許可情報 - Cloud Firewall - Alibaba Cloud ドキュメントセンター

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by CloudFirewall. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate CloudFirewall is yundun-cloudfirewall. You can grant permissions on CloudFirewall at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

CloudFirewall defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- For mandatory resource types, indicate with a prefix of * .
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
yundun-cloudfirewall:AddAddressBook	AddAddressBook	create	AddressBook `acs:yundun-cloudfirewall::{#accountId}:addressbook/`	None	None
yundun-cloudfirewall:AddControlPolicy	AddControlPolicy	create	ControlPolicy `acs:cloudfirewall::{#accountId}:controlpolicy/`	None	None
yundun-cloudfirewall:AddInstanceMembers	AddInstanceMembers	create	InstanceMember `acs:yundun-cloudfirewall::{#accountId}:instancemember/`	None	None
yundun-cloudfirewall:BatchCopyVpcFirewallControlPolicy	BatchCopyVpcFirewallControlPolicy	update	VpcFirewallControlPolicy `acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/`	None	None
yundun-cloudfirewall:BatchDeleteVpcFirewallControlPolicy	BatchDeleteVpcFirewallControlPolicy	none	All Resources ``	None	None
yundun-cloudfirewall:CreateDownloadTask	CreateDownloadTask	create	All Resources ``	None	None
yundun-cloudfirewall:CreateNatFirewallControlPolicy	CreateNatFirewallControlPolicy	create	NatFirewallControlPolicy `acs:yundun-cloudfirewall::{#accountId}:natfirewallcontrolpolicy/`	None	None
yundun-cloudfirewall:CreateSecurityProxy	CreateSecurityProxy	get	All Resources ``	None	None
yundun-cloudfirewall:CreateSlsLogDispatch	CreateSlsLogDispatch	create	All Resources ``	None	None
yundun-cloudfirewall:CreateTrFirewallV2	CreateTrFirewallV2	create	VpcCenTrFirewall `acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/`	None	None
yundun-cloudfirewall:CreateTrFirewallV2RoutePolicy	CreateTrFirewallV2RoutePolicy	create	All Resources ``	None	None
yundun-cloudfirewall:CreateVpcFirewallCenConfigure	CreateVpcFirewallCenConfigure	create	VpcFirewallCen `acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcen/`	None	None
yundun-cloudfirewall:CreateVpcFirewallConfigure	CreateVpcFirewallConfigure	create	All Resources ``	None	None
yundun-cloudfirewall:CreateVpcFirewallControlPolicy	CreateVpcFirewallControlPolicy	create	VpcFirewallControlPolicy `acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/`	None	None
yundun-cloudfirewall:DeleteAddressBook	DeleteAddressBook	delete	*AddressBook `acs:cloudfirewall::{#accountId}:addressbook/{#GroupUuid}`	None	None
yundun-cloudfirewall:DeleteControlPolicy	DeleteControlPolicy	delete	*ControlPolicy `acs:yundun-cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:DeleteControlPolicyTemplate	DeleteControlPolicyTemplate	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteDownloadTask	DeleteDownloadTask	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteFirewallV2RoutePolicies	DeleteFirewallV2RoutePolicies	delete	*VpcCenTrFirewallPolicy `acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/{#FirewallId}/{#TrFirewallRoutePolicyId}`	None	None
yundun-cloudfirewall:DeleteInstanceMembers	DeleteInstanceMembers	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteNatFirewallControlPolicy	DeleteNatFirewallControlPolicy	delete	*NatFirewallControlPolicy `acs:cloudfirewall::{#accountId}:natfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:DeleteNatFirewallControlPolicyBatch	DeleteNatFirewallControlPolicyBatch	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteSecurityProxy	DeleteSecurityProxy	get	*NatFirewall `acs:cloudfirewall::{#accountId}:natfirewall/{#ProxyId}`	None	None
yundun-cloudfirewall:DeleteTrFirewallV2	DeleteTrFirewallV2	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteVpcFirewallCenConfigure	DeleteVpcFirewallCenConfigure	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteVpcFirewallConfigure	DeleteVpcFirewallConfigure	delete	All Resources ``	None	None
yundun-cloudfirewall:DeleteVpcFirewallControlPolicy	DeleteVpcFirewallControlPolicy	delete	*VpcFirewallControlPolicy `acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:DescribeACLProtectTrend	DescribeACLProtectTrend	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeAddressBook	DescribeAddressBook	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeAssetList	DescribeAssetList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeAssetRiskList	DescribeAssetRiskList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeAssetStatistic	DescribeAssetStatistic	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeCfwRiskLevelSummary	DescribeCfwRiskLevelSummary	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeControlPolicy	DescribeControlPolicy	get	ControlPolicyOrder `acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}/controlpolicyorder/{#Direction}` ControlPolicy `acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:DescribeDefaultIPSConfig	DescribeDefaultIPSConfig	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeDomainResolve	DescribeDomainResolve	get	*Domain `acs:yundun-cloudfirewall::{#accountId}:domain/{#Domain}`	None	None
yundun-cloudfirewall:DescribeDownloadTask	DescribeDownloadTask	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeDownloadTaskType	DescribeDownloadTaskType	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeInstanceMembers	DescribeInstanceMembers	get	*InstanceMember `acs:cloudfirewall::{#accountId}:instancemember/{#MemberUid}`	None	None
yundun-cloudfirewall:DescribeInstanceRiskLevels	DescribeInstanceRiskLevels	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeInternetOpenIp	DescribeInternetOpenIp	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeInternetTrafficTrend	DescribeInternetTrafficTrend	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeInvadeEventList	DescribeInvadeEventList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeLogStoreInfo	DescribeLogStoreInfo	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeNatAclPageStatus	DescribeNatAclPageStatus	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeNatFirewallControlPolicy	DescribeNatFirewallControlPolicy	list	*NatFirewallControlPolicy `acs:cloudfirewall::{#accountId}:natfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:DescribeNatFirewallList	DescribeNatFirewallList	get	*NatFirewall `acs:cloudfirewall::{#accountId}:natfirewall/{#ProxyId}`	None	None
yundun-cloudfirewall:DescribeNatFirewallPolicyPriorUsed	DescribeNatFirewallPolicyPriorUsed	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeNatFirewallTrafficTrend	DescribeNatFirewallTrafficTrend	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeOutgoingDestinationIP	DescribeOutgoingDestinationIP	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeOutgoingDomain	DescribeOutgoingDomain	get	All Resources ``	None	None
yundun-cloudfirewall:DescribePolicyAdvancedConfig	DescribePolicyAdvancedConfig	list	*PolicyAdvancedConfig `acs:yundun-cloudfirewall::{#accountId}:policyadvancedconfig`	None	None
yundun-cloudfirewall:DescribePolicyPriorUsed	DescribePolicyPriorUsed	list	All Resources ``	None	None
yundun-cloudfirewall:DescribePostpayTrafficDetail	DescribePostpayTrafficDetail	get	All Resources ``	None	None
yundun-cloudfirewall:DescribePostpayTrafficTotal	DescribePostpayTrafficTotal	get	All Resources ``	None	None
yundun-cloudfirewall:DescribePrefixLists	DescribePrefixLists	list	All Resources ``	None	None
yundun-cloudfirewall:DescribeRiskEventGroup	DescribeRiskEventGroup	list	All Resources ``	None	None
yundun-cloudfirewall:DescribeRiskEventPayload	DescribeRiskEventPayload	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeSignatureLibVersion	DescribeSignatureLibVersion	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeTrFirewallPolicyBackUpAssociationList	DescribeTrFirewallPolicyBackUpAssociationList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeTrFirewallV2RoutePolicyList	DescribeTrFirewallV2RoutePolicyList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeTrFirewallsV2Detail	DescribeTrFirewallsV2Detail	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeTrFirewallsV2List	DescribeTrFirewallsV2List	get	*VpcCenTrFirewall `acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/{#FirewallId}`	None	None
yundun-cloudfirewall:DescribeTrFirewallsV2RouteList	DescribeTrFirewallsV2RouteList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeUserAssetIPTrafficInfo	DescribeUserAssetIPTrafficInfo	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeUserBuyVersion	DescribeUserBuyVersion	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeVpcFirewallAclGroupList	DescribeVpcFirewallAclGroupList	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeVpcFirewallCenDetail	DescribeVpcFirewallCenDetail	get	*VpcFirewallCen `acs:cloudfirewall::{#accountId}:vpcfirewallcen/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcFirewallCenList	DescribeVpcFirewallCenList	get	*VpcFirewallCen `acs:cloudfirewall::{#accountId}:vpcfirewallcen/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcFirewallControlPolicy	DescribeVpcFirewallControlPolicy	get	VpcFirewallControlPolicy `acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}` VpcFirewall `acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcFirewallDefaultIPSConfig	DescribeVpcFirewallDefaultIPSConfig	get	*VpcFirewallIpsConfig `acs:cloudfirewall::{#accountId}:vpcfirewallipsconfig/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcFirewallDetail	DescribeVpcFirewallDetail	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeVpcFirewallIPSWhitelist	DescribeVpcFirewallIPSWhitelist	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeVpcFirewallList	DescribeVpcFirewallList	get	*VpcFirewall `acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcFirewallPolicyPriorUsed	DescribeVpcFirewallPolicyPriorUsed	get	*VpcFirewall `acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:DescribeVpcListLite	DescribeVpcListLite	get	All Resources ``	None	None
yundun-cloudfirewall:DescribeVpcZone	DescribeVpcZone	list	All Resources ``	None	None
yundun-cloudfirewall:DescribeVulnerabilityProtectedList	DescribeVulnerabilityProtectedList	get	All Resources ``	None	None
yundun-cloudfirewall:ModifyAddressBook	ModifyAddressBook	update	*AddressBook `acs:yundun-cloudfirewall::{#accountId}:addressbook/{#GroupUuid}`	None	None
yundun-cloudfirewall:ModifyControlPolicy	ModifyControlPolicy	update	*ControlPolicy `acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:ModifyControlPolicyPosition	ModifyControlPolicyPosition	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyDefaultIPSConfig	ModifyDefaultIPSConfig	get	All Resources ``	None	None
yundun-cloudfirewall:ModifyFirewallV2RoutePolicySwitch	ModifyFirewallV2RoutePolicySwitch	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyInstanceMemberAttributes	ModifyInstanceMemberAttributes	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyNatFirewallControlPolicy	ModifyNatFirewallControlPolicy	update	*NatFirewallControlPolicy `acs:cloudfirewall::{#accountId}:natfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:ModifyNatFirewallControlPolicyPosition	ModifyNatFirewallControlPolicyPosition	update	*NatFirewallControlPolicy `acs:cloudfirewall::{#accountId}:natfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:ModifyObjectGroupOperation	ModifyObjectGroupOperation	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyPolicyAdvancedConfig	ModifyPolicyAdvancedConfig	update	*PolicyAdvancedConfig `acs:yundun-cloudfirewall::{#accountId}:policyadvancedconfig`	None	None
yundun-cloudfirewall:ModifyTrFirewallV2Configuration	ModifyTrFirewallV2Configuration	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyTrFirewallV2RoutePolicyScope	ModifyTrFirewallV2RoutePolicyScope	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyVpcFirewallCenConfigure	ModifyVpcFirewallCenConfigure	update	*VpcFirewallCen `acs:cloudfirewall::{#accountId}:vpcfirewallcen/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:ModifyVpcFirewallCenSwitchStatus	ModifyVpcFirewallCenSwitchStatus	update	*VpcFirewallCen `acs:cloudfirewall::{#accountId}:vpcfirewallcen/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:ModifyVpcFirewallConfigure	ModifyVpcFirewallConfigure	update	*VpcFirewall `acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:ModifyVpcFirewallControlPolicy	ModifyVpcFirewallControlPolicy	update	*VpcFirewallControlPolicy `acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:ModifyVpcFirewallControlPolicyPosition	ModifyVpcFirewallControlPolicyPosition	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyVpcFirewallDefaultIPSConfig	ModifyVpcFirewallDefaultIPSConfig	update	*VpcFirewallIpsConfig `acs:cloudfirewall::{#accountId}:vpcfirewallipsconfig/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:ModifyVpcFirewallIPSWhitelist	ModifyVpcFirewallIPSWhitelist	update	All Resources ``	None	None
yundun-cloudfirewall:ModifyVpcFirewallSwitchStatus	ModifyVpcFirewallSwitchStatus	update	*VpcFirewall `acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}`	None	None
yundun-cloudfirewall:PutDisableAllFwSwitch	PutDisableAllFwSwitch	update	All Resources ``	None	None
yundun-cloudfirewall:PutDisableFwSwitch	PutDisableFwSwitch	update	All Resources ``	None	None
yundun-cloudfirewall:PutEnableAllFwSwitch	PutEnableAllFwSwitch	update	All Resources ``	None	None
yundun-cloudfirewall:PutEnableFwSwitch	PutEnableFwSwitch	update	All Resources ``	None	None
yundun-cloudfirewall:ReleasePostInstance	ReleasePostInstance	delete	All Resources ``	None	None
yundun-cloudfirewall:ResetNatFirewallRuleHitCount	ResetNatFirewallRuleHitCount	update	All Resources ``	None	None
yundun-cloudfirewall:ResetVpcFirewallRuleHitCount	ResetVpcFirewallRuleHitCount	update	*VpcFirewallControlPolicy `acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}`	None	None
yundun-cloudfirewall:SwitchSecurityProxy	SwitchSecurityProxy	none	All Resources ``	None	None

Resource

CloudFirewall defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
AddressBook	acs:cloudfirewall::{#accountId}:addressbook/{#GroupUuid} acs:yundun-cloudfirewall::{#accountId}:addressbook/{#GroupUuid} acs:yundun-cloudfirewall::{#accountId}:addressbook/*
Asset	acs:yundun-cloudfirewall::{#accountId}:asset/{#InternetAddress}
ControlPolicy	acs:cloudfirewall::{#accountId}:controlpolicy/* acs:yundun-cloudfirewall::{#accountId}:controlpolicy/{#AclUuid} acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}
ControlPolicyOrder	acs:cloudfirewall::{#accountId}:controlpolicy/{#AclUuid}/controlpolicyorder/{#Direction}
DnsFirewallPolicy	acs:yundun-cloudfirewall::{#accountId}:dnsfirewallpolicy/{#AclUuid} acs:yundun-cloudfirewall::{#accountId}:dnsfirewallpolicy/*
Domain	acs:yundun-cloudfirewall::{#accountId}:domain/{#Domain}
Instance	acs:yundun-cloudfirewall::{#accountId}:instance/*
InstanceMember	acs:yundun-cloudfirewall::{#accountId}:instancemember/* acs:cloudfirewall::{#accountId}:instancemember/{#MemberUid}
NatFirewall	acs:cloudfirewall::{#accountId}:natfirewall/{#ProxyId}
NatFirewallControlPolicy	acs:yundun-cloudfirewall::{#accountId}:natfirewallcontrolpolicy/* acs:cloudfirewall::{#accountId}:natfirewallcontrolpolicy/{#AclUuid}
PolicyAdvancedConfig	acs:yundun-cloudfirewall::{#accountId}:policyadvancedconfig
PrivateDNS	acs:cloudfirewall::{#accountId}:privatedns/{#AccessInstanceId} acs:yundun-cloudfirewall::{#accountId}:privatedns/${AccessInstanceId} acs:yundun-cloudfirewall::{#accountId}:privatedns/*
VpcCenTrFirewall	acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/* acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/{#FirewallId}
VpcCenTrFirewallPolicy	acs:yundun-cloudfirewall::{#accountId}:vpccentrfirewall/{#FirewallId}/{#TrFirewallRoutePolicyId}
VpcFirewall	acs:cloudfirewall::{#accountId}:vpcfirewall/{#VpcFirewallId}
VpcFirewallCen	acs:cloudfirewall::{#accountId}:vpcfirewallcen/{#VpcFirewallId} acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcen/*
VpcFirewallControlPolicy	acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/* acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid} acs:cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/* acs:yundun-cloudfirewall::{#accountId}:vpcfirewallcontrolpolicy/{#AclUuid}
VpcFirewallIpsConfig	acs:cloudfirewall::{#accountId}:vpcfirewallipsconfig/{#VpcFirewallId}

Condition

CloudFirewall does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: