在使用RAM账号调用区块链服务API前，需要主账号通过创建授权策略对RAM账号进行授权。在授权策略中，使用资源描述符（Alibaba Cloud Resource Name，ARN）指定授权资源。

本文提供了在区块链服务中通过访问控制实现团队或者部门成员鉴权、跨账号资源授权以及跨云服务授权的RAM鉴权规则。在了解如何使用访问控制RAM授权和访问区块链服务之前，确保您已阅读了RAM产品文档和RAM API 文档。

可授权的Hyperledger Fabric资源类型

在进行RAM子账号授权时，Hyperledger Fabric资源的描述方式如下：

资源类型授权策略中的资源描述方法
联盟acs:baas:$regionId:$accountId:consortium/$consortiumId
组织acs:baas:$regionId:$accountId:organization/$organizationId
通道acs:baas:*:$accountId:channel/$channelId
链码acs:baas:*:$accountId:chaincode/$chaincodeId

其中，$regionId为具体资源所在的region。$accountId为具体资源属主的阿里云云账号Id。$consortiumId/$organizationId/$channelId/$chaincodeId为具体资源在区块链服务中的资源Id。

说明 通道和链码属于全局资源，region必须为“*”。

可授权的Hyperledger Fabric接口

下表列举了Hyperledger Fabric区块链中默认授权的API（子账号以及STS Token持有者默认拥有权限）：

API
CheckFabricConsortiumDomain
CheckFabricOrganizationDomain
DescribeTasks
DescribeRootDomain
DescribeFabricConsortiumConfig
DescribeFabricConsortiumSpecs
DescribeFabricOrganizationSpecs
DescribeFabricInviter
DescribeFabricChaincodeUploadPolicy
AcceptFabricInvitation

下表列举了Hyperledger Fabric中可授权的API及其描述方式：

API资源描述
CreateFabricOrganizationacs:baas:$regionId:$accountId:organization/*
DescribeFabricOrganizationacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationDeletableacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationsacs:baas:*:$accountId:organization/*
DescribeFabricCandidateOrganizationsacs:baas:*:$accountId:organization/*
CreateFabricChannelacs:baas:*:$accountId:channel/*

acs:baas:$regionId:$accountId:consortium/$consortiumId

DescribeFabricOrganizationChannelsacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumChannelsacs:baas:$regionId:$accountId:consortium/$consortiumId
CreateFabricChannelMemberacs:baas:*:$accountId:channel/$channelId
DescribeFabricChannelMembersacs:baas:*:$accountId:channel/$channelId
JoinFabricChannelacs:baas:*:$accountId:channel/$channelId
CreateFabricConsortiumacs:baas:$regionId:$accountId:consortium/*
CreateFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
ConfirmFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricOrganizationMembersacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationPeersacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumsacs:baas:*:$accountId:consortium/*
DescribeFabricConsortiumAdminStatusacs:baas:*:$accountId:consortium/*
DescribeFabricConsortiumMembersacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumMemberApprovalacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumOrderersacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumDeletableacs:baas:$regionId:$accountId:consortium/$consortiumId
CreateFabricChaincodeacs:baas:*:$accountId:chaincode/*

acs:baas:*:$accountId:channel/$channelId

acs:baas:$regionId:$accountId:consortium/$consortiumId

acs:baas:$regionId:$accountId:organization/$organizationId

DescribeFabricOrganizationChaincodesacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumChaincodesacs:baas:$regionId:$accountId:consortium/$consortiumId
DeleteFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId
InstallFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

InstantiateFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

UpgradeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

SynchronizeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

CreateFabricOrganizationUseracs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationUsersacs:baas:$regionId:$accountId:organization/$organizationId
ResetFabricOrganizationUserPasswordacs:baas:$regionId:$accountId:organization/$organizationId
DownloadFabricOrganizationSDKacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricInvitationCodeacs:baas:$regionId:$accountId:consortium/$consortiumId

Hyperledger Fabric RAM规则示例

例1 ：授权BaaS服务只读类操作。这种类型的权限能够允许用户通过控制台或API查看区块链状态，下载SDK。

{
   "Statement": [{ 
       "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
       "Effect": "Allow",
       "Resource": "acs:baas:*:*:*"
   }],
   "Version": "1"
}
例2：授权链码管理类操作（上传、安装、实例化等等）。这种类型的权限允许用户通过控制台或API管理所有链码。 
{
  "Statement": [{
     "Action": "baas:*Chaincode",
     "Effect": "Allow",
     "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/*", "acs:baas:*:*:consortium/*","acs:baas:*:*:channel/*"]
  }],
  "Version": "1"
}

例3：更精细化的链码开发者授权。该权限通常需要全部的读类型操作，以及特定组织的链码管理类操作。按照最小权限原则，需要限制该用户仅能创建用于指定联盟、组织、通道的链码，也只能在特定组织上进行链码的安装、实例化等操作。将下面的$consortiumId/$organizationId/$channelId替换为具体资源在区块链服务中的资源Id。

{
 "Statement": [{
   "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
   "Effect": "Allow",
   "Resource": "acs:baas:*:*:*"
 },
 {
   "Action": "baas:*Chaincode",
   "Effect": "Allow",
   "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/$organizationId","acs:baas:*:*:consortium/$consortiumId","acs:baas:*:*:channel/$channelId"]
 }],
 "Version": "1"
}