Cloud-native API Gateway system policy reference
Cloud-native API Gateway provides system policies that you can attach to Resource Access Management (RAM) identities to grant permissions.
What are system policies
An access policy is a set of permissions that defines the authorized resources, operations, and conditions. RAM provides two types of access policies: system policies and custom policies. Alibaba Cloud creates and maintains system policies, which you can use but cannot modify. You create and manage custom policies yourself. As API Gateway evolves, new permissions are added to system policies to support new features. Updates to a system policy affect all attached RAM identities, including RAM users, RAM user groups, and RAM roles. For more information, see Overview of access policies.
Product system policies are a quick way to grant access to the product and its dependent products from the console. They also apply to OpenAPI and CLI access. For better security, use custom policies to grant only the specific API permissions that users and applications need.
System policies are categorized into product system policies, server role policies, and service-linked role policies. Not all cloud products support every type. Only the policy types that apply to Cloud-native API Gateway are listed below.
Product system policies
AliyunAPIGFullAccess
Grant this policy to a RAM identity to allow full management of Cloud-native API Gateway.
AliyunAPIGReadOnlyAccess
Grant this policy to a RAM identity to allow read-only access to Cloud-native API Gateway.
Service-linked role policy
AliyunServiceRolePolicyForNativeApiGw
API Gateway uses the service-linked role AliyunServiceRoleForNativeApiGw to access your resources in other cloud products. AliyunServiceRolePolicyForNativeApiGw is the authorization policy attached to this role. API Gateway defines and manages this policy. You cannot modify or delete it, and you must not grant it to any other RAM identity.
Authorization operation reference
By default, a RAM identity has no permissions. An Alibaba Cloud account administrator must explicitly grant permissions before a RAM identity can access resources. Follow the Principle of Least Privilege (PoLP) and grant only the permissions that each identity requires. For more information, see the following topics: