Policy Authentication Evaluation Logic

Overview

Baidu AI Cloud IAM service seamlessly [integrates numerous cloud services](IAM/Product Description/Currently Supported Product Lines.md) and provides access control for their resources. When users access the cloud service, the cloud service converts access behaviors into authentication contexts and passes them to IAM. IAM then performs permission verification based on the user's permission policies to return success or failure.

IAM permission policy types include Service Control Policy (SCP) for enterprise organizations, resource-based policies, and identity-based policies. For details, refer to [Policy Type](IAM/Operation guide/Permission Policies/Strategy type.md). Whether a user has permission to access specific cloud resources or not depends on the comprehensive evaluation result of the user's permission policies. This document explains the evaluation logic of policy authentication.

Strategy evaluation logic

The policy evaluation logic of Baidu AI Cloud adheres to the following principles:

• By default, all requests are implicitly denied (only the root account possesses full permissions);
• Explicit allow in identity-based or resource-based policies overrides implicit deny
• The implicit deny of organization SCP overrides allow, meaning member accounts under an enterprise organization must be granted service permissions at both the organizational unit and individual levels
• Any display of deny in a policy will override allow;