Function Compute：權限原則及樣本

自訂建立和擷取服務以及建立和執行函數權限原則

{
	"Version": "1",
	"Statement": [{
			"Action": [
				"fc:CreateFunction",
				"fc:GetFunction",
				"fc:InvokeFunction"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"ram:PassRole"
			],
			"Effect": "Allow",
			"Resource": "*"
		}
	]
}

自訂訪問日誌權限原則

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:ListProject",
                "log:ListLogStore"
            ],
            "Resource": "acs:log:*:*:project/*"
        }
    ]
}

自訂訪問OSS觸發器權限原則

{
  "Statement": [
    {
      "Action": [
        "oss:ListBucket",
        "oss:GetBucketEventNotification",
        "oss:PutBucketEventNotification",
        "oss:DeleteBucketEventNotification"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}

自訂禁止建立支援訪問公網的服務權限原則

{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateFunction",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableServiceInternetAccess": "true"
        }
      }
    },
    {
      "Action": "fc:CreateFunction",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "fc:EnableServiceInternetAccess": "false"
        }
      }
    }
  ]
}

自訂禁止建立無法開啟日誌訪問的服務權限原則

{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateFunction",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableServiceSLSLogging": "false"
        }
      }
    },
    {
      "Action": "fc:CreateFunction",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "fc:EnableServiceSLSLogging": "true"
        }
      }
    }
  ]
}

自訂禁止建立支援公網訪問的觸發器權限原則

{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerInternet": "true"
        }
      }
    },
    {
      "Action": "fc:CreateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerInternet": "true"
        }
      }
    }
  ]
}

該權限原則會禁止使用者在CreateTrigger - 建立觸發器API和UpdateTrigger - 更新觸發器API中將 disableURLInternet 參數設定為false (表示支援預設公網網域名稱)，disableURLInternet只能設定為true，該限制僅適用於HTTP觸發器。關於HTTP觸發器資料結構，請參見HTTPTriggerConfig。

如果嘗試建立開啟disableURLInternet=false的觸發器，會出現 403 AccessDenied報錯，樣本如下：

{
  "statusCode":403,
  "Code":"AccessDenied",
  "Message":"the caller is not authorized to perform 'fc:CreateTrigger' on resource 'acs:fc:xx:xx:functions/xx/triggers/xx' with condition '[fc:EnableHTTPTriggerInternet=true]'"
}

自訂禁止建立匿名訪問的觸發器權限原則

{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:UpdateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerAnonymous": "true"
        }
      }
    },
    {
      "Action": "fc:CreateTrigger",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableHTTPTriggerAnonymous": "true"
        }
      }
    }
  ]
}

該權限原則會禁止使用者在API CreateTrigger - 建立觸發器和UpdateTrigger - 更新觸發器中將authType參數設定為anonymous（不需要認證），只允許設定為function（需要認證）。該限制僅適用於HTTP觸發器，更多資訊，請參見HTTPTriggerConfig。

如果嘗試建立開啟authType=anonymous的HTTP觸發器，會出現403 AccessDenied報錯。樣本如下：

{
  "statusCode":403,
  "Code":"AccessDenied",
  "Message":"the caller is not authorized to perform 'fc:CreateTrigger' on resource 'acs:fc:xx:xx:functions/xx/triggers/xx' with condition '[fc:EnableHTTPTriggerAnonymous=true]'"
}

自訂禁止建立支援HTTP協議訪問的自訂網域名的權限原則

{
  "Version": "1",
  "Statement": [
    {
      "Action": "fc:CreateCustomDomain",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableCustomDomainHTTP": "true"
        }
      }
    },
    {
      "Action": "fc:UpdateCustomDomain",
      "Effect": "Deny",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "fc:EnableCustomDomainHTTP": "true"
        }
      }
    }
  ]
}

該權限原則會禁止使用者在API CreateCustomDomain - 建立自訂網域名和UpdateCustomDomain - 更新自訂網域名中將protocol參數設定為 HTTP或 HTTP,HTTPS，只能設定為 HTTPS。

如果嘗試建立開啟HTTP協議的自訂網域名，會出現 403 AccessDenied 報錯，樣本如下：

{
  "statusCode":403,
  "Code":"AccessDenied",
  "Message":"the caller is not authorized to perform 'fc:CreateCustomDomain' on resource 'acs:fc:xxx:xxx:custom-domains/xxx' with condition '[fc:EnableCustomDomainHTTP=true]'"
}