Available in Classic and VPC
NAVER Cloud Platform allows you to control access to resources and requests to perform actions based on Condition keys. You can learn about Resource Tag, a Condition key used to control access to resources, and Request Tag, a Condition key used to control action requests.
| Type | Resource Tag | Request Tag | Principal Tag | Dynamic Condition |
|---|---|---|---|---|
| Purpose of use | Used to allow or deny user actions on resources with specific tags. | Used to ensure that a specific tag key-value pair is required when creating a resource or modifying tags. | Used to allow or deny user actions only when a specific tag is assigned to the principal performing the action (sub account or role). | Used to dynamically allow or deny actions based on the request context by comparing request-time properties as variables rather than static values. |
| Available actions | Actions for which specific resources can be specified.
|
|
All actions. | Available only for actions for which the condition key can be used. |
| Permission check method | Compare the tag key-value pair defined in the IAM policy with those attached to the resource to manage access permissions. | Compare the tag key-value pair defined in the IAM policy with those included in the permission request to manage action permissions. | Compare the tag key-value pairs defined in the IAM policy with the tag key-value pairs assigned to the action principal, and use the result to manage whether the action is allowed. | Replace the variable defined in the policy, ${조건 키 전체} (e.g., ${ncp:principalTag/key}), its actual value at request time, then check whether it matches the target tag key-value pair to determine whether the action is allowed. |
Resource access control using Resource Tag
The following policy uses the ncp:resourceTag condition key to define permissions such that only policies with a specific tag [key:value] can be deleted:
Controlling action execution requests using Request Tag
The following policy uses the ncp:requestTag condition key to define permissions such that only Sub Account with a specific tag [key:value] can be created:
A Sub Account granted this policy can only create Sub Account with the [project:unicorn] tag. If Sub Account is created without specifying a tag, or with a tag other than [project:unicorn], the action is denied. In the case of resource creation actions that include tag information, you can also use the ncp:requestTag condition key to ensure that only Sub Accounts with a specific tag [key:value] can be created.
Access control using Principal Tag
The following policy uses the ncp:Principal Tag condition key to define permissions such that only sub accounts or roles with a specific tag [key:value] can perform actions:
Only sub accounts assigned this policy and tagged with [team:devops] can create a Policy. If an untagged sub account or a sub account with a tag value other than [team:devops] requests to create a Policy, the request is denied.
Tag-based access control using Dynamic Condition
Dynamic Condition is a method of defining a policy condition value so that it dynamically references a variable instead of directly specifying a particular value.
When a policy variable ${조건 키 전체} (e.g., ${ncp:principalTag/key}) is used as a condition value, it is replaced with the tag value at the time of the permission check and compared with the condition key.
A sub account assigned this policy and tagged with [project:unicorn] can delete only Policies tagged with [project:unicorn]. Without any additional policy changes, a sub account tagged with [project:pegasus] can delete only Policies tagged with [project:pegasus].
- For more information on the condition keys that can be allocated by action, see Sub Account permissions management.
- If Sub Account is granted a policy with a condition key that is not supported for the action, the action is denied.
- For more information on operators defined by NAVER Cloud Platform, see Condition keys and operator information.
Permission check logic when multiple keys or values are included
| CASE | Permission check logic |
|---|---|
| When multiple values are specified within a single (1) condition key | The logical operator or is applied, and permission is granted if at least 1 of the tag key-value pairs defined in the policy matches. |
| When multiple tag values are specified with a negation operator within a single (1) condition key | The logical operator nor is applied, and permission is granted only if none of the tag key-value pairs defined in the policy match. |
| When multiple condition keys are used within a single (1) Condition | The logical operator AND is applied, and permission is granted only if all condition keys match. |