本参考列出了 API7 网关权限策略中可以使用 的所有操作和资源 ARN。编写策略时应以本页为准：此处列出的每个操作都由控制面强制执行，每个资源 ARN 都遵循策略引擎接受的确切格式。
权限分为以下三个命名空间：
| 命名空间 | 用途 |
|---|
gateway: | 数据面配置，包括网关组、服务、路由、消费者、插件、证书和告警 |
iam: | 身份与组织管理，包括用户、角色、权限策略、许可证、审计日志、登录选项、SMTP 和通知渠道 |
portal: | 开发者门户，包括门户、API 产品、开发者、DCR 提供商和门户 Token |
通配符表示为 *（资源路径中的字面通配符）或 <regex>（用尖括号包围、在匹配时应用的正则表达式）。例如，arn:api7:gateway:gatewaygroup/<.*> 匹配所有网关组，而 arn:api7:gateway:gatewaygroup/* 用于尚未有特定目标的创建语句。
gateway: 命名空间
网关组
| 操作 | 资源 |
|---|
gateway:GetGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGatewayGroup | arn:api7:gateway:gatewaygroup/* |
gateway:UpdateGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayGroup | arn:api7:gateway:gatewaygroup/%s |
gateway:GetAdminKey | arn:api7:gateway:gatewaygroup/%s |
网关实例
| 操作 | 资源 |
|---|
gateway:GetGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:GetGatewayInstanceCore | arn:api7:gateway:gatewaygroup/* |
gateway:CreateGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGatewayInstance | arn:api7:gateway:gatewaygroup/%s |
Consumer
| 操作 | 资源 |
|---|
gateway:GetConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/* |
gateway:UpdateConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumer | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
消费者凭证
| 操作 | 资源 |
|---|
gateway:GetConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:CreateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:UpdateConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
gateway:DeleteConsumerCredential | arn:api7:gateway:gatewaygroup/%s/consumer/%s |
SSL 证书
| 操作 | 资源 |
|---|
gateway:GetSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSSLCertificate | arn:api7:gateway:gatewaygroup/%s |
| 操作 | 资源 |
|---|
gateway:GetCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCertificate | arn:api7:gateway:gatewaygroup/%s |
CA 证书
| 操作 | 资源 |
|---|
gateway:GetCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateCACertificate | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteCACertificate | arn:api7:gateway:gatewaygroup/%s |
SNI
| 操作 | 资源 |
|---|
gateway:GetSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateSNI | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteSNI | arn:api7:gateway:gatewaygroup/%s |
全局插件规则
| 操作 | 资源 |
|---|
gateway:GetGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteGlobalPluginRule | arn:api7:gateway:gatewaygroup/%s |
插件元数据
| 操作 | 资源 |
|---|
gateway:GetPluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdatePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
gateway:DeletePluginMetadata | arn:api7:gateway:gatewaygroup/%s |
服务注册中心
| 操作 | 资源 |
|---|
gateway:GetServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:ConnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
gateway:DisconnectServiceRegistry | arn:api7:gateway:gatewaygroup/%s |
密钥提供者
| 操作 | 资源 |
|---|
gateway:GetSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:PutSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
gateway:DeleteSecretProvider | arn:api7:gateway:gatewaygroup/%s/secret_provider/%s |
Proto
用于 grpc-transcode 和 proto 插件的 gRPC 服务定义。
| 操作 | 资源 |
|---|
gateway:GetProto | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:UpdateProto | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteProto | arn:api7:gateway:gatewaygroup/%s |
调试会话
用于在线请求调试和追踪捕获。
| 操作 | 资源 |
|---|
gateway:GetDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:CreateDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:StopDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:DeleteDebugSession | arn:api7:gateway:gatewaygroup/%s |
gateway:ExportDebugSession | arn:api7:gateway:gatewaygroup/%s |
Service
服务的作用域为网关组。同一组四个操作涵盖服务的路由和四层路由。
| 操作 | 资源 |
|---|
gateway:GetPublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
gateway:CreatePublishedService | arn:api7:gateway:gatewaygroup/%s/service/* |
gateway:UpdatePublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
gateway:DeletePublishedService | arn:api7:gateway:gatewaygroup/%s/service/%s |
部署设置
全局网关部署设置。
| 操作 | 资源 |
|---|
gateway:UpdateDeploymentSetting | arn:api7:gateway:gatewaysetting/* |
自定义插件
| 操作 | 资源 |
|---|
gateway:CreateCustomPlugin | arn:api7:gateway:gatewaysetting/* |
gateway:UpdateCustomPlugin | arn:api7:gateway:gatewaysetting/* |
gateway:DeleteCustomPlugin | arn:api7:gateway:gatewaysetting/* |
告警策略
| 操作 | 资源 |
|---|
gateway:GetAlertPolicy | arn:api7:gateway:alert/%s |
gateway:CreateAlertPolicy | arn:api7:gateway:alert/* |
gateway:UpdateAlertPolicy | arn:api7:gateway:alert/%s |
gateway:DeleteAlertPolicy | arn:api7:gateway:alert/%s |
Webhook 模板
供告警通知渠道使用的可复用 Webhook 载荷模板。
| 操作 | 资源 |
|---|
gateway:GetWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:CreateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:UpdateWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
gateway:DeleteWebhookTemplate | arn:api7:gateway:gatewaysetting/* |
iam: 命名空间
User
| 操作 | 资源 |
|---|
iam:GetUser | arn:api7:iam:user/%s |
iam:InviteUser | arn:api7:iam:user/* |
iam:UpdateUser | arn:api7:iam:user/%s |
iam:DeleteUser | arn:api7:iam:user/%s |
iam:UpdateUserRole | arn:api7:iam:user/%s |
iam:ResetPassword | arn:api7:iam:user/%s |
iam:UpdateUserBoundary | arn:api7:iam:user/%s |
Role
| 操作 | 资源 |
|---|
iam:GetRole | arn:api7:iam:role/%s |
iam:CreateRole | arn:api7:iam:role/* |
iam:UpdateRole | arn:api7:iam:role/%s |
iam:DeleteRole | arn:api7:iam:role/%s |
权限策略
| 操作 | 资源 |
|---|
iam:GetPermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:CreatePermissionPolicy | arn:api7:iam:permissionpolicy/* |
iam:UpdatePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
iam:DeletePermissionPolicy | arn:api7:iam:permissionpolicy/%s |
License
| 操作 | 资源 |
|---|
iam:UpdateLicense | arn:api7:iam:organization/* |
审计日志
| 操作 | 资源 |
|---|
iam:GetAudit | arn:api7:iam:organization/* |
iam:ExportAudits | arn:api7:iam:organization/* |
登录选项
登录选项用于配置 Dashboard 的身份验证方式（OIDC、SAML、LDAP、CAS）。
| 操作 | 资源 |
|---|
iam:GetLoginOption | arn:api7:iam:organization/* |
iam:CreateLoginOption | arn:api7:iam:organization/* |
iam:UpdateLoginOption | arn:api7:iam:organization/* |
iam:DeleteLoginOption | arn:api7:iam:organization/* |
SCIM 配置
| 操作 | 资源 |
|---|
iam:GetSCIMProvisioning | arn:api7:iam:organization/* |
iam:UpdateSCIMProvisioning | arn:api7:iam:organization/* |
SMTP 服务器
用于发送外发电子邮件通知和邀请用户。
| 操作 | 资源 |
|---|
iam:GetSMTPServer | arn:api7:iam:organization/* |
iam:UpdateSMTPServer | arn:api7:iam:organization/* |
通知渠道
通知渠道是告警策略引用的告警通知目标（电子邮件、Webhook 等）。
| 操作 | 资源 |
|---|
iam:GetContactPoint | arn:api7:iam:contactpoint/%s |
iam:CreateContactPoint | arn:api7:iam:contactpoint/* |
iam:UpdateContactPoint | arn:api7:iam:contactpoint/%s |
iam:DeleteContactPoint | arn:api7:iam:contactpoint/%s |
portal: 命名空间
| 操作 | 资源 |
|---|
portal:GetPortal | arn:api7:portal:portal/%s |
portal:CreatePortal | arn:api7:portal:portal/* |
portal:UpdatePortal | arn:api7:portal:portal/%s |
portal:DeletePortal | arn:api7:portal:portal/%s |
门户 Token
| 操作 | 资源 |
|---|
portal:GetPortalToken | arn:api7:portal:portal/%s/token/* |
portal:CreatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:UpdatePortalToken | arn:api7:portal:portal/%s/token/* |
portal:DeletePortalToken | arn:api7:portal:portal/%s/token/* |
API 产品
| 操作 | 资源 |
|---|
portal:GetAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:CreateAPIProduct | arn:api7:portal:portal/%s/apiproduct/* |
portal:UpdateAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
portal:DeleteAPIProduct | arn:api7:portal:portal/%s/apiproduct/%s |
开发者
| 操作 | 资源 |
|---|
portal:GetDeveloper | arn:api7:portal:portal/%s/developer/%s |
portal:InviteDeveloper | arn:api7:portal:portal/%s/developer/* |
portal:DeleteDeveloper | arn:api7:portal:portal/%s/developer/%s |
DCR 提供商
开发者门户使用的动态客户端注册提供商。
| 操作 | 资源 |
|---|
portal:GetDCRProvider | arn:api7:portal:dcrprovider/* |
portal:CreateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:UpdateDCRProvider | arn:api7:portal:dcrprovider/* |
portal:DeleteDCRProvider | arn:api7:portal:dcrprovider/* |
开发者登录选项
配置开发者登录开发者门户时可使用的身份验证方式。
| 操作 | 资源 |
|---|
portal:GetDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:CreateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
portal:DeleteDeveloperLoginOption | arn:api7:portal:portal/%s/loginsetting/* |
开发者 SCIM 配置
| 操作 | 资源 |
|---|
portal:GetDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperSCIMProvisioning | arn:api7:portal:portal/%s/loginsetting/* |
开发者门户公开访问
控制开发者门户是否无需登录即可公开访问。
| 操作 | 资源 |
|---|
portal:GetDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
portal:UpdateDeveloperPortalPublicAccess | arn:api7:portal:portal/%s/loginsetting/* |
审批待处理的 API 产品订阅或新开发者注册。
| 操作 | 资源 |
|---|
portal:ApproveAPIProductSubscription | arn:api7:portal:portal/%s/apiproduct/%s |
portal:ApproveDeveloperSignUp | arn:api7:portal:portal/%s/developer/* |
后续步骤