RAM用户调用资源管理API前,需要阿里云账号(主账号)创建权限策略并对RAM用户进行授权。在权限策略中,使用资源描述符ARN(Aliyun Resource Name)指定授权资源。
本文用到的字段含义如下,请在使用时替换为实际值。
- <account_id>:阿里云账号(主账号)ID。
- <resourcegroup_id>:资源组ID。
- <policy_name>:权限策略名称。
- <role_name>:RAM角色名称。
- <resource_type>:资源类型。
- <resource_id>:资源ID。
- <region_id>:地域ID。
- <product>:云服务代码。
资源组鉴权列表
下表列举了资源组中可授权的操作(Action)和资源(Resource)。
Action | Resource |
---|---|
ram:CreateResourceGroup | acs:ram:*:<account_id>:resourcegroup/* |
ram:DeleteResourceGroup | acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id> |
ram:UpdateResourceGroup | acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id> |
ram:CreatePolicy | acs:ram:*:<account_id>:policy/* |
ram:DeletePolicy | acs:ram:*:<account_id>:policy/<policy_name> |
ram:ListPolicies | acs:ram:*:<account_id>:policy/* |
ram:GetPolicy | acs:ram:*:<account_id>:policy/<policy_name> |
ram:CreatePolicyVersion | acs:ram:*:<account_id>:policy/<policy_name> |
ram:DeletePolicyVersion | acs:ram:*:<account_id>:policy/<policy_name> |
ram:ListPolicyVersions | acs:ram:*:<account_id>:policy/<policy_name> |
ram:GetPolicyVersion | acs:ram:*:<account_id>:policy/<policy_name> |
ram:SetDefaultPolicyVersion | acs:ram:*:<account_id>:policy/<policy_name> |
ram:AttachPolicy |
|
ram:DetachPolicy |
|
ram:ListPolicyAttachments | acs:ram:*:<account_id>:* |
ram:CreateRole | acs:ram:*:<account_id>:role/* |
ram:GetRole | acs:ram:*:<account_id>:role/<role_name> |
ram:ListRoles | acs:ram:*:<account_id>:role/* |
ram:UpdateRole | acs:ram:*:<account_id>:role/<role_name> |
ram:DeleteRole | acs:ram:*:<account_id>:role/<role_name> |
ram:CreateServiceLinkedRole | acs:ram:*:<account_id>:role/* |
ram:DeleteServiceLinkedRole | acs:ram:*:<account_id>:role/<role_name> |
ram:GetServiceLinkedRoleDeletionStatus | acs:ram:*:<account_id>:role/<role_name> |
资源目录鉴权列表
下表列举了资源目录中可授权的操作(Action)和资源(Resource)。
Action | Resource |
---|---|
resourcemanager:InitResourceDirectory | acs:resourcemanager:*:<account_id>:* |
resourcemanager:DestroyResourceDirectory | acs:resourcemanager:*:<account_id>:* |
resourcemanager:GetResourceDirectory | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CreateResourceAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CreateCloudAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:PromoteResourceAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ResendCreateCloudAccountEmail | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ResendPromoteResourceAccountEmail | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CancelCreateCloudAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CancelPromoteResourceAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:RemoveCloudAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:GetAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:MoveAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListAccountsForParent | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListAccounts | acs:resourcemanager:*:<account_id>:* |
resourcemanager:GetPayerForAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:UpdateAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CreateFolder | acs:resourcemanager:*:<account_id>:* |
resourcemanager:DeleteFolder | acs:resourcemanager:*:<account_id>:* |
resourcemanager:GetFolder | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListFoldersForParent | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListAncestors | acs:resourcemanager:*:<account_id>:* |
resourcemanager:UpdateFolder | acs:resourcemanager:*:<account_id>:* |
resourcemanager:InviteAccountToResourceDirectory | acs:resourcemanager:*:<account_id>:* |
resourcemanager:GetHandshake | acs:resourcemanager:*:<account_id>:* |
resourcemanager:AcceptHandshake | acs:resourcemanager:*:<account_id>:* |
resourcemanager:CancelHandshake | acs:resourcemanager:*:<account_id>:* |
resourcemanager:DeclineHandshake | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListHandshakesForAccount | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListHandshakesForResourceDirectory | acs:resourcemanager:*:<account_id>:* |
resourcemanager:ListTrustedServiceStatus | acs:resourcemanager:*:<account_id>:* |
资源共享鉴权列表
下表列举了资源共享中可授权的操作(Action)和资源(Resource)。
Action | Resource |
---|---|
resourcesharing:EnableSharingWithResourceDirectory | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:CreateResourceShare | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:UpdateResourceShare | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:DeleteResourceShare | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListResourceShares | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:AssociateResourceShare | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:DisassociateResourceShare | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListResourceShareAssociations | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListSharedResources | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListSharedTargets | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:DescribeRegions | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListResourceShareInvitations | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:AcceptResourceShareInvitation | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:RejectResourceShareInvitation | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:AssociateResourceSharePermission | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:DisassociateResourceSharePermission | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListResourceSharePermissions | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:GetPermission | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListPermissionVersions | acs:resourcesharing:<region_id>:<account_id>:* |
resourcesharing:ListPermissions | acs:resourcesharing:<region_id>:<account_id>:* |
标签鉴权列表
下表列举了标签中可授权的操作(Action)和资源(Resource)。
Action | Resource |
---|---|
tag:ListTagResources | acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id> |
tag:TagResources |
|
tag:UntagResources |
|
tag:ListTagKeys | acs:tag:<region_id>:<account_id>:*/* |
tag:ListTagValues | acs:tag:<region_id>:<account_id>:*/* |
tag:CreateTags | acs:tag:<region_id>:<account_id>:*/* |
tag:DeleteTag | acs:tag:<region_id>:<account_id>:*/* |