ALIYUN::KMS::Policy - Resource Orchestration Service: Central de Documentação do Alibaba Cloud

Sintaxe

{
  "Type": "ALIYUN::KMS::Policy",
  "Properties": {
    "AccessControlRules": Map,
    "KmsInstanceId": String,
    "PolicyName": String,
    "Permissions": List,
    "Resources": List,
    "Description": String
  }
}

Propriedades

Propriedade	Tipo	Obrigatório	Editável	Descrição	Restrição
AccessControlRules	Map	Sim	Sim	Nomes das regras de acesso à rede.	Para mais informações, consulte Propriedade AccessControlRules.
KmsInstanceId	String	Sim	Não	Escopo da política de permissão.	Especifique a instância do Key Management Service (KMS) a ser acessada.
PolicyName	String	Sim	Não	Nome da política de permissão.	Nenhuma.
Permissions	List	Sim	Sim	Operações compatíveis com a política de permissão.	Valores válidos: RbacPermission/Template/CryptoServiceKeyUser: operações criptográficas em instâncias KMS RbacPermission/Template/CryptoServiceSecretUser: operações relacionadas a segredos em instâncias KMS Ambos os valores podem ser especificados.
Resources	List	Sim	Sim	Chaves e segredos com acesso permitido pela política.	Formatos de valor: Chave: especifique uma chave no formato `key/${KeyId}`. Para permitir acesso a todas as chaves de uma instância KMS, use key/. Segredo: especifique um segredo no formato `secret/${SecretName}`. Para permitir acesso a todos os segredos de uma instância KMS, use secret/.
Description	String	Não	Sim	Descrição.	Nenhuma.

Sintaxe de AccessControlRules

"AccessControlRules": {
  "NetworkRules": List
}

Propriedade AccessControlRules

Propriedade	Tipo	Obrigatório	Editável	Descrição	Restrição
NetworkRules	List	Sim	Sim	Nomes das regras de acesso à rede.	Limite de 40 nomes.

Valores de retorno

Fn::GetAtt

Description: a descrição.
AccessControlRules: os nomes das regras de controle de rede.
PolicyName: o nome da política de permissão.
Permissions: as operações compatíveis com a política de permissão.
KmsInstanceId: o escopo da política de permissão.
Resources: as chaves e os segredos com acesso permitido.

Exemplos

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  AccessControlRules:
    AssociationPropertyMetadata:
      Parameters:
        NetworkRules:
          AssociationPropertyMetadata:
            Parameter:
              Type: String
              Description:
                en: The name of the access control rule.
              Required: true
          AssociationProperty: List[Parameter]
          Type: Json
          Description:
            en: NetworkRule list, Supports a maximum of 40 network control rules.
          Required: true
          MinLength: 1
          MaxLength: 40
    Type: Json
    Description:
      en: Network Rules info.
    Required: true
  PolicyName:
    Type: String
    Description:
      en: The name of the permission policy.
    Required: true
  Permissions:
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        AllowedValues:
          - RbacPermission/Template/CryptoServiceKeyUser
          - RbacPermission/Template/CryptoServiceSecretUser
        Required: true
    AssociationProperty: List[Parameter]
    Type: Json
    Description:
      en: |-
        The operations that can be performed. Valid values:
        RbacPermission/Template/CryptoServiceKeyUser: allows you to perform cryptographic operations.
        RbacPermission/Template/CryptoServiceSecretUser: allows you to perform secret-related operations.
    Required: true
    MinLength: 1
    MaxLength: 2
  KmsInstanceId:
    Type: String
    Description:
      en: The scope of the permission policy. You need to specify the KMS instance that you want to access.
    Required: true
  Resources:
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: true
    AssociationProperty: List[Parameter]
    Type: Json
    Description:
      en: |-
        The key and secret that are allowed to access. Supports a maximum of 30 key and secret.
        Key: Enter a key in the key/${KeyId} format. To allow access to all keys of a KMS instance, enter key/*. 
        Secret: Enter a secret in the secret/${SecretName} format. To allow access to all secrets of a KMS instance, enter secret/*.
    Required: true
    MinLength: 1
    MaxLength: 30
Resources:
  ExtensionResource:
    Type: ALIYUN::KMS::Policy
    Properties:
      AccessControlRules:
        Ref: AccessControlRules
      PolicyName:
        Ref: PolicyName
      Permissions:
        Ref: Permissions
      KmsInstanceId:
        Ref: KmsInstanceId
      Resources:
        Ref: Resources
Outputs:
  Description:
    Description: Description.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - Description
  AccessControlRules:
    Description: Network Rules info.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - AccessControlRules
  PolicyName:
    Description: The name of the permission policy.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - PolicyName
  Permissions:
    Description: RbacPermission Template, support RbacPermission/Template/CryptoServiceKeyUser and RbacPermission/Template/CryptoServiceSecretUser.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - Permissions
  KmsInstanceId:
    Description: The scope of the permission policy. You need to specify the KMS instance that you want to access.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - KmsInstanceId
  Resources:
    Description: Resources that allowed access by this policy.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - Resources

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "AccessControlRules": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "NetworkRules": {
            "AssociationPropertyMetadata": {
              "Parameter": {
                "Type": "String",
                "Description": {
                  "en": "The name of the access control rule."
                },
                "Required": true
              }
            },
            "AssociationProperty": "List[Parameter]",
            "Type": "Json",
            "Description": {
              "en": "NetworkRule list, Supports a maximum of 40 network control rules."
            },
            "Required": true,
            "MinLength": 1,
            "MaxLength": 40
          }
        }
      },
      "Type": "Json",
      "Description": {
        "en": "Network Rules info."
      },
      "Required": true
    },
    "PolicyName": {
      "Type": "String",
      "Description": {
        "en": "The name of the permission policy."
      },
      "Required": true
    },
    "Permissions": {
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "AllowedValues": [
            "RbacPermission/Template/CryptoServiceKeyUser",
            "RbacPermission/Template/CryptoServiceSecretUser"
          ],
          "Required": true
        }
      },
      "AssociationProperty": "List[Parameter]",
      "Type": "Json",
      "Description": {
        "en": "The operations that can be performed. Valid values:\nRbacPermission/Template/CryptoServiceKeyUser: allows you to perform cryptographic operations.\nRbacPermission/Template/CryptoServiceSecretUser: allows you to perform secret-related operations."
      },
      "Required": true,
      "MinLength": 1,
      "MaxLength": 2
    },
    "KmsInstanceId": {
      "Type": "String",
      "Description": {
        "en": "The scope of the permission policy. You need to specify the KMS instance that you want to access."
      },
      "Required": true
    },
    "Resources": {
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": true
        }
      },
      "AssociationProperty": "List[Parameter]",
      "Type": "Json",
      "Description": {
        "en": "The key and secret that are allowed to access. Supports a maximum of 30 key and secret.\nKey: Enter a key in the key/${KeyId} format. To allow access to all keys of a KMS instance, enter key/*. \nSecret: Enter a secret in the secret/${SecretName} format. To allow access to all secrets of a KMS instance, enter secret/*."
      },
      "Required": true,
      "MinLength": 1,
      "MaxLength": 30
    }
  },
  "Resources": {
    "ExtensionResource": {
      "Type": "ALIYUN::KMS::Policy",
      "Properties": {
        "AccessControlRules": {
          "Ref": "AccessControlRules"
        },
        "PolicyName": {
          "Ref": "PolicyName"
        },
        "Permissions": {
          "Ref": "Permissions"
        },
        "KmsInstanceId": {
          "Ref": "KmsInstanceId"
        },
        "Resources": {
          "Ref": "Resources"
        }
      }
    }
  },
  "Outputs": {
    "Description": {
      "Description": "Description.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "Description"
        ]
      }
    },
    "AccessControlRules": {
      "Description": "Network Rules info.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "AccessControlRules"
        ]
      }
    },
    "PolicyName": {
      "Description": "The name of the permission policy.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "PolicyName"
        ]
      }
    },
    "Permissions": {
      "Description": "RbacPermission Template, support RbacPermission/Template/CryptoServiceKeyUser and RbacPermission/Template/CryptoServiceSecretUser.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "Permissions"
        ]
      }
    },
    "KmsInstanceId": {
      "Description": "The scope of the permission policy. You need to specify the KMS instance that you want to access.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "KmsInstanceId"
        ]
      }
    },
    "Resources": {
      "Description": "Resources that allowed access by this policy.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "Resources"
        ]
      }
    }
  }
}