The page has been translated by Gen AI.

Resource-based Policy Guide

Resource-based policy overview

The resource-based policy (Resource-based Policy) of Cloud Functions is a policy granted to a resource that can decide to allow or deny (Effect) an action (Action) on a specific resource for a principal (Principal). You can directly define the principal that can invoke a function by using resource-based policies.

Reference
While a typical IAM policy (Identity-based) grants permissions to a user, a resource-based policy is applied to the function itself to allow external access.

You can allow function calls by defining the following in a resource-based policy.

  • User of the specified Samsung Cloud Platform account
  • Specified source IP address range or CIDR block

A source policy is defined as a JSON policy document attached to the API, which controls whether the specified security principal (typically an IAM role or group) can call the API.

Categorydescriptionexample
PrincipalSpecify the caller of the functionSpecific object storage bucket, API Gateway, other Samsung Cloud Platform accounts, etc.
Task(Action)Define the allowed functionsMostly scf:InvokeFunction
Condition(Condition)Restrict to allow only in specific situationsAllow only requests originating from a bucket with a specific SRN.
Table. Entity that controls API call execution
Reference
  • Cloud Functions’ resource-based policies leverage the rules of IAM’s resource-based policies.
  • For instructions on creating or modifying policies using JSON, refer to the JSON Mode Utilization Guide.

Resource-based policy usage scenario

The primary use cases for resource-based policies are as follows.

Resource-based policy scenario

The resource-based policy scenarios used when a Cloud Functions function runs are as follows.

CategorydescriptionReference example
Function URL - Authentication Type NoneIt is required when generating a function URL for invocation.
  • If there is no resource-based policy, authorization fails, making it impossible to invoke the function using a public URL.
Function URL (Auth Type None) Example
Function URL - Authentication Type IAM
  • Resource-based policy is registered or credential permission is required.
  • If the resource belongs to the same account: you can invoke it if you have a resource-based policy or credential permission (InvokeFunctionUrl).
  • If the resource belongs to a different account: you must have both a resource-based policy and credential permission (InvokeFunction) to invoke it.
Function URL (authentication type IAM) example
API Gateway triggerIt is required when API Gateway calls Lambda to handle external API requests.
  • Resource-based policy registration is required.
  • If a resource-based policy is not present, authorization fails, making it impossible to invoke the function via API Gateway.
API Gateway Trigger Example
PrivateLink connectionYou can connect a PrivateLink Service to define the function for private access from another VPC.
  • It must be registered with a resource-based policy or require credential permissions.
  • When the resource is in the same account: you can invoke it if you have a resource-based policy or credential permission (InvokeFunction).
  • When the resource is in a different account: you must have both a resource-based policy and credential permission (InvokeFunction) to invoke it.
PrivateLink connection example
Table. Resource-based policy scenario

User addition usage scenario

Although it is not automatically registered as a resource-based policy for Cloud Functions, users can add and use it as needed. The scenarios that users can add and utilize are as follows.

  • Cross-Account Access
    • If an IAM user in account A wants to invoke a Lambda in account B, register account A in the function policy of account B.
  • Hybrid Access Control
    • It can be configured so that access is allowed only when both conditions are met—a specific user and a specific IP range—rather than merely restricting by account or IP alone.

Resource-based policy management for Cloud Functions

To view and configure resource-based policies for Cloud Functions, follow these steps.

  1. Click the All Services > Compute > Cloud Functions menu. Navigate to the Service Home page of Cloud Functions.
  2. On the Service Home page, click the Function menu. You will be taken to the Function list page.
  3. On the Function List page, click the resource for which you want to set a policy. You will be taken to the Function Details page.
  4. Click the Configuration tab on the Function Details page.
  5. Click the Edit button of the Resource-based policy permission item. The Resource policy edit popup window opens.
  6. In the Resource Policy edit popup, after selecting the Policy Template, write the policy.
  7. When the writing is complete, click the Confirm button.
    • Click the Delete button to delete the registered policy.

Example of resource-based policy

Users can define additional resource-based policies as needed or modify existing policies for use.

Reference
  • For some features, a resource‑based policy (or credential) must be registered to use them in Cloud Functions.
  • In the resource-based policy examples described in this guide, Cloud Functions automatically registers the example resource-based policies when each feature is enabled or linked.

Function URL - Authentication Type None

Principal is /* a policy that allows public calls.

Policy Template

Color mode
{
    "Statement": [
        {
        	"Action": ["scf:InvokeFunctionUrl"],
        	"Condition": {
            	"StringEquals": {
                	"scf:CloudFunctionAuthType": ["NONE"]
            	}
        	},
        	"Effect": "Allow"
        	"Principal": "*"
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "InvokeFunctionURLAllowPublicAccess"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
        	"Action": ["scf:InvokeFunctionUrl"],
        	"Condition": {
            	"StringEquals": {
                	"scf:CloudFunctionAuthType": ["NONE"]
            	}
        	},
        	"Effect": "Allow"
        	"Principal": "*"
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "InvokeFunctionURLAllowPublicAccess"
        }
    ],
    "Version": "2024-07-01"
}
Function URL – Authentication Type None Policy Template Example

Policy example

Color mode
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["NONE"]
                }
            },
            "Effect": "Allow"
            "Principal": "*"
            "Resource": ["srn:e::accountID:kr-west1::scf:cloud-function/functionsID"],
            "Sid": "InvokeFunctionURLAllowPublicAccess"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["NONE"]
                }
            },
            "Effect": "Allow"
            "Principal": "*"
            "Resource": ["srn:e::accountID:kr-west1::scf:cloud-function/functionsID"],
            "Sid": "InvokeFunctionURLAllowPublicAccess"
        }
    ],
    "Version": "2024-07-01"
}
Function URL - Authentication Type None Policy Example

Function URL - Authentication Type IAM

This policy permits a specific user to invoke a public URL.

Policy Template

Color mode
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "scp": ["srn:{{Environment}}::{{AccountID}}:::iam:user/{{UserId}}"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "scp": ["srn:{{Environment}}::{{AccountID}}:::iam:user/{{UserId}}"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
Function URL - Authentication Type IAM Policy Template Example

Policy Example

Color mode
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": "*",
            "Resource":  ["srn:e::accountID:kr-west1::scf:cloud-function/functionsID"],
            "Sid": "accountID-iam-invokefunctionurl"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunctionUrl"],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": "*",
            "Resource":  ["srn:e::accountID:kr-west1::scf:cloud-function/functionsID"],
            "Sid": "accountID-iam-invokefunctionurl"
        }
    ],
    "Version": "2024-07-01"
}
Function URL - Authentication Type IAM Policy Example

API Gateway trigger

Principal is a policy that permits public calls with a * principal.

Policy Template

Color mode
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunction"],
            "Condition": {
                "SrnLike": {
                    "scp:RequestAttribute/body['x-scf-request-obj-srn']": ["{{ApiGatewayMethodSrn}}"]
                }
            },
            "Effect": "Allow",
            "Principal": {
                "Service": ["apigateway.samsungsdscloud.com"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunction"],
            "Condition": {
                "SrnLike": {
                    "scp:RequestAttribute/body['x-scf-request-obj-srn']": ["{{ApiGatewayMethodSrn}}"]
                }
            },
            "Effect": "Allow",
            "Principal": {
                "Service": ["apigateway.samsungsdscloud.com"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
API Gateway trigger policy template example

Policy Example

Color mode
{
    "Statement": [
        {
            "Action": [
                scf:InvokeFunction
            ],
            "Condition": {
                "SrnLike": {
                    "scp:RequestAttribute/body['x-scf-request-obj-srn']": [
                        srn:e::accountID:kr-west1::apigateway:method/MethodID/*/GET/test
                    ]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "Service": [
                    "apigateway.samsungsdscloud.com"
                ]
            },
            "Resource": [
                srn:e::accountID:kr-west1::scf:cloud-function/functionID
            ],
            "Sid": "999e9a9999de4d4683c9e10c74ee999z"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": [
                scf:InvokeFunction
            ],
            "Condition": {
                "SrnLike": {
                    "scp:RequestAttribute/body['x-scf-request-obj-srn']": [
                        srn:e::accountID:kr-west1::apigateway:method/MethodID/*/GET/test
                    ]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "Service": [
                    "apigateway.samsungsdscloud.com"
                ]
            },
            "Resource": [
                srn:e::accountID:kr-west1::scf:cloud-function/functionID
            ],
            "Sid": "999e9a9999de4d4683c9e10c74ee999z"
        }
    ],
    "Version": "2024-07-01"
}
API Gateway trigger policy example

PrivateLink connection

This is a policy that allows function calls through a Privatelink Endpoint for specific users.

Policy Template

Color mode
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunction"],
            "Condition": {
                "StringEquals": {
           			"scf:CloudFunctionPrivatelinkServiceAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "scp": ["srn:{{Environment}}::{{AccountID}}:::iam:user/{{UserId}}"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": ["scf:InvokeFunction"],
            "Condition": {
                "StringEquals": {
           			"scf:CloudFunctionPrivatelinkServiceAuthType": ["SCP_IAM"]
                }
            },
            "Effect": "Allow"
            "Principal": {
                "scp": ["srn:{{Environment}}::{{AccountID}}:::iam:user/{{UserId}}"]
            },
            "Resource": ["{{CloudFunctionSrn}}"],
            "Sid": "Statement1"
        }
    ],
    "Version": "2024-07-01"
}
Example of a PrivateLink connection policy template

Policy Example

Color mode
{
    "Statement": [
        {
            "Action": [
                scf:InvokeFunction
            ],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": [
                        SCP_IAM
                    ]
                }
            },
            "Effect": "Allow",
            "Principal": {
                "scp": [
                    srn:e::accountID:::iam:user/userID
                ]
            },
            "Resource": [
                srn:e::accountID:kr-west1::scf:cloud-function/functionID
            ],
"Sid": "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr-privatelink-invokefunction"
        }
    ],
    "Version": "2024-07-01"
}
{
    "Statement": [
        {
            "Action": [
                scf:InvokeFunction
            ],
            "Condition": {
                "StringEquals": {
                    "scf:CloudFunctionAuthType": [
                        SCP_IAM
                    ]
                }
            },
            "Effect": "Allow",
            "Principal": {
                "scp": [
                    srn:e::accountID:::iam:user/userID
                ]
            },
            "Resource": [
                srn:e::accountID:kr-west1::scf:cloud-function/functionID
            ],
"Sid": "rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr-privatelink-invokefunction"
        }
    ],
    "Version": "2024-07-01"
}
Example of PrivateLink connection policy
Integrate PrivateLink Service
Release Note