版本：3.9.x

权限策略的操作与资源

本参考文档列出了 API7 Gateway 权限策略中可能出现的所有操作和资源 ARN。编写策略时请以此为准：此处列出的每项操作均由控制面强制执行，每个资源 ARN 均采用策略引擎接受的确切格式。

权限分为三个命名空间：

命名空间	用途
`gateway:`	数据面配置，包括网关组、服务、路由、消费者、插件、证书和告警
`iam:`	身份和组织，包括用户、角色、权限策略、许可证、审计日志、登录选项、SMTP 和联系人
`portal:`	开发者门户，包括门户、API 产品、开发者、DCR 提供方和门户 Token

通配符表示为 *（资源路径中的字面通配符）或 <regex>（用尖括号括起来、在匹配时应用的正则表达式）。例如，arn:api7:gateway:gatewaygroup/<.*> 匹配所有网关组，而 arn:api7:gateway:gatewaygroup/* 用于尚无特定目标的创建语句。

gateway: 命名空间

网关组

操作	资源
`gateway:GetGatewayGroup`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateGatewayGroup`	`arn:api7:gateway:gatewaygroup/*`
`gateway:UpdateGatewayGroup`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteGatewayGroup`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:GetAdminKey`	`arn:api7:gateway:gatewaygroup/%s`

网关实例

操作	资源
`gateway:GetGatewayInstance`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:GetGatewayInstanceCore`	`arn:api7:gateway:gatewaygroup/*`
`gateway:CreateGatewayInstance`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteGatewayInstance`	`arn:api7:gateway:gatewaygroup/%s`

消费者

操作	资源
`gateway:GetConsumer`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`
`gateway:CreateConsumer`	`arn:api7:gateway:gatewaygroup/%s/consumer/*`
`gateway:UpdateConsumer`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`
`gateway:DeleteConsumer`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`

消费者凭证

操作	资源
`gateway:GetConsumerCredential`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`
`gateway:CreateConsumerCredential`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`
`gateway:UpdateConsumerCredential`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`
`gateway:DeleteConsumerCredential`	`arn:api7:gateway:gatewaygroup/%s/consumer/%s`

SSL 证书

操作	资源
`gateway:GetSSLCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateSSLCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateSSLCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteSSLCertificate`	`arn:api7:gateway:gatewaygroup/%s`

证书

操作	资源
`gateway:GetCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateCertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteCertificate`	`arn:api7:gateway:gatewaygroup/%s`

CA 证书

操作	资源
`gateway:GetCACertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateCACertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateCACertificate`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteCACertificate`	`arn:api7:gateway:gatewaygroup/%s`

SNI

操作	资源
`gateway:GetSNI`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateSNI`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateSNI`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteSNI`	`arn:api7:gateway:gatewaygroup/%s`

全局插件规则

操作	资源
`gateway:GetGlobalPluginRule`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateGlobalPluginRule`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateGlobalPluginRule`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteGlobalPluginRule`	`arn:api7:gateway:gatewaygroup/%s`

插件元数据

操作	资源
`gateway:GetPluginMetadata`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdatePluginMetadata`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeletePluginMetadata`	`arn:api7:gateway:gatewaygroup/%s`

服务注册中心

操作	资源
`gateway:GetServiceRegistry`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:ConnectServiceRegistry`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateServiceRegistry`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DisconnectServiceRegistry`	`arn:api7:gateway:gatewaygroup/%s`

密钥提供方

操作	资源
`gateway:GetSecretProvider`	`arn:api7:gateway:gatewaygroup/%s/secret_provider/%s`
`gateway:PutSecretProvider`	`arn:api7:gateway:gatewaygroup/%s/secret_provider/%s`
`gateway:DeleteSecretProvider`	`arn:api7:gateway:gatewaygroup/%s/secret_provider/%s`

Proto

适用于 grpc-transcode 和 proto 插件所用的 gRPC 服务定义。

操作	资源
`gateway:GetProto`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateProto`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:UpdateProto`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteProto`	`arn:api7:gateway:gatewaygroup/%s`

调试会话

用于在线请求调试和链路捕获。

操作	资源
`gateway:GetDebugSession`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:CreateDebugSession`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:StopDebugSession`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:DeleteDebugSession`	`arn:api7:gateway:gatewaygroup/%s`
`gateway:ExportDebugSession`	`arn:api7:gateway:gatewaygroup/%s`

服务模板

服务模板定义可复用的服务配置，包括路由和流路由。关于服务模板 ID 与已发布服务 ID 的区别，以及如何在权限策略中使用两者，请参阅服务管理员示例。

操作	资源
`gateway:GetServiceTemplate`	`arn:api7:gateway:servicetemplate/%s`
`gateway:CreateServiceTemplate`	`arn:api7:gateway:servicetemplate/*`
`gateway:UpdateServiceTemplate`	`arn:api7:gateway:servicetemplate/%s`
`gateway:DeleteServiceTemplate`	`arn:api7:gateway:servicetemplate/%s`

已发布服务

已发布服务是部署到特定网关组的服务模板。相同的四项操作也涵盖该服务的路由和流路由。

操作	资源
`gateway:GetPublishedService`	`arn:api7:gateway:gatewaygroup/%s/publishedservice/%s`
`gateway:CreatePublishedService`	`arn:api7:gateway:gatewaygroup/%s/publishedservice/*`
`gateway:UpdatePublishedService`	`arn:api7:gateway:gatewaygroup/%s/publishedservice/%s`
`gateway:DeletePublishedService`	`arn:api7:gateway:gatewaygroup/%s/publishedservice/%s`
`gateway:PublishServices`	`arn:api7:gateway:gatewaygroup/%s/publishedservice/*`

部署设置

系统范围内的网关部署设置。

操作	资源
`gateway:UpdateDeploymentSetting`	`arn:api7:gateway:gatewaysetting/*`

自定义插件

操作	资源
`gateway:CreateCustomPlugin`	`arn:api7:gateway:gatewaysetting/*`
`gateway:UpdateCustomPlugin`	`arn:api7:gateway:gatewaysetting/*`
`gateway:DeleteCustomPlugin`	`arn:api7:gateway:gatewaysetting/*`

告警策略

操作	资源
`gateway:GetAlertPolicy`	`arn:api7:gateway:alert/%s`
`gateway:CreateAlertPolicy`	`arn:api7:gateway:alert/*`
`gateway:UpdateAlertPolicy`	`arn:api7:gateway:alert/%s`
`gateway:DeleteAlertPolicy`	`arn:api7:gateway:alert/%s`

Webhook 模板

告警联系人使用的可复用 Webhook 载荷模板。

操作	资源
`gateway:GetWebhookTemplate`	`arn:api7:gateway:gatewaysetting/*`
`gateway:CreateWebhookTemplate`	`arn:api7:gateway:gatewaysetting/*`
`gateway:UpdateWebhookTemplate`	`arn:api7:gateway:gatewaysetting/*`
`gateway:DeleteWebhookTemplate`	`arn:api7:gateway:gatewaysetting/*`

iam: 命名空间

用户

操作	资源
`iam:GetUser`	`arn:api7:iam:user/%s`
`iam:InviteUser`	`arn:api7:iam:user/*`
`iam:UpdateUser`	`arn:api7:iam:user/%s`
`iam:DeleteUser`	`arn:api7:iam:user/%s`
`iam:UpdateUserRole`	`arn:api7:iam:user/%s`
`iam:ResetPassword`	`arn:api7:iam:user/%s`
`iam:UpdateUserBoundary`	`arn:api7:iam:user/%s`

角色

操作	资源
`iam:GetRole`	`arn:api7:iam:role/%s`
`iam:CreateRole`	`arn:api7:iam:role/*`
`iam:UpdateRole`	`arn:api7:iam:role/%s`
`iam:DeleteRole`	`arn:api7:iam:role/%s`

权限策略

操作	资源
`iam:GetPermissionPolicy`	`arn:api7:iam:permissionpolicy/%s`
`iam:CreatePermissionPolicy`	`arn:api7:iam:permissionpolicy/*`
`iam:UpdatePermissionPolicy`	`arn:api7:iam:permissionpolicy/%s`
`iam:DeletePermissionPolicy`	`arn:api7:iam:permissionpolicy/%s`

许可证

操作	资源
`iam:UpdateLicense`	`arn:api7:iam:organization/*`

审计日志

操作	资源
`iam:GetAudit`	`arn:api7:iam:organization/*`
`iam:ExportAudits`	`arn:api7:iam:organization/*`

登录选项用于配置 Dashboard 的认证方式（OIDC、SAML、LDAP、CAS）。

操作	资源
`iam:GetLoginOption`	`arn:api7:iam:organization/*`
`iam:CreateLoginOption`	`arn:api7:iam:organization/*`
`iam:UpdateLoginOption`	`arn:api7:iam:organization/*`
`iam:DeleteLoginOption`	`arn:api7:iam:organization/*`

SCIM 预配

操作	资源
`iam:GetSCIMProvisioning`	`arn:api7:iam:organization/*`
`iam:UpdateSCIMProvisioning`	`arn:api7:iam:organization/*`

SMTP 服务器

用于发送电子邮件通知和用户邀请。

操作	资源
`iam:GetSMTPServer`	`arn:api7:iam:organization/*`
`iam:UpdateSMTPServer`	`arn:api7:iam:organization/*`

联系人

联系人是告警策略引用的告警通知目标（电子邮件、Webhook 等）。

操作	资源
`iam:GetContactPoint`	`arn:api7:iam:contactpoint/%s`
`iam:CreateContactPoint`	`arn:api7:iam:contactpoint/*`
`iam:UpdateContactPoint`	`arn:api7:iam:contactpoint/%s`
`iam:DeleteContactPoint`	`arn:api7:iam:contactpoint/%s`

portal: 命名空间

门户

操作	资源
`portal:GetPortal`	`arn:api7:portal:portal/%s`
`portal:CreatePortal`	`arn:api7:portal:portal/*`
`portal:UpdatePortal`	`arn:api7:portal:portal/%s`
`portal:DeletePortal`	`arn:api7:portal:portal/%s`

门户 Token

操作	资源
`portal:GetPortalToken`	`arn:api7:portal:portal/%s/token/*`
`portal:CreatePortalToken`	`arn:api7:portal:portal/%s/token/*`
`portal:UpdatePortalToken`	`arn:api7:portal:portal/%s/token/*`
`portal:DeletePortalToken`	`arn:api7:portal:portal/%s/token/*`

API 产品

操作	资源
`portal:GetAPIProduct`	`arn:api7:portal:portal/%s/apiproduct/%s`
`portal:CreateAPIProduct`	`arn:api7:portal:portal/%s/apiproduct/*`
`portal:UpdateAPIProduct`	`arn:api7:portal:portal/%s/apiproduct/%s`
`portal:DeleteAPIProduct`	`arn:api7:portal:portal/%s/apiproduct/%s`

开发者

操作	资源
`portal:GetDeveloper`	`arn:api7:portal:portal/%s/developer/%s`
`portal:InviteDeveloper`	`arn:api7:portal:portal/%s/developer/*`
`portal:DeleteDeveloper`	`arn:api7:portal:portal/%s/developer/%s`

DCR 提供方

开发者门户使用的动态客户端注册提供方。

操作	资源
`portal:GetDCRProvider`	`arn:api7:portal:dcrprovider/*`
`portal:CreateDCRProvider`	`arn:api7:portal:dcrprovider/*`
`portal:UpdateDCRProvider`	`arn:api7:portal:dcrprovider/*`
`portal:DeleteDCRProvider`	`arn:api7:portal:dcrprovider/*`

配置开发者可用于登录开发者门户的认证方式。

操作	资源
`portal:GetDeveloperLoginOption`	`arn:api7:portal:portal/%s/loginsetting/*`
`portal:CreateDeveloperLoginOption`	`arn:api7:portal:portal/%s/loginsetting/*`
`portal:UpdateDeveloperLoginOption`	`arn:api7:portal:portal/%s/loginsetting/*`
`portal:DeleteDeveloperLoginOption`	`arn:api7:portal:portal/%s/loginsetting/*`

开发者 SCIM 预配

操作	资源
`portal:GetDeveloperSCIMProvisioning`	`arn:api7:portal:portal/%s/loginsetting/*`
`portal:UpdateDeveloperSCIMProvisioning`	`arn:api7:portal:portal/%s/loginsetting/*`

开发者门户公开访问

控制开发者门户是否可在无需登录的情况下公开访问。

操作	资源
`portal:GetDeveloperPortalPublicAccess`	`arn:api7:portal:portal/%s/loginsetting/*`
`portal:UpdateDeveloperPortalPublicAccess`	`arn:api7:portal:portal/%s/loginsetting/*`

审批

审批待处理的 API 产品订阅或新开发者注册。

操作	资源
`portal:ApproveAPIProductSubscription`	`arn:api7:portal:portal/%s/apiproduct/%s`
`portal:ApproveDeveloperSignUp`	`arn:api7:portal:portal/%s/developer/*`

后续步骤

权限策略和权限边界 — 了解完整的 JSON 语法。
权限策略示例 — 可直接调整用于常见场景的策略示例。
基于角色的访问控制 — 了解角色、用户和策略如何协同工作。

gateway: 命名空间​

网关组​

网关实例​

消费者​

消费者凭证​

SSL 证书​

证书​

CA 证书​

SNI​

全局插件规则​

插件元数据​

服务注册中心​

密钥提供方​

Proto​

调试会话​

服务模板​

已发布服务​

部署设置​

自定义插件​

告警策略​

Webhook 模板​

iam: 命名空间​

用户​

角色​

权限策略​

许可证​

审计日志​

登录选项​

SCIM 预配​

SMTP 服务器​

联系人​

portal: 命名空间​

门户​

门户 Token​

API 产品​

开发者​

DCR 提供方​

开发者登录选项​

开发者 SCIM 预配​

开发者门户公开访问​

审批​

后续步骤​