tencent cloud

PrevNext

피드백

키워드를 검색하세요

Recent Pages

문서
Cloud Access Management
    문서
    Download PDF

    Policy Version Control

    마지막 업데이트 시간:2024-01-23 17:54:33
    PDF 다운로드

      Overview

      When a custom policy you configured is changed, the system will not overwrite it; instead, it will automatically create a new version. After saving the change, you can configure a default version out of different versions for rapid rollback to different policy versions.

      Granting Permission to Set Default Policy Version

      Root accounts and sub-accounts that have permissions to use the cam:ListPolicies, cam:GetPolicy, and cam:UpdatePolicy APIs can configure a default policy version. Root accounts can use the following policy syntax to grant sub-accounts permission to configure a default policy version:
      {
          "version": "2.0",
          "statement": [
              {
                  "effect": "allow",
                  "action": [
                      "name/cam:ListPolicies",
                      "name/cam:GetPolicy",
                      "name/cam:UpdatePolicy"
                  ],
                  "resource": [
                      "*"
                  ]
              }
          ]
      }

      Setting the default version of custom policy

      You can set one of the custom policy versions as the default version to make it the active version. After the configuration, all sub-accounts associated with this custom policy will receive the permissions set on the default version.
      1. Log in to the CAM console, and go to Policies.
      2. On the policy management page, click the name of the custom policy you want to configure to enter the policy details page.
      3. On the policy details page, select Policy Version.
      4. Locate the version you want to configure, check the box on the left, and click Save as Default.

      Rolling back Changes by Using Different Versions

      You can roll back your changes by setting the default version of the custom policy. For example, see the following scenario: You create a custom policy that allows sub-accounts to have read access to CVM instance ins-1. When you create the policy, there is only one version of the custom policy (tagged as "v1"). This version is automatically set as the default version, and this policy can work normally.
      You update this custom policy and add read permission to CVM instance ins-2. After the change is saved, the system will create a new policy version (tagged as "v2"). After v2 is set as the default version, sub-accounts feed back that they lack the original CVM management permission. In this case, you can roll back the current policy version to v1. You can set v1 as the default version and restore the sub-account's management permission for the original CVM instance.
      You find and correct an error in policy v2, and the system will create another new version of the policy (tagged as "v3"). You can set v3 as the default version to provide the sub-accounts with read permission to both CVM instances ins-1 and ins-2. You can delete the policy v2 which contains the error.

      Version Limits

      Each custom policy can have up to 5 versions. When the number of versions of a custom policy reaches 5, you must delete one or more current versions before you can edit and save a new version. You can delete existing policy versions in the pop-up dialog box in the following two ways:
      Delete the oldest non-default policy version.
      Select one or more policy versions to be deleted. You can click ▼ on the left to view the policy syntax of each version to make decisions more conveniently.
      
      Note:
      When a version is deleted, version IDs of the remaining versions will not change. Therefore, version IDs may be discontinuous. For example, if you delete the policy v2 and v4 and then add two new versions, the remaining version IDs may be v1, v3, v5, v6, and v7.
      문의하기

      고객의 업무에 전용 서비스를 제공해드립니다.

      문의하기
      기술 지원

      더 많은 도움이 필요하시면, 티켓을 통해 연락 바랍니다. 티켓 서비스는 연중무휴 24시간 제공됩니다.

      티켓 제출
      연중무휴 24시간 전화 지원
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      개인정보 처리방침서비스 약관쿠키 정책