Policy variables

JD Cloud IAM supports using variables as placeholders to implement generalization policies.

Location of policy variables

JD Cloud supports the use of policy variables in the Condition element.

Types of policy variables

Using variables as placeholders, policy variables are replaced with values from the request context when determining permissions. That is, the values populating the policy variables must come from the current request context. The following policy variable types are currently supported by the JD Cloud Condition element:

Scenarios for the use of policy variables

The policy variables work with the JD Cloud resource tag, mainly to achieve the function of authorization based on the creator tag (jdc-createdby). Example application scenario:

Create a policy that allows all Subusers under the master account 859150329790 to manage their own cloud virtual machines that they have created. Details of the policy are as follows:

json
{
	"Version": "3",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"vm:*"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"StringEquals": {
					"JDCloud:ResourceTag/jdc-createdby": [
						"${name}"
					]
				}
			}
		}
	]
}