Introduction to ACL Syntax

Background

Baidu AI Cloud supports the user role-based and resource-based permission verification. For the user's request, the accessControlList associated with the user role is obtained according to the request identity for authentication; ACL (Access Control List) associated with the resources is obtained according to the resource path of the user's request for authentication.

Glossary

Access Control List (ACL): A permission control list appended to a user role or resource. The user's permission control over the resource can be resource-based or user-based. The user can control the fine grain over the access to the service by setting ACL. ACL is a list, and consists of one or more entries.

User-based ACL: permission control list appended to the user. Add a user or group to a specific permission policy in which you specify the permission of such specified role on different resources. When the request arrives, traverse the permission description for authentication by the set of permission list appended to the user and the group where the user is located.

Resource-based ACL: permission control list appended to the resource. For specific level of resource (such as bucket-level of BOS), specify applicable policies while creating resources, and specify the permission to different users in the policy description. When the user requests the resource, the user obtains the permission policy associated with the resource, and transverse the permission description in the policies for authentication.

IAM ACL Syntax

IAM ACL uses the policy description language with JSON format for fine-grained access control based on user or resource. The CamelCase that the first letter is lowercase is used as the naming method.

Field overview

• Son field of Grantee:

• Son field of Condition:

Relationship between ACL and entry:

• Each resource has an independent ACL
• Each ACL consists of one or more entries

Relationship between entries:

• The entries are independent of each other
• The meaning of mutual independence means that: Each entry is independent of the other, and the entry logic judgment is irrelevant to the location in ACL

Synthesis example

{
    "id": "id or description",
    "accessControlList": [
        {
            "eid": "eid or description",
            "service": "bce:bos",
            "region": "bj",
            "effect": "Allow",
            "permission": [
                "CreateBucket",
                "READ"
            ],
            "resource": [
                "bucketname/objectname"
            ],
            "grantee": [
                {
                    "id": "accountid",
                    "user": "bob",
                    "saml-provider":"saml.xml"
                }
            ],
            "condition": {
                "ipAddress": [
                    "192.168.0.0/16",
                    "192.169.0.0/16"
                ],
                "time": {
                "in": [
                        {
                            "greaterThan":"2010-06-01T23:00:00Z",
                            "lessThan":"2010-07-01T23:00:00Z "
                        },
                        {
                            "greaterThan":"2010-08-01T23:00:00Z "
                        }
                    ] 
                },
                "referer": {
                    "stringEquals": [
                        "www.abc.com",
                        "www.example.com"
                    ],
                    "stringLike": [
                        "www.baidu.com/*"
                    ] 
                }
            }
        }
    ] 
}