授权策略示例

授权策略示例

示例1: 在Allow授权中增加Action限制只允许对CodePipeline服务下的ram-demo项目进行 配置 操作。AliyunCodePipelineConfigJobAccess:

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:ConfigJob",
          "Resource": "acs:codepipeline:*:*:demo-ram"
        }
      ]
    }

示例2: 在Allow授权中增加Action限制只允许对CodePipeline服务下的ram-demo项目进行 构建 操作。AliyunCodePipelineBuildJobAccess:

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:BuildJob",
          "Resource": "acs:codepipeline:*:*:demo-ram"
        }
      ]
    }

示例3: 在Allow授权中增加Action限制只允许对CodePipeline服务下的ram-demo项目进行 删除 操作。AliyunCodePipelineDeleteJobAccess:

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:DeleteJob",
          "Resource": "acs:codepipeline:*:*:demo-ram",
        }
      ]
    }

示例4: 在Allow授权中增加Action限制只允许在CodePipeline服务下进行 创建 项目操作。CodePipeline默认设置具有 创建 操作权限的用户也将拥有对项目的所有其他权限。AliyunCodePipelineFullJobAccess:

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:FullJob",
          "Resource": "acs:codepipeline:*:*:*"
        }
      ]
    }

示例5: 在Allow授权中增加Action限制只允许在CodePipeline服务下进行 创建 用户证书操作。AliyunCodePipelineCreateCredentialAccess :

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:CreateCredential",
          "Resource": "acs:codepipeline:*:*:*"
        }
      ]
    }

示例6: 在Allow授权中增加Action限制只允许在CodePipeline服务下对id为java-demo的用户证书进行 更新 操作。AliyunCodePipelineUpdateCredentialAccess :

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:UpdateCredential",
          "Resource": "acs:codepipeline:*:*:java-demo"
        }
      ]
    }

示例7: 在Allow授权中增加Action限制只允许在CodePipeline服务下对id为java-demo的用户证书进行 删除 操作。AliyunCodePipelineDeleteCredentialAccess :

    {
      "Version": "1",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "codepipeline:DeleteCredential",
          "Resource": "acs:codepipeline:*:*:java-demo"
        }
      ]
    }

示例8: 在Allow授权中增加IP限制允许通过 42.120.88.0/24, 42.120.66.0/24 两个IP段访问CodePipeline服务。

    {    
        "Statement": [    
        　　{    
                "Action": "codepipeline:*",    
                "Effect": "Allow",    
                "Resource": "acs:codepipeline:*:*:*"     
        　　}    
    　　],    
    　　"Version": "1",    
        "Condition":{    
            "IpAddress": {    
                "acs:SourceIp": ["42.120.88.0/24", "42.120.66.0/24"]    
            }    
        }    
    }

示例9: 在Allow授权中增加时间限制允许在 2018-12-11T17:00:00+08:00 前可以访问CodePipeline服务。

    {    
            "Statement": [    
            　　{    
                    "Action": "codepipeline:*",    
                    "Effect": "Allow",    
                    "Resource": "acs:codepipeline:*:*:*"     
            　　}    
        　　],    
        　　"Version": "1",    
            "Condition":{    
                "DateLessThan": {    
                    "acs:CurrentTime": "2018-12-11T17:00:00+08:00"
                }    
            }    
        }

示例10: 在Allow授权中增加条件限制允许正在使用HTTPS访问控制台的用户可以访问CodePipeline服务。

    {    
                "Statement": [    
                　　{    
                        "Action": "codepipeline:*",    
                        "Effect": "Allow",    
                        "Resource": "acs:codepipeline:*:*:*"     
                　　}    
            　　],    
           　　"Version": "1",    
                "Condition":{    
                    "Bool": {    
                        "acs:SecureTransport": "true"
                   }    
                }    
            }

示例11: 在Allow授权中增加条件限制允许启用MFA并使用MFA登录的用户可以访问CodePipeline服务。

    {    
                    "Statement": [    
                    　　{    
                            "Action": "codepipeline:*",    
                            "Effect": "Allow",    
                            "Resource": "acs:codepipeline:*:*:*"
                    　　}    
                　　],    
               　　"Version": "1",    
                    "Condition":{    
                        "Bool": {    
                            "acs:MFAPresent": "true"
                       }    
                    }    
                }