RAM authorization-API Gateway(API Gateway)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by API Gateway for RAM permission policies. The RAM code (RamCode) for API Gateway is apig , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by API Gateway. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
apig:CreatePolicy	CreatePolicy	none	All Resource ``	None	None
apig:BatchDeleteConsumerAuthorizationRule	BatchDeleteConsumerAuthorizationRule	none	All Resource ``	None	None
apig:ImportHttpApi	ImportHttpApi	none	All Resource ``	None	None
apig:DeleteSource	DeleteSource	none	*Source `acs:apig:{#regionId}:{#accountId}:source/{#SourceId}`	None	None
apig:DeleteHttpApiRoute	DeleteHttpApiRoute	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:UpdateSecret	UpdateSecret	none	*Domain `acs:apig:{#regionId}:{#accountId}:secret/{#SecretId}`	None	None
apig:ListMcpServers	ListMcpServers	none	All Resource ``	None	None
apig:UnDeployMcpServer	UnDeployMcpServer	none	All Resource ``	None	None
apig:CreatePolicyAttachment	CreatePolicyAttachment	create	All Resource ``	None	None
apig:GetSecret	GetSecret	none	*Domain `acs:apig:{#regionId}:{#accountId}:secret/{#SecretId}`	None	None
apig:GetPolicy	GetPolicy	get	*Policy `acs:apig:{#regionId}:{#accountId}:policy/{#PolicyId}`	None	None
apig:CreateHttpApiOperation	CreateHttpApiOperation	create	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:UpdateGatewayName	UpdateGatewayName	update	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:ExportHttpApi	ExportHttpApi	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:CreateConsumerAuthorizationRules	CreateConsumerAuthorizationRules	none	All Resource ``	None	None
apig:GetDashboard	GetDashboard	get	All Resource ``	None	None
apig:CreatePluginAttachment	CreatePluginAttachment	none	All Resource ``	None	None
apig:ListGateways	ListGateways	list	Gateway `acs:apig:{#regionId}:{#accountId}:gateway/`	None	None
apig:DeployMcpServer	DeployMcpServer	none	All Resource ``	None	None
apig:ListPolicyClasses	ListPolicyClasses	none	All Resource ``	None	None
apig:CreateHttpApi	CreateHttpApi	create	HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/`	None	None
apig:UpdateGatewayFeature	UpdateGatewayFeature	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:UpdateAndAttachPolicy	UpdateAndAttachPolicy	none	*Policy `acs:apig:{#regionId}:{#accountId}:policy/{#PolicyId}`	None	None
apig:GetTraceConfig	GetTraceConfig	get	All Resource ``	None	None
apig:UpdateConsumer	UpdateConsumer	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:ListDomains	ListDomains	none	Domain `acs:apig:{#regionId}:{#accountId}:domain/`	None	None
apig:GetHttpApi	GetHttpApi	get	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:InstallPlugin	InstallPlugin	none	All Resource ``	None	None
apig:ListPluginClasses	ListPluginClasses	none	All Resource ``	None	None
apig:DeleteGateway	DeleteGateway	delete	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:ListConsumerAuthorizationRules	ListConsumerAuthorizationRules	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:DeleteConsumer	DeleteConsumer	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:ListZones	ListZones	none	All Resource ``	None	None
apig:DeleteDomain	DeleteDomain	none	*Domain `acs:apig:{#regionId}:{#accountId}:domain/{#DomainId}`	None	None
apig:UpgradeGateway	UpgradeGateway	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:CreateHttpApiRoute	CreateHttpApiRoute	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetDomain	GetDomain	get	*Domain `acs:apig:{#regionId}:{#accountId}:domain/{#DomainId}`	None	None
apig:DeletePluginAttachment	DeletePluginAttachment	none	All Resource ``	None	None
apig:UpdateMcpServer	UpdateMcpServer	none	All Resource ``	None	None
apig:GetHttpApiOperation	GetHttpApiOperation	get	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:ListPluginAttachments	ListPluginAttachments	none	All Resource ``	None	None
apig:DeletePolicyAttachment	DeletePolicyAttachment	delete	All Resource ``	None	None
apig:GetEnvironment	GetEnvironment	none	*Environment `acs:apig:{#regionId}:{#accountId}:environment/{#EnvironmentId}`	None	None
apig:DeleteService	DeleteService	none	*Service `acs:apig:{#regionId}:{#accountId}:service/{#ServiceId}`	None	None
apig:CreateDomain	CreateDomain	create	Domain `acs:apig:{#regionId}:{#accountId}:domain/`	None	None
apig:UpdateDomain	UpdateDomain	none	*Domain `acs:apig:{#regionId}:{#accountId}:domain/{#DomainId}`	None	None
apig:QueryConsumerAuthorizationRules	QueryConsumerAuthorizationRules	none	All Resource ``	None	None
apig:CreateConsumer	CreateConsumer	create	All Resource ``	None	None
apig:UpdateHttpApiOperation	UpdateHttpApiOperation	update	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetHttpApiRoute	GetHttpApiRoute	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:CreateAndAttachPolicy	CreateAndAttachPolicy	none	Policy `acs:apig:{#regionId}:{#accountId}:policy/`	None	None
apig:RestartGateway	RestartGateway	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:RemoveConsumerAuthorizationRule	RemoveConsumerAuthorizationRule	none	All Resource ``	None	None
apig:UpdateHttpApiRoute	UpdateHttpApiRoute	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetPluginAttachment	GetPluginAttachment	get	All Resource ``	None	None
apig:CreateSource	CreateSource	none	All Resource ``	None	None
apig:CreateConsumerAuthorizationRule	CreateConsumerAuthorizationRule	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:UninstallPlugin	UninstallPlugin	none	All Resource ``	None	None
apig:ChangeResourceGroup	ChangeResourceGroup	none	All Resource ``	None	None
apig:ListPolicies	ListPolicies	none	All Resource ``	None	None
apig:CreateEnvironment	CreateEnvironment	none	Environment `acs:apig:{#regionId}:{#accountId}:environment/`	None	None
apig:GetSecretValue	GetSecretValue	none	All Resource ``	None	None
apig:UpdatePolicy	UpdatePolicy	update	All Resource ``	None	None
apig:GetPolicyAttachment	GetPolicyAttachment	get	All Resource ``	None	None
apig:GetSource	GetSource	get	All Resource ``	apig:GatewayId	None
apig:DeleteSecret	DeleteSecret	none	*Domain `acs:apig:{#regionId}:{#accountId}:secret/{#SecretId}`	None	None
apig:ListHttpApiRoutes	ListHttpApiRoutes	list	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetService	GetService	none	*Service `acs:apig:{#regionId}:{#accountId}:service/{#ServiceId}`	apig:GatewayId	None
apig:CreateMcpServer	CreateMcpServer	none	All Resource ``	None	None
apig:CreateGateway	CreateGateway	create	Gateway `acs:apig:{#regionId}:{#accountId}:gateway/`	None	None
apig:SyncMCPServers	SyncMCPServers	none	All Resource ``	None	None
apig:GetMcpServer	GetMcpServer	none	All Resource ``	None	None
apig:ListGatewayFeatures	ListGatewayFeatures	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:CreateServiceVersion	CreateServiceVersion	create	All Resource ``	None	None
apig:ListHttpApis	ListHttpApis	list	HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/`	None	None
apig:UpdateEnvironment	UpdateEnvironment	none	*Environment `acs:apig:{#regionId}:{#accountId}:environment/{#EnvironmentId}`	None	None
apig:GetResourceOverview	GetResourceOverview	get	All Resource ``	None	None
apig:ListSecretReferences	ListSecretReferences	list	*Domain `acs:apig:{#regionId}:{#accountId}:secret/{#SecretId}`	None	None
apig:ListSslCerts	ListSslCerts	none	All Resource ``	None	None
apig:UpdateServiceVersion	UpdateServiceVersion	update	*Service `acs:apig:{#regionId}:{#accountId}:service/{#ServiceId}`	None	None
apig:UpdateService	UpdateService	none	*Service `acs:apig:{#regionId}:{#accountId}:service/{#ServiceId}`	None	None
apig:DeleteGatewaySecurityGroupRule	DeleteGatewaySecurityGroupRule	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:ListConsumers	ListConsumers	list	All Resource ``	None	None
apig:ListSecrets	ListSecrets	list	All Resource ``	None	None
apig:UpdateHttpApi	UpdateHttpApi	update	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:CreateSecret	CreateSecret	create	All Resource ``	None	None
apig:DeleteHttpApi	DeleteHttpApi	delete	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:CreateService	CreateService	none	Service `acs:apig:{#regionId}:{#accountId}:service/`	None	None
apig:UpdateConsumerAuthorizationRule	UpdateConsumerAuthorizationRule	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:ListPlugins	ListPlugins	none	All Resource ``	None	None
apig:UpdatePluginAttachment	UpdatePluginAttachment	none	All Resource ``	None	None
apig:GetGateway	GetGateway	get	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:DeletePolicy	DeletePolicy	delete	All Resource ``	None	None
apig:UndeployHttpApi	UndeployHttpApi	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:DeleteMcpServer	DeleteMcpServer	none	All Resource ``	None	None
apig:DeleteServiceVersion	DeleteServiceVersion	delete	*Service `acs:apig:{#regionId}:{#accountId}:service/{#ServiceId}`	None	None
apig:DeleteConsumerAuthorizationRule	DeleteConsumerAuthorizationRule	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:ListEnvironments	ListEnvironments	list	Environment `acs:apig:{#regionId}:{#accountId}:environment/`	None	None
apig:DeployHttpApi	DeployHttpApi	none	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetConsumerAuthorizationRule	GetConsumerAuthorizationRule	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:ListServices	ListServices	none	Service `acs:apig:{#regionId}:{#accountId}:service/`	None	None
apig:AddGatewaySecurityGroupRule	AddGatewaySecurityGroupRule	none	*Gateway `acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId}`	None	None
apig:DeleteHttpApiOperation	DeleteHttpApiOperation	delete	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None
apig:GetConsumer	GetConsumer	none	*Domain `acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId}`	None	None
apig:DeleteEnvironment	DeleteEnvironment	none	*Environment `acs:apig:{#regionId}:{#accountId}:environment/{#EnvironmentId}`	None	None
apig:ListHttpApiOperations	ListHttpApiOperations	list	*HttpApi `acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}`	None	None

Resource

The following table lists the resources defined by API Gateway. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Policy	acs:apig:{#regionId}:{#accountId}:policy/* acs:apig:{#regionId}:{#accountId}:policy/{#PolicyId}
ConsumerAuthorizationRule	acs:apig:{#regionId}:{#accountId}:consumerauthorizationrule/*
HttpApi	acs:apig:{#regionId}:{#accountId}:httpapi/* acs:apig:{#regionId}:{#accountId}:httpapi/{#HttpApiId}
Source	acs:apig:{#regionId}:{#accountId}:source/{#SourceId} acs:apig:{#regionId}:{#accountId}:source/{SourceId]
Domain	acs:apig:{#regionId}:{#accountId}:secret/{#SecretId} acs:apig:{#regionId}:{#accountId}:consumer/{#ConsumerId} acs:apig:{#regionId}:{#accountId}:domain/* acs:apig:{#regionId}:{#accountId}:domain/{#DomainId} acs:apig:{#regionId}:{#accountId}:consumer/* acs:apig:{#regionId}:{#accountId}:secret/*
Gateway	acs:apig:{#regionId}:{#accountId}:gateway/{#GatewayId} acs:apig:{#regionId}:{#accountId}:gateway/*
Environment	acs:apig:{#regionId}:{#accountId}:environment/{#EnvironmentId} acs:apig:{#regionId}:{#accountId}:environment/*
Service	acs:apig:{#regionId}:{#accountId}:service/{#ServiceId} acs:apig:{#regionId}:{#accountId}:service/*

Condition

The following table lists the product-level condition keys defined by API Gateway. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
apig:GatewayId	Gateway Id	Array
apig:NetworkType	network type	Array

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: