Resource names (TRNs)

Every resource has an ID (like vm-0123456789ab) and a TRN, a TebibHost Resource Name, that says exactly where it lives. Policies, the access checker and the audit log use TRNs.

trn:tebib:<service>:<region>:<scope>:<type>/<id>

Part	Meaning	Example
service	compute, network, iam, org, billing, metering	compute
region	The region, or empty for global resources (IAM)	lab-neo-1
scope	The project (p-…) for project resources, the organization (o-…) for others	p-0123456789ab
type/id	The resource type and its ID	vm/vm-0123456789ab

Examples:

trn:tebib:compute:lab-neo-1:p-0123456789ab:vm/vm-0123456789ab
trn:tebib:network:lab-neo-1:p-0123456789ab:security-group/sg-0123456789ab
trn:tebib:iam::o-0123456789ab:user/u-0123456789ab
trn:tebib:iam::tebib:policy/ReadOnly          # a TebibHost-managed policy

Wildcards in policies

* matches any run of characters and ? one character, so:

Resource	Matches
trn:tebib:compute:*:p-0123456789ab:vm/*	Every VM in one project, in any region
trn:tebib:compute:*:*:*	Everything in compute
*	Everything

A create is checked against <type>/* in the target project (for example ...:vm/* for compute:CreateVM), together with the tags in the request.

ID prefixes

Prefix	Resource	Prefix	Resource
o-	Organization	p-	Project
vm-	VM	vol-	Volume
snap-	Snapshot	key-	SSH key
vpc-	VPC	subnet-	Subnet
sg-	Security group	sgr-	Security group rule
nat-	NAT gateway	eip-	Public IP
u-	User	g-	Group
sa-	Service account	role-	Role
pol-	Policy	grd-	Guardrail
top-	Top-up	st-	Statement
TBK…	Access key	TBS…	Role session key