• Simple Message Notification

smn
  1. Help Center
  2. Simple Message Notification
  3. User Guide
  4. Topic Management
  5. Configuring Topic Policies
  6. Advanced Mode

Advanced Mode

The advanced mode provides a more flexible topic policy. You can specify which users and cloud services can perform which topic operations, for example, querying topic details, modifying topics, publishing messages, and deleting topics.

Introduction to Topic Policies

A topic policy is configured by a topic creator to allow or disallow other users or cloud services to perform specified operations to a topic. Table 1 lists the elements consisting of a topic policy.

Table 1 Topic policy elements

Parameter

Description

Constraint

Version

Policy specification version

Currently, only 2016-09-07 is supported.

Id

Policy ID, which uniquely identifies a policy

The policy ID cannot be left blank.

Statement

Statements used to configure which users and cloud services can perform specified operations in a topic policy. Each policy may contain one or more statements.

A policy must contain at least one statement. For details about elements in a statement, see Statement Elements.

The following is an example topic policy, which contains two statements, Statement1 and Statement2.

{
    "Version": "2016-09-07",
    "Id": "access_policy_01",
    "Statement": [
       {Statement1},
       {Statement2}
    ]
}

Statement Elements

Table 2 lists the elements composed of a statement, as shown in the following example topic policy:

{
    "Version": "2016-09-07", 
    "Id": "__default_policy_ID", 
    "Statement": [
           //The first statement.
        {
            "Sid": "__user_pub_0", 
            "Effect": "Allow", 
            "Principal": {
                "CSP": [
                    "urn:csp:iam::123456789:root",
                    "urn:csp:iam::987654321:root"
                ]
            }, 
            "Action": [
                "SMN:Publish", 
                "SMN:QueryTopicDetail"
            ], 
            "Resource": "urn:smn:regionId:e23bf08ebb924730b452426c60849564:ECM_BKS_Topic"
        }, 
        //The second statement
       {
            "Sid": "__service_pub_0", 
            "Effect": "Allow", 
            "Principal": {
                "Service": [
                    "obs"
                ]
            }, 
            "Action": [
                "SMN:Publish", 
                "SMN:QueryTopicDetail"
            ], 
            "Resource": "urn:smn:regionId:e23bf08ebb924730b452426c60849564:ECM_BKS_Topic"
        }
    ]
}
Table 2 Statement elements description

Element

Description

Constraint

Sid

Statement ID

The statement ID must be unique, for example, statement01 or statement02.

Effect

Statement effect

The value can be Allow or Deny.

Principal

NotPrincipal

  • Principal: object to which the statement applies
  • NotPrincipal: object to which the statement does not apply

    There are currently two supported values:

    • CSP: Specify one or more cloud users.
    • Service: Specify one or more cloud services.

Either the Principal or NotPrincipal element must be configured.

If you enter CSP, you must specify user information in the format urn:csp:iam::domainId:root. You need to obtain the domain ID of each user you specify.

If you enter Service, you must specify the cloud service names in lower case.

Action

NotAction

  • Action: allowed statement action
  • NotAction: statement action not allowed

    You can use a wildcard character to configure a set of actions by type, for example, SMN:Update* and SMN:Delete*. If you only enter a wildcard character (*) in a statement, all supported actions are configured.

Either the Action or NotAction element must be configured.

The following actions are supported:

  • SMN:UpdateTopic
  • SMN:DeleteTopic
  • SMN:QueryTopicDetail
  • SMN:ListTopicAttributes
  • SMN:UpdateTopicAttribute
  • SMN:DeleteTopicAttributes
  • SMN:DeleteTopicAttributeByName
  • SMN:ListSubscriptionsByTopic
  • SMN:Subscribe
  • SMN:Unsubscribe
  • SMN:Publish

For details about mappings between actions and APIs, see section Mappings Between SMN Operations and APIs.

Resource

NotResource

  • Resource: topic to which a statement applies
  • NotResource: topic to which the statement does not apply

Either the Resource or NotResource element must be configured.

You need to enter a topic URN.

Condition

(Optional) Condition under which a policy statement takes effect

Enter supported condition operators and key words.

For details, see Condition Elements.

Condition Elements

Conditions determine whether a statement takes effect. They enable you to configure more fine-grained control over topic permissions. Table 3 lists elements in a condition.

Table 3 Condition elements

Parameter

Description

Constraint

Condition operator

Character string, numeral, date, or time to be matched

The time you entered must comply with ISO 8601 specifications. For details, see Table 4.

Key word

Object to which the condition operation applies

The key word cannot be left blank. For details, see Table 5.

A statement allows the requested operation only when all conditions in the statement are met. Otherwise, the operation will be denied.

As shown in Figure 1, when a condition contains multiple operators, for example, condition1 and condition2, an AND operation is executed.

When the operator condition1 contains multiple key words, for example, conditionKey1 and conditionKey2, an AND operation is executed.

When the key word conditionKey1 contains multiple values, for example, value11 and value12, an OR operation is executed.

Figure 1 Condition logic
An example condition is as follows:
"Condition": {
    "DateLessThan":{
         "csp:CurrentTime":"2016-11-07T15:35:00Z"
    },
    "StringLike": {
         "smn:Endpoint":["*@gmail.com","*@hotmail.com"]
    }
}
Table 4 Condition operators

Category

Operator

Description

String

StringEquals

Match a string (case-sensitive).

StringNotEquals

Exclude a string (case-sensitive).

StringEqualsIgnoreCase

Match a string (case-insensitive).

StringNotEqualsIgnoreCase

Exclude a string (case-insensitive).

StringLike

Match a string. The value can contain one or more wildcard characters (*).

StringNotLike

Exclude a string. The value can contain one or more wildcard characters (*).

Numeric

NumericEquals

Match an integer or decimal.

NumericNotEquals

Exclude an integer or decimal.

NumericLessThan

Match any numeral less than an integer or decimal.

NumericLessThanEquals

Match any numeral less than or equal to an integer or decimal.

NumericGreaterThan

Match any numeral greater than an integer or decimal.

NumericGreaterThanEquals

Match any numeral greater than or equal to an integer or decimal.

Date

DateEquals

Match a date.

DateNotEquals

Exclude a date.

DateLessThan

Match any time earlier than a date and time point.

DateLessThanEquals

Match any time earlier than or equal to a date and time point.

DateGreaterThan

Match any time later than a date and time point.

DateGreaterThanEquals

Match any time later than or equal to a date and time point.

Bool

Bool

Match a Boolean value.

Table 5 Condition key words

Key Word

Description

csp:CurrentTime

Current time

smn:Protocol

Protocol of a subscription, which is valid only for the SMN:Subscribe action

smn:Endpoint

Endpoint of a subscription, which is valid only for the SMN:Subscribe action