RAM authentication
Alibaba Cloud provides Resource Access Management (RAM) for you to manage permissions on ApsaraMQ for MQTT. If you use RAM, you do not need to share the AccessKey pair of your Alibaba Cloud account with other users. You can grant the users only the required permissions. An AccessKey pair consists of an AccessKey ID and an AccessKey secret. Before you call an Alibaba Cloud API operation as a RAM user, you must use an Alibaba Cloud account to create an authorization policy to grant permissions to the RAM user.
Mappings between resources and actions in ApsaraMQ for MQTT
In ApsaraMQ for MQTT, resource types include instances, topics, groups, and rules. The permissions that are granted on these resources are called actions. For more information about the format of resources, see Resources.
API operations that can be authorized to RAM users
The following table describes the ApsaraMQ for MQTT API operations that can be authorized to RAM users.
To access ApsaraMQ for MQTT API operations, you must obtain the permissions to access ApsaraMQ for MQTT instances. The action for the permissions is mq:MqttInstanceAccess.
For more information, see Policies.
API | Resource naming format | Resource naming example | Action description |
acs:mq:*:*:* | acs:mq:*:*:* |
| |
acs:mq:*:*:* | acs:mq:*:*:* |
| |
|
|
| |
| |||
|
|
| |
| |||
| |||
|
|
| |
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
Instance: acs:mq:*:*:instance/{mqttInstanceId} | Instance: acs:mq:*:*:instance/post-cn-09k1noy**** |
| |
| |||
Instance: acs:mq:*:*:instance/{mqttInstanceId} | Instance: acs:mq:*:*:instance/post-cn-09k1noy**** |
| |
| |||
| |||
| |||
| |||
| |||
| |||
Instance: acs:mq:*:*:instance/{mqttInstanceId} | Instance: acs:mq:*:*:instance/post-cn-09k1noy**** |
| |
| |||
| |||
| |||
| |||
| |||
Instance: acs:mq:*:*:instance/{mqttInstanceId} | Instance: acs:mq:*:*:instance/post-cn-09k1noy**** |
| |
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
| |||
CreateTopic |
|
|
|
ListTopics |
| ||
DeleteTopic |
| ||
UpdateTopic |
| ||
UpdateMqttOutboundRule |
|
|
|
CreateMqttInboundRule |
| ||
DeleteMqttOutboundRule |
| ||
UpdateClientStatusNotifyRule |
| ||
ListClientStatusNotifyRuleInPages |
| ||
ListMqttInboundRuleInPages |
| ||
DeleteClientStatusNotifyRule |
| ||
CreateClientStatusNotifyRule |
| ||
CreateMqttOutboundRule |
| ||
UpdateMqttInboundRule |
| ||
DeleteMqttInboundRule |
| ||
ListMqttOutboundRuleInPages |
|