# Networking

This page lists the IAM bindings available to policy rules for each network-related
API operation: `operation`, `parameters` and `resources`. For general information
on how rules and bindings work, see the
[IAM policy guide]({{< ref "/product/security/iam/how-to/policy-guide/" >}}).

## Overview

The operations below belong to the `networking` IAM service.

> [!IMPORTANT]
> Attaching and detaching a Compute instance to/from a VPC Subnet
> (`attach-instance-to-subnet`, `detach-instance-from-subnet`) belong to the
> `compute` service class, not `networking`. Rules for these operations must be
> written in the `compute` service policy. See
> [attach-instance-to-subnet](/reference/iam/compute/#attach-instance-to-subnet)
> and [detach-instance-from-subnet](/reference/iam/compute/#detach-instance-from-subnet)
> in the compute reference.

| Operation | Endpoint | Resources |
|---|---|---|
| [create-vpc](#create-vpc) | `POST /vpc` | - |
| [list-vpcs](#list-vpcs) | `GET /vpc` | - |
| [get-vpc](#get-vpc) | `GET /vpc/<id>` | `vpc` |
| [update-vpc](#update-vpc) | `PUT /vpc/<id>` | `vpc` |
| [delete-vpc](#delete-vpc) | `DELETE /vpc/<id>` | `vpc` |
| [create-subnet](#create-subnet) | `POST /vpc/<vpc-id>/subnet` | `vpc` |
| [list-subnets](#list-subnets) | `GET /vpc/<vpc-id>/subnet` | `vpc` |
| [get-subnet](#get-subnet) | `GET /vpc/<vpc-id>/subnet/<id>` | `vpc`, `subnet` |
| [update-subnet](#update-subnet) | `PUT /vpc/<vpc-id>/subnet/<id>` | `vpc`, `subnet` |
| [delete-subnet](#delete-subnet) | `DELETE /vpc/<vpc-id>/subnet/<id>` | `vpc`, `subnet` |
| [create-route](#create-route) | `POST /vpc/<vpc-id>/subnet/<subnet-id>/route` | `vpc`, `subnet` |
| [delete-route](#delete-route) | `DELETE /vpc/<vpc-id>/subnet/<subnet-id>/route/<id>` | `vpc`, `subnet` |
| [list-routes](#list-routes) | `GET /vpc/<vpc-id>/subnet/<subnet-id>/route` | `vpc`, `subnet` |
| [list-vpc-routes](#list-vpc-routes) | `GET /vpc/<vpc-id>/route` | `vpc` |

Routes are not exposed as a resource. To write rules about routes, use
`parameters` (for example `parameters.destination` on `create-route`) together
with the parent `vpc` and `subnet` resources.

## Resources

Resources are only loaded when a rule in the `networking` service policy
references them.

### vpc

The VPC targeted by the request, or the parent VPC of the targeted subnet or route.

* resources.vpc.id
* resources.vpc.name
* resources.vpc.description
* resources.vpc.created\_at
* resources.vpc.default: `true` if this is the organization's default VPC
* resources.vpc.labels

### subnet

The subnet targeted by the request, or the parent subnet of the targeted route.

* resources.subnet.id
* resources.subnet.name
* resources.subnet.description
* resources.subnet.created\_at
* resources.subnet.addressfamily
* resources.subnet.address\_space
* resources.subnet.ipv4\_block
* resources.subnet.labels
* resources.subnet.instances: list of attached instances, each with `id`, `name` and `ipv4`

## VPC operations

### create-vpc

`POST /vpc` - Create a VPC

#### Parameters:

* parameters.name
* parameters.description
* parameters.labels

#### Resources:

None.

### list-vpcs

`GET /vpc` - List VPCs

#### Resources:

None.

### get-vpc

`GET /vpc/<id>` - Retrieve VPC details

#### Parameters:

* parameters.id

#### Resources:

* [resources.vpc](#vpc)

### update-vpc

`PUT /vpc/<id>` - Update a VPC

#### Parameters:

* parameters.id
* parameters.name
* parameters.description
* parameters.labels

#### Resources:

* [resources.vpc](#vpc)

### delete-vpc

`DELETE /vpc/<id>` - Delete a VPC

#### Parameters:

* parameters.id

#### Resources:

* [resources.vpc](#vpc)

## Subnet operations

### create-subnet

[`POST /vpc/<vpc-id>/subnet`](https://community.exoscale.com/reference/api/compute/vpc/vpc/#create-subnet) - Create a Subnet

#### Parameters:

* parameters.vpc\_id
* parameters.name
* parameters.description
* parameters.labels
* parameters.addressfamily
* parameters.address\_space
* parameters.ipv4\_block

#### Resources:

* [resources.vpc](#vpc)

### list-subnets

[`GET /vpc/<vpc-id>/subnet`](https://community.exoscale.com/reference/api/compute/vpc/vpc/#list-subnets) - List Subnets

#### Parameters:

* parameters.vpc\_id

#### Resources:

* [resources.vpc](#vpc)

### get-subnet

[`GET /vpc/<vpc-id>/subnet/<id>`](https://community.exoscale.com/reference/api/compute/vpc/vpc/#get-subnet) - Retrieve Subnet details

#### Parameters:

* parameters.vpc\_id
* parameters.id

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

### update-subnet

[`PUT /vpc/<vpc-id>/subnet/<id>`](https://community.exoscale.com/reference/api/compute/vpc/vpc/#update-subnet) - Update a Subnet

#### Parameters:

* parameters.vpc\_id
* parameters.id
* parameters.name
* parameters.description
* parameters.labels

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

### delete-subnet

[`DELETE /vpc/<vpc-id>/subnet/<id>`](https://community.exoscale.com/reference/api/compute/vpc/vpc/#delete-subnet) - Delete a Subnet

#### Parameters:

* parameters.vpc\_id
* parameters.id

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

## Route operations

### create-route

`POST /vpc/<vpc-id>/subnet/<subnet-id>/route` - Create a route

#### Parameters:

* parameters.vpc\_id
* parameters.subnet\_id
* parameters.description
* parameters.destination
* parameters.target

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

### delete-route

`DELETE /vpc/<vpc-id>/subnet/<subnet-id>/route/<id>` - Delete a route

#### Parameters:

* parameters.vpc\_id
* parameters.subnet\_id
* parameters.id: the route ID

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

### list-routes

`GET /vpc/<vpc-id>/subnet/<subnet-id>/route` - List Subnet routes

#### Parameters:

* parameters.vpc\_id
* parameters.subnet\_id

#### Resources:

* [resources.vpc](#vpc)
* [resources.subnet](#subnet)

### list-vpc-routes

`GET /vpc/<vpc-id>/route` - List VPC routes

#### Parameters:

* parameters.vpc\_id

#### Resources:

* [resources.vpc](#vpc)

## Examples

### Restrict VPC management to VPCs labelled `env=dev`

`create-vpc` and `list-vpcs` load no resource, so the first rule lets them
through. Every other `networking` operation is only allowed on VPCs labelled
`env=dev`. Any request that matches no rule is denied.

```json
{
  "default-service-strategy": "deny",
  "services": {
    "networking": {
      "type": "rules",
      "rules": [
        {
          "action": "allow",
          "expression": "!has(resources.vpc)"
        },
        {
          "action": "allow",
          "expression": "has(resources.vpc.labels.env) && resources.vpc.labels.env == 'dev'"
        }
      ]
    }
  }
}
```

> [!WARNING]
> This policy does not cover `attach-instance-to-subnet` and
> `detach-instance-from-subnet`, which belong to the `compute` service class. To
> apply the same restriction to them, add equivalent rules to the `compute`
> service policy.