RAM authentication
ApsaraMQ for MQTT uses Alibaba Cloud Resource Access Management (RAM) for permission management. RAM lets you avoid sharing your Alibaba Cloud account's AccessKey, which consists of an AccessKey ID and an AccessKey secret. Instead, you can assign permissions to users based on the principle of least privilege. Before a RAM user can call an Alibaba Cloud OpenAPI, the root account must create an authorization policy to grant permissions to the RAM user.
Mapping rules for resources and actions in ApsaraMQ for MQTT
In ApsaraMQ for MQTT, resource types include instances, topics, groups, and rules. The permissions that are granted on these resources are called actions. For more information about the format of resources, see Resources.
Authorizable ApsaraMQ for MQTT OpenAPI operations
The following table lists the authorizable OpenAPI operations in ApsaraMQ for MQTT and their action descriptions.
To call the OpenAPI operations of ApsaraMQ for MQTT, you must have the `mq:MqttInstanceAccess` permission to access ApsaraMQ for MQTT instances.
For more information, see Access policy.
API | Resource naming format (for instances without namespaces) | Resource naming format (for instances with namespaces) | Action description |
RevokeToken |
|
Important In the format, storeInstanceId is the ID of the persistent instance that is bound to the ApsaraMQ for MQTT instance. You can obtain the ID of the persistent instance on the Instance Details page in the ApsaraMQ for MQTT console. |
|
QueryToken |
| ||
ApplyToken |
| ||
CreateGroupId |
| ||
DeleteGroupId |
| ||
ListGroupId |
|