Authorization information-ApsaraMQ for Kafka(Kafka)-阿里云帮助中心

Resource Access Management (RAM) controls access to your Alibaba Cloud resources. Instead of sharing your Alibaba Cloud account AccessKey pair, create RAM users and grant them only the permissions they need.

ApsaraMQ for Kafka defines the following actions and resources for RAM policies. Use these elements to build custom policies and attach them to RAM users or RAM roles.

RAM code: alikafka
Permission granularity: Resource level

Policy structure

A RAM policy is a JSON document with the following structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

Field	Description
Effect	Allows or denies access. Valid values: `Allow`, `Deny`.
Action	One or more operations to allow or deny. See Actions.
Resource	One or more resources specified by Alibaba Cloud Resource Name (ARN). See Resources.

Actions

The following tables map RAM actions to API operations. Use these values in the Action element of your policy.

Column descriptions:

Action: The permission string to use in your policy.
API operation: The API operation that this action authorizes.
Access level: The type of access granted: create, get, update, or delete.
Resource type: The required resource type. Bold text indicates a required type. All resources means resource-level permissions are not supported for this action.
Associated operation: Other actions required to complete the operation.

Instance management

Action	API operation	Access level	Resource type	Condition key	Associated operation
alikafka:CreatePrePayOrder	CreatePrePayOrder	create	Instance `acs:alikafka:{#regionId}:{#accountId}:instance/*`	alikafka:SpecType, alikafka:DeployModule	None
alikafka:StartInstance	StartInstance	update	All resources `*`	alikafka:DeployModule, alikafka:SpecType, alikafka:Acl, alikafka:DiskEncryption	None
alikafka:UpdateInstance	ModifyInstanceName	update	Instance `acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`	None	None
alikafka:ListInstance	GetInstanceList	get	All resources `*`	None	None
alikafka:ListInstance	GetAllInstanceIdList	get	All resources `*`	None	None
alikafka:UpgradePostPayOrder	UpgradePrePayOrder	update	All resources `*`	alikafka:DeployModule	None

Tag operations

Action	API operation	Access level	Resource type	Condition key	Associated operation
alikafka:ListTagResources	ListTagResources	get	All resources `*`	None	None
alikafka:UntagResources	UntagResources	update	All resources `*`	None	None
alikafka:TagResources	TagResources	update	Instance `acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`	None	None

SASL user management

Action	API operation	Access level	Resource type	Condition key	Associated operation
alikafka:CreateSaslUser	CreateSaslUser	create	Instance `acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`	None	None
alikafka:DeleteSaslUser	DeleteSaslUser	delete	Instance `acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`	None	None
alikafka:ListSaslUser	DescribeSaslUsers	get	Instance `acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`	None	None

Resources

Specify resources in the Resource element of your policy using Alibaba Cloud Resource Names (ARNs). The following table lists the ARN formats that ApsaraMQ for Kafka supports.

Replace {#} placeholders with actual values. An asterisk (*) matches all values for a given segment:

{#resourceType} = * matches all resources.
{#regionId} = * matches all regions.
{#accountId} = * matches all Alibaba Cloud accounts.

ARN formats by resource type

The following table lists the ARN format that ApsaraMQ for Kafka (Confluent Edition) supports.

Resource type	ARN format
Instance	`acs:alikafka:{#regionId}:{#accountId}:{#InstanceId}`

Tip: To grant access to a single instance, specify its instance ID in the ARN rather than using a wildcard. Use resource-level ARNs instead of * whenever possible.

What to do next

Create a custom policy, and then attach it to a RAM user, RAM user group, or RAM role: