Available in Classic and VPC
NAVER Cloud Platform allows you to control requests to access resources and perform actions based on Condition keys. This section explains the Resource Tag condition key for controlling access to resources, the Request Tag condition key for controlling action requests, the Principal Tag condition key for controlling access based on tags assigned to the principal, and Dynamic Condition for dynamic control using request-time attributes as variables.
| Type | Resource Tag | Request Tag | Principal Tag | Dynamic Condition |
|---|---|---|---|---|
| Purpose of use | Used to allow or deny user actions on resources with specific tags. | Used to ensure that a specific tag key-value pair is required when creating a resource or modifying tags. | Used to allow or deny user actions only when a specific tag is assigned to the principal performing the action (sub account or role). | Used to dynamically allow or deny actions based on the request context by comparing request-time properties as variables rather than static values. |
| Available actions | Actions for which specific resources can be specified.
|
|
All actions. | Available only for actions for which the condition key can be used. |
| Permission check method | Compare the tag key-value pair defined in the IAM policy with those attached to the resource to manage access permissions. | Compare the tag key-value pair defined in the IAM policy with those included in the permission request to manage action permissions. | Compare the tag key-value pairs defined in the IAM policy with the tag key-value pairs assigned to the action principal, and use the result to manage whether the action is allowed. | Replace the variable ${All condition keys} defined in the policy (e.g., ${ncp:principalTag/key}) with its actual value at request time, then check whether it matches the target tag key-value pair to determine whether the request is allowed. |
Resource access control using Resource Tag
The following policy uses the ncp:resourceTag condition key to define permissions such that only policies with a specific tag [key:value] can be deleted:
Controlling action execution requests using Request Tag
The following policy uses the ncp:requestTag condition key to define permissions such that only Sub Account with a specific tag [key:value] can be created:
A Sub Account granted this policy can only create Sub Account with the [project:unicorn] tag. If Sub Account is created without specifying a tag, or with a tag other than [project:unicorn], the action is denied. In the case of resource creation actions that include tag information, you can also use the ncp:requestTag condition key to ensure that only Sub Accounts with a specific tag [key:value] can be created.
Access control using Principal Tag
The following policy uses the ncp:Principal Tag condition key to define permissions such that only sub accounts or roles with a specific tag [key:value] can perform actions:
Only sub accounts assigned this policy and tagged with [team:devops] can create a Policy. If an untagged sub account or a sub account with a tag value other than [team:devops] requests to create a Policy, the request is denied.
Tag-based access control using Dynamic Condition
Dynamic Condition is a method of defining a policy condition value so that it dynamically references a variable instead of directly specifying a particular value.
When you use the policy variable ${All condition keys} (e.g., ${ncp:principalTag/key}) as a condition value, it is replaced with the tag value during the permission check and compared with the condition key.
A sub account assigned this policy and tagged with [project:unicorn] can delete only Policies tagged with [project:unicorn]. Without any additional policy changes, a sub account tagged with [project:pegasus] can delete only Policies tagged with [project:pegasus].
- For more information on the condition keys that can be allocated by action, see Sub Account permissions management.
- If Sub Account is granted a policy with a condition key that is not supported for the action, the action is denied.
- For more information on operators defined by NAVER Cloud Platform, see Condition keys and operator information.
Permission check logic when multiple keys or values are included
| CASE | Permission check logic |
|---|---|
| When multiple values are specified within a single (1) condition key | The logical operator or is applied, and permission is granted if at least 1 of the tag key-value pairs defined in the policy matches. |
| When multiple tag values are specified with a negation operator within a single (1) condition key | The logical operator nor is applied, and permission is granted only if none of the tag key-value pairs defined in the policy match. |
| When multiple condition keys are used within a single (1) Condition | The logical operator AND is applied, and permission is granted only if all condition keys match. |