自定義網絡和自定義網絡ACL相關策略未在物理機 FullAccess、物理機 CommonOperations或物理機 ReadOnlyAccess系統策略中定義，您需要創建自定義策略來實現創建、修改、刪除自定義網絡和自定義網絡ACL等操作。
場景一：自定義網絡和自定義網絡ACL依賴的授權項
自定義網絡和自定義網絡ACL依賴的授權項必須包含：ecs:servers:list、bms:servers:list
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list"
]
}
]
}
如果未添加這些授權項，用戶將無法進入物理機列表頁面，也就無法進行任何自定義網絡和自定義網絡ACL相關的操作。
場景二：創建自定義網絡
創建自定義網絡對應授權項為：bms:virtualNetworks:create。
除了依賴場景一：自定義網絡和自定義網絡ACL依賴的授權項中的授權項外，還依賴vpc:vpcs:list，因為自定義網絡創建頁面會查詢VPC列表。
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:create"
]
}
]
}
場景三：查詢自定義網絡列表
查詢自定義網絡列表對應授權項為：bms:virtualNetworks:list
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list"
]
}
]
}
場景四：查詢自定義網絡詳情
查詢自定義網絡詳情對應授權項為：bms:virtualNetworks:get
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get"
]
}
]
}
場景五：修改自定義網絡名稱
修改自定義網絡名稱對應授權項為：bms:virtualNetworks:update
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get",
"bms:virtualSubnets:create",
"bms:virtualNetworks:update"
]
}
]
}
場景六：刪除自定義網絡
刪除自定義網絡對應授權項為：bms:virtualNetworks:delete
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get",
"bms:virtualNetworks:delete"
]
}
]
}
場景七：添加自定義子網
添加自定義子網對應授權項為：bms:virtualSubnets:create
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get",
"bms:virtualSubnets:list",
"bms:virtualSubnets:create"
]
}
]
}
場景八：查詢自定義子網列表
查詢自定義子網列表對應授權項為：bms:virtualSubnets:list
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get",
"bms:virtualSubnets:list"
]
}
]
}
說明該授權項僅用于自定義網絡ACL關聯自定義子網時使用。
場景九：刪除自定義子網
刪除自定義子網對應授權項為：bms:virtualSubnets:delete
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:virtualNetworks:list",
"bms:virtualNetworks:get",
"bms:virtualSubnets:list",
"bms:virtualSubnets:delete"
]
}
]
}
場景十：創建自定義網絡ACL
創建自定義網絡ACL對應授權項為：bms:firewallGroups:create
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:firewallGroups:list",
"bms:firewallGroups:create"
]
}
]
}
場景十一：查詢自定義網絡ACL列表
查詢自定義網絡ACL列表對應授權項為：bms:firewallGroups:list
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:firewallGroups:list"
]
}
]
}
場景十二：查詢自定義網絡ACL詳情
查詢自定義網絡ACL詳情對應授權項為：bms:firewallGroups:get
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:firewallGroups:list",
"bms:firewallGroups:get"
]
}
]
}
場景十三：修改自定義網絡ACL
該場景包括如下操作：修改名稱、修改描述、添加ACL規則、修改ACL規則、刪除ACL規則、開啟/關閉ACL規則、向前/后插入規則、關聯自定義子網（依賴bms:virtualSubnets:list授權項）。
修改自定義網絡ACL對應授權項為：bms:firewallGroups:update
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:firewallGroups:list",
"bms:firewallGroups:get",
"bms:virtualSubnets:list",
"bms:firewallGroups:update"
]
}
]
}
場景十四：刪除自定義網絡ACL
刪除自定義網絡ACL對應授權項為：bms:firewallGroups:delete
完整的策略內容如下：
{
"Version": "1.1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ecs:servers:list",
"bms:servers:list",
"vpc:vpcs:list",
"bms:firewallGroups:list",
"bms:firewallGroups:get",
"bms:firewallGroups:delete"
]
}
]
}
