Authorization information-Container Service for Kubernetes(ACK)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by ADCP for RAM permission policies. The RAM code (RamCode) for ADCP is ADCP , and the supported authorization granularity is resource-level .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by ACK Distributed Cloud Container Platform. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
adcp:DeleteComponentBaseline	Deletes a component baseline.	Write	all resources ``	None	None
adcp:CheckServiceRole	Checks a service role.	Read	all resources ``	None	None
adcp:DescribePolicies	Describes policies.	List	all resources ``	None	None
adcp:DescribePolicyInstancesStatus	Describes the status of policy instances.	List	all resources ``	None	None
adcp:DescribeComponentBaselineDeployJobDetail	Describes the details of a component baseline deployment job.	Read	all resources ``	None	None
adcp:CreateComponentBaseline	Creates a component baseline.	Write	all resources ``	None	None
adcp:CreateComponentBaselineDeployJob	Creates a component baseline deployment job.	Write	all resources ``	None	None
adcp:DeleteUserPermission	Deletes a user's permissions.	Permissions management	all resources ``	None	None
adcp:CreateHubCluster	Creates a hub cluster.	Write	cluster `acs:adcp:{#regionId}:{#accountId}:cluster/`	None	None
adcp:AbortComponentBaselineDeployJob	Aborts a component baseline deployment job.	Write	all resources ``	None	None
adcp:ComponentBaselinePreCheck	Performs a pre-check on a component baseline.	Read	all resources ``	None	None
adcp:DetachClusterFromHub	Detaches a cluster from a hub.	Write	all resources ``	None	None
adcp:ResumeComponentBaselineDeployJob	Resumes a component baseline deployment job.	Write	all resources ``	None	None
adcp:ListTagResources	Lists tags for one or more resources.	List	all resources ``	None	None
adcp:DeployPolicyInstance	Deploys a policy instance.	Write	all resources ``	None	None
adcp:RollbackComponentBaselineDeployBatch	Rolls back a component baseline deployment batch.	Write	all resources ``	None	None
adcp:UpdateUserPermission	Updates a user's permissions.	Permissions management	all resources ``	None	None
adcp:UntagResources	Removes tags from one or more resources.	Tagging	all resources ``	None	None
adcp:UpdateComponentBaseline	Updates a component baseline.	Write	all resources ``	None	None
adcp:DeleteHubCluster	Deletes a hub cluster.	Write	*cluster `acs:adcp:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
adcp:DescribePolicyGovernanceInCluster	Describes policy governance within a cluster.	List	all resources ``	None	None
adcp:GrantUserPermission	Grants permissions to a user.	Permissions management	all resources ``	None	None
adcp:UpdateHubClusterFeature	Updates a feature of a hub cluster.	Write	all resources ``	None	None
adcp:AbortComponentBaselineDeployBatch	Aborts a component baseline deployment batch.	Write	all resources ``	None	None
adcp:ChangeResourceGroup	Changes the resource group of a resource.	Write	all resources ``	None	None
adcp:DescribeHubClusterLogs	Describes the logs for a hub cluster.	List	all resources ``	None	None
adcp:StartComponentBaselineDeployJob	Starts a component baseline deployment job.	Write	all resources ``	None	None
adcp:DescribePolicyDetails	Describes the details of a policy.	Read	all resources ``	None	None
adcp:CheckSLRExists	Checks if a service-linked role (SLR) exists.	Read	all resources ``	None	None
adcp:UpdateClusterTags	Updates the tags of a cluster.	Tagging	all resources ``	None	None
adcp:DeletePolicyInstance	Deletes a policy instance.	Write	all resources ``	None	None
adcp:DescribeHubClusterKubeconfig	Retrieves the Kubeconfig file for a hub cluster.	Read	all resources ``	None	None
adcp:DescribePolicyInstances	Describes policy instances.	List	all resources ``	None	None
adcp:DescribeManagedClusters	Describes managed clusters.	List	all resources ``	None	None
adcp:SuspendComponentBaselineDeployJob	Suspends a component baseline deployment job.	Write	all resources ``	None	None
adcp:DescribeComponentListOfHubCluster	Lists the components for a hub cluster.	List	all resources ``	None	None
adcp:DescribeComponentBaselines	Describes component baselines.	List	all resources ``	None	None
adcp:DescribeUserPermissions	Describes a user's permissions.	List	all resources ``	None	None
adcp:DescribeClusterEvents	Describes cluster events.	List	all resources ``	None	None
adcp:StartComponentBaselineDeployBatch	Starts a component baseline deployment batch.	Write	all resources ``	None	None
adcp:DescribeHubClusters	Describes hub clusters.	List	cluster `acs:adcp::{#accountId}:cluster/`	None	None
adcp:TagResources	Adds tags to one or more resources.	Tagging	all resources ``	None	None
adcp:DescribeComponentBaselineDetail	Describes the details of a component baseline.	Read	all resources ``	None	None
adcp:AttachClusterToHub	Attaches a cluster to a hub.	Write	all resources ``	None	None
adcp:DeleteComponentBaselineDeployJob	Deletes a component baseline deployment job.	Write	all resources ``	None	None
adcp:DescribeHubClusterDetails	Describes the details of a hub cluster.	Read	*cluster `acs:adcp:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
adcp:DescribeComponentBaselineDeployJobs	Describes component baseline deployment jobs.	List	all resources ``	None	None
adcp:GrantUserPermissions	Assigns multiple permissions to a user.	Permissions management	all resources ``	None	None

Resource

The following table lists the resources defined by Alibaba Cloud Distributed Cloud Container Platform. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Cluster	acs:adcp:{#regionId}:{#accountId}:cluster/* acs:adcp:{#regionId}:{#accountId}:cluster/{#ClusterId} acs:adcp::{#accountId}:cluster/*

Condition

Alibaba Cloud Distributed Cloud Container Platform does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: