",
          "dcdn:DescribeDcdnWafQuota",
          "dcdn:DescribeDcdnWafRule",
          "dcdn:DescribeDcdnWafRules",
          "dcdn:DescribeDcdnWafScenes",
          "dcdn:DescribeDcdnWafService",
          "dcdn:DescribeDcdnWafSpecInfo",
          "dcdn:DescribeDcdnsecService",
          "dcdn:DescribeDdosAllEventList",
          "dcdn:DescribeDdosBpsList",
          "dcdn:DescribeDdosBpsMax",
          "dcdn:DescribeDdosEventMax",
          "dcdn:DescribeDdosSpecialPort",
          "dcdn:DescribeDomainAttackEventList",
          "dcdn:DescribeDomainOverview",
          "dcdn:DescribeDomainQpsList",
          "dcdn:DescribeEncryptRoutineUid",
          "dcdn:DescribeEsExceptionData",
          "dcdn:DescribeEsExecuteData",
          "dcdn:DescribeHighlightInfo",
          "dcdn:DescribeKVTimeoutRequestDistributionData",
          "dcdn:DescribeKvPerfData",
          "dcdn:DescribeKvRealTimeQpsData",
          "dcdn:DescribeKvUsageData",
          "dcdn:DescribeRDDomainConfig",
          "dcdn:DescribeRDDomains",
          "dcdn:DescribeRegistryNamespace",
          "dcdn:DescribeRegistryUser",
          "dcdn:DescribeRoutine",
          "dcdn:DescribeRoutineCanaryEnvs",
          "dcdn:DescribeRoutineCodeRevision",
          "dcdn:DescribeRoutineRelatedDomains",
          "dcdn:DescribeRoutineSpec",
          "dcdn:DescribeRoutineUserInfo",
          "dcdn:DescribeRuleHitsTopResource",
          "dcdn:DescribeRuleIdInfo",
          "dcdn:DescribeUserDcdnDdosStatus",
          "dcdn:DescribeUserDcdnIpaStatus",
          "dcdn:DescribeUserDcdnStatus",
          "dcdn:DescribeUserDcdnWafStatus",
          "dcdn:DescribeUserErStatus",
          "dcdn:DescribeUserLogserviceStatus",
          "dcdn:DescribeWasm",
          "dcdn:DescribeWasmUserInfo",
          "dcdn:GetAuthorizationToken",
          "dcdn:GetDcdnKv",
          "dcdn:GetDcdnKvDetail",
          "dcdn:GetDcdnKvStatus",
          "dcdn:ListBackOriginMapping",
          "dcdn:ListBackOriginSource",
          "dcdn:ListDcdnEsTemplateInfo",
          "dcdn:ListDcdnIpaTagResources",
          "dcdn:ListDcdnKv"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dcdn:ActivateDcdnVersionOfConfigGroup",
          "dcdn:AddBackOriginSource",
          "dcdn:AddDcdnConfigGroup",
          "dcdn:BatchCreateDcdnWafRules",
          "dcdn:BatchDeleteDcdnKv",
          "dcdn:BatchDeleteDcdnKvWithHighCapacity",
          "dcdn:BatchDeleteDcdnWafRules",
          "dcdn:BatchModifyDcdnWafRules",
          "dcdn:BatchPutDcdnKv",
          "dcdn:BatchPutDcdnKvWithHighCapacity",
          "dcdn:BatchSetRDBlockIP",
          "dcdn:BlockDcdnObjectCaches",
          "dcdn:CheckDcdnIpaVip",
          "dcdn:CheckDcdnProjectExist",
          "dcdn:CloneDcdnVersionOfConfigGroup",
          "dcdn:CommitStagingRoutineCode",
          "dcdn:CreateApp",
          "dcdn:CreateAppConfig",
          "dcdn:CreateAppVersion",
          "dcdn:CreateBackOriginMapping",
          "dcdn:CreateCustomScenePolicy",
          "dcdn:CreateDcdnCertificateSigningRequest",
          "dcdn:CreateDcdnWafGroup",
          "dcdn:CreateDcdnWafList",
          "dcdn:CreateDcdnWafPolicy",
          "dcdn:CreateDcdnpaybag",
          "dcdn:CreateRegistryNamespace",
          "dcdn:CreateRegistryUser",
          "dcdn:CreateRoutine",
          "dcdn:CreateSlrAndSlsProject",
          "dcdn:CreateWasm",
          "dcdn:CustomScenePolicyBindObject",
          "dcdn:DcdnHttpRequestStagingTest",
          "dcdn:DcdnHttpRequestTestTool",
          "dcdn:DeactivateDcdnConfigOfVersion",
          "dcdn:DeleteBackOriginMapping",
          "dcdn:DeleteCustomDomainSampleRate",
          "dcdn:DeleteCustomScenePolicy",
          "dcdn:DeleteDcdnConfigGroup",
          "dcdn:DeleteDcdnConfigOfVersion",
          "dcdn:DeleteDcdnDeliverTask",
          "dcdn:DeleteDcdnIpaSpecificConfig",
          "dcdn:DeleteDcdnKv",
          "dcdn:DeleteDcdnKvNamespace",
          "dcdn:DeleteDcdnRealTimeLogProject",
          "dcdn:DeleteDcdnSubTask",
          "dcdn:DeleteDcdnUserConfig",
          "dcdn:DeleteDcdnVersionOfConfigGroup",
          "dcdn:DeleteDcdnWafGroup",
          "dcdn:DeleteDcdnWafList",
          "dcdn:DeleteDcdnWafPolicy",
          "dcdn:DeleteRoutine",
          "dcdn:DeleteRoutineCodeRevision",
          "dcdn:DeleteRoutineConfEnvs",
          "dcdn:DeleteWasm",
          "dcdn:DeleteWasmCodeRevision",
          "dcdn:DeployAppVersion",
          "dcdn:DescribeApp",
          "dcdn:DescribeAppConfigs",
          "dcdn:DescribeAppState",
          "dcdn:DescribeAppTenant",
          "dcdn:DescribeAppVersion",
          "dcdn:DescribeAppVersions",
          "dcdn:DescribeApps",
          "dcdn:DescribeBackOriginAreas",
          "dcdn:DescribeCustomDomainSampleRate",
          "dcdn:DescribeCustomScenePolicies",
          "dcdn:DescribeCustomScenePolicyObject",
          "dcdn:DescribeDcdnAclFields",
          "dcdn:DescribeDcdnActivationHistory",
          "dcdn:DescribeDcdnActiveVersionOfConfigGroup",
          "dcdn:DescribeDcdnBgpBpsData",
          "dcdn:DescribeDcdnBgpTrafficData",
          "dcdn:DescribeDcdnBlockedRegions",
          "dcdn:DescribeDcdnCcSignatureArgList",
          "dcdn:DescribeDcdnCcSignatureObjectList",
          "dcdn:DescribeDcdnCertificateDetail",
          "dcdn:DescribeDcdnCertificateDetailById",
          "dcdn:DescribeDcdnConditionIPBInfo",
          "dcdn:DescribeDcdnConfigGroupDetail",
          "dcdn:DescribeDcdnConfigGroupList",
          "dcdn:DescribeDcdnConfigOfVersion",
          "dcdn:DescribeDcdnConfigOfVersionForDiff",
          "dcdn:DescribeDcdnContainerStats",
          "dcdn:DescribeDcdnDdosService",
          "dcdn:DescribeDcdnDdosSpecInfo",
          "dcdn:DescribeDcdnDeletedDomains",
          "dcdn:DescribeDcdnDeliverList",
          "dcdn:DescribeDcdnDomainByCertificate",
          "dcdn:DescribeDcdnDomainCcActivityLog",
          "dcdn:DescribeDcdnDomainMax95BpsData",
          "dcdn:DescribeDcdnDomainMd5Info",
          "dcdn:DescribeDcdnDomainNamesOfVersion",
          "dcdn:DescribeDcdnDomainVerifyData",
          "dcdn:DescribeDcdnDomainsBySource",
          "dcdn:DescribeDcdnErUsageData",
          "dcdn:DescribeDcdnFullDomainsBlockIPConfig",
          "dcdn:DescribeDcdnFullDomainsBlockIPHistory",
          "dcdn:DescribeDcdnHttpsDomainList",
          "dcdn:DescribeDcdnIpInfo",
          "dcdn:DescribeDcdnIpaDomainCidr",
          "dcdn:DescribeDcdnIpaService",
          "dcdn:DescribeDcdnKvAccount",
          "dcdn:DescribeDcdnKvAccountStatus",
          "dcdn:DescribeDcdnKvNamespace",
          "dcdn:DescribeDcdnL2Ips",
          "dcdn:DescribeDcdnL2Vips",
          "dcdn:DescribeDcdnRealTimeDeliveryField",
          "dcdn:DescribeDcdnRefreshQuota",
          "dcdn:DescribeDcdnRefreshTaskById",
          "dcdn:DescribeDcdnRegionAndIsp",
          "dcdn:DescribeDcdnReportList",
          "dcdn:DescribeDcdnResourcesProperty",
          "dcdn:DescribeDcdnSLSRealTimeLogType",
          "dcdn:DescribeDcdnSLSRealtimeLogDelivery",
          "dcdn:DescribeDcdnSMCertificateDetail",
          "dcdn:DescribeDcdnSecFuncInfo",
          "dcdn:DescribeDcdnSecSpecInfo",
          "dcdn:DescribeDcdnService",
          "dcdn:DescribeDcdnStagingIp",
          "dcdn:DescribeDcdnSubList",
          "dcdn:DescribeDcdnTopDomainsByFlow",
          "dcdn:DescribeDcdnUserBillHistory",
          "dcdn:DescribeDcdnUserBillType",
          "dcdn:DescribeDcdnUserCertificateExpireCount",
          "dcdn:DescribeDcdnUserConfigs",
          "dcdn:DescribeDcdnUserQuota",
          "dcdn:DescribeDcdnUserRealTimeDeliveryField",
          "dcdn:DescribeDcdnUserResourcePackage",
          "dcdn:DescribeDcdnUserSecDrop",
          "dcdn:DescribeDcdnUserSecDropByMinute",
          "dcdn:DescribeDcdnUserTags",
          "dcdn:DescribeDcdnVerifyContent",
          "dcdn:DescribeDcdnVersionInfo",
          "dcdn:DescribeDcdnVersionOfConfigGroup",
          "dcdn:DescribeDcdnWafBotAppKey",
          "dcdn:DescribeDcdnWafDefaultRules",
          "dcdn:DescribeDcdnWafDomains",
          "dcdn:DescribeDcdnWafFilterInfo",
          "dcdn:DescribeDcdnWafGeoInfo",
          "dcdn:DescribeDcdnWafGroup",
          "dcdn:DescribeDcdnWafGroups",
          "dcdn:DescribeDcdnWafList",
          "dcdn:DescribeDcdnWafLists",
          "dcdn:DescribeDcdnWafPolicies",
          "dcdn:DescribeDcdnWafPolicy",
          "dcdn:DescribeDcdnWafPolicyDomains",
          "dcdn:DescribeDcdnWafPolicyValidDomains",
          "dcdn:DescribeDcdnWafQuota",
          "dcdn:DescribeDcdnWafRule",
          "dcdn:DescribeDcdnWafRules",
          "dcdn:DescribeDcdnWafScenes",
          "dcdn:DescribeDcdnWafService",
          "dcdn:DescribeDcdnWafSpecInfo",
          "dcdn:DescribeDcdnsecService",
          "dcdn:DescribeDdosAllEventList",
          "dcdn:DescribeDdosBpsList",
          "dcdn:DescribeDdosBpsMax",
          "dcdn:DescribeDdosEventMax",
          "dcdn:DescribeDdosSpecialPort",
          "dcdn:DescribeDomainAttackEventList",
          "dcdn:DescribeDomainOverview",
          "dcdn:DescribeDomainQpsList",
          "dcdn:DescribeEncryptRoutineUid",
          "dcdn:DescribeEsExceptionData",
          "dcdn:DescribeEsExecuteData",
          "dcdn:DescribeHighlightInfo",
          "dcdn:DescribeKVTimeoutRequestDistributionData",
          "dcdn:DescribeKvPerfData",
          "dcdn:DescribeKvRealTimeQpsData",
          "dcdn:DescribeKvUsageData",
          "dcdn:DescribeRDDomainConfig",
          "dcdn:DescribeRDDomains",
          "dcdn:DescribeRegistryNamespace",
          "dcdn:DescribeRegistryUser",
          "dcdn:DescribeRoutine",
          "dcdn:DescribeRoutineCanaryEnvs",
          "dcdn:DescribeRoutineCodeRevision",
          "dcdn:DescribeRoutineRelatedDomains",
          "dcdn:DescribeRoutineSpec",
          "dcdn:DescribeRoutineUserInfo",
          "dcdn:DescribeRuleHitsTopResource",
          "dcdn:DescribeRuleIdInfo",
          "dcdn:DescribeUserDcdnDdosStatus",
          "dcdn:DescribeUserDcdnIpaStatus",
          "dcdn:DescribeUserDcdnStatus",
          "dcdn:DescribeUserDcdnWafStatus",
          "dcdn:DescribeUserErStatus",
          "dcdn:DescribeUserLogserviceStatus",
          "dcdn:DescribeWasm",
          "dcdn:DescribeWasmUserInfo",
          "dcdn:DisableCustomScenePolicy",
          "dcdn:DisableDcdnRDAccess",
          "dcdn:EditRoutineConf",
          "dcdn:EditWasmConf",
          "dcdn:EnableCustomScenePolicy",
          "dcdn:EnableDcdnRDAccess",
          "dcdn:GetAuthorizationToken",
          "dcdn:GetDcdnKv",
          "dcdn:GetDcdnKvDetail",
          "dcdn:GetDcdnKvStatus",
          "dcdn:ListBackOriginMapping",
          "dcdn:ListBackOriginSource",
          "dcdn:ListDcdnEsTemplateInfo",
          "dcdn:ListDcdnIpaTagResources",
          "dcdn:ListDcdnKv",
          "dcdn:ModifyCustomScenePolicy",
          "dcdn:ModifyDcdnConfigTemplate",
          "dcdn:ModifyDcdnDescriptionOfVersion",
          "dcdn:ModifyDcdnDomainOwner",
          "dcdn:ModifyDcdnService",
          "dcdn:ModifyDcdnWafGroup",
          "dcdn:ModifyDcdnWafList",
          "dcdn:ModifyDcdnWafPolicy",
          "dcdn:ModifyDcdnWafPolicyDomains",
          "dcdn:ModifyDcdnWafRule",
          "dcdn:OpenDcdnService",
          "dcdn:PublishAppVersion",
          "dcdn:PublishRoutineCodeRevision",
          "dcdn:PutDcdnKv",
          "dcdn:PutDcdnKvAccount",
          "dcdn:PutDcdnKvNamespace",
          "dcdn:PutDcdnKvWithHighCapacity",
          "dcdn:RemoveBackOriginSource",
          "dcdn:RollbackAppVersion",
          "dcdn:SetDcdnBlockIP",
          "dcdn:SetDcdnConfigOfVersion",
          "dcdn:SetDcdnDomainRouteTunnelConfig",
          "dcdn:SetDcdnFullDomainsBlockIP",
          "dcdn:SetDcdnUserConfig",
          "dcdn:SetDdosSpecialPort",
          "dcdn:SetIntelligentCCCfg",
          "dcdn:SetL7GlobalCfg",
          "dcdn:SetRoutineSubdomain",
          "dcdn:TagDcdnIpaResources",
          "dcdn:UnDeployAppVersion",
          "dcdn:UntagDcdnIpaResources",
          "dcdn:UpdateAppConfig",
          "dcdn:UpdateAppHealthCheck",
          "dcdn:UpdateBackOriginNameServer",
          "dcdn:UpdateDcdnUserRealTimeDeliveryField",
          "dcdn:UploadRoutineCode",
          "dcdn:UploadStagingRoutineCode",
          "dcdn:UploadWasmCode",
          "dcdn:VerifyDcdnDomainOwner"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問