Grant Browser Monitoring permissions with a custom RAM policy-Application Real-Time Monitoring Service(ARMS)-阿里云帮助中心

When to use a custom policy

ARMS provides system policies that grant coarse-grained permissions. If a system policy meets your RAM authorization requirements, use the system policy instead of creating a custom policy.

Create a custom policy when you need finer-grained control. For example, to control the permissions of a RAM user on a specific application, you must use a custom policy to meet this fine-grained requirement.

Prerequisites

Availability — Custom policies for Browser Monitoring are supported by default if you activated ARMS after 00:00 (UTC+8) on August 26, 2022.
Policy syntax — Before you create a custom policy, familiarize yourself with the basic structure and syntax of RAM policies. See Permission policy elements.

Create a custom policy

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON tab. Write the content of your custom policy in the policy document.
The following example grants read-only permissions on all applications in the China (Hangzhou) region:
```
{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "arms:ReadRumApp"
      ],
      "Resource": "acs:arms:cn-hangzhou:*:armsweb/*",
      "Effect": "Allow",
      "Condition": {
      }
    }
  ]
}
```
For the elements that determine Browser Monitoring permissions, see Policy elements for Browser Monitoring.
At the top of the page, click Optimize, and then click Perform to perform advanced optimization on the policy.
The advanced policy optimization feature performs the following tasks:
- Splits resources or conditions for incompatible actions.
- Narrows the scope of resources.
- Removes duplicate statements or merges statements.
On the Create Policy page, click OK.
In the Create Policy dialog box, enter a policy name and Description, and then click OK.

Grant permissions to a RAM user

Console

The RAM console offers two entry points, both supporting single and batch authorization:

Users page: The principal is auto-selected based on the users you choose. Best for user-centric workflows.
Grants page: You manually select principals and can view all authorization records across your account. Best for permission-centric workflows.

Note

Tip: For large-scale management, add RAM users with identical responsibilities to a user group, then grant permissions to the group. Navigate to Identities > User Groups to manage groups.

From the Users page

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

In the Grant Permission panel, configure the following settings:

Resource scope:
- Account level: Permissions apply to all resources in your Alibaba Cloud account.
- Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
  Note
  1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
  2. For resource group authorization examples, see Control RAM user access to specific ECS instances.
Principal:

The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

Permission policy:

System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name. For example, to grant permissions for financial management (expenses and costs), search for BSS to find AliyunBSSFullAccess (full access to Billing and Cost Management) and other finance-related policies.

The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

Product	System policy name	Access level
Billing and cost management (finance)	`AliyunBSSFullAccess`	Full access
Cloud Monitor	`AliyunCloudMonitorReadOnlyAccess`	Read-only
China Gateway (Website Builder)	`AliyunWebsiteBuildFullAccess`	Full access
Alibaba Cloud DevOps	`AliyunYunxiaoFullAccess`	Full access
Model Studio (Bailian)	`AliyunBailianFullAccess`	Full access
Alibaba Cloud DNS	`AliyunDNSFullAccess`	Full access
SSL Certificates Service	`AliyunYundunCertFullAccess`	Full access
Cloud Phone	`AliyunECDFullAccess`	Full access
Support Center	`AliyunSupportFullAccess`	Full access
Resource Center	`AliyunResourceCenterFullAccess`	Full access
AgentBay	`AliyunAgentBayFullAccess`	Full access
Security Center	`AliyunYundunSASFullAccess`	Full access

If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

Custom policy: You must Create a custom policy before you can grant it.
Pagination limit for select all: The policy list is paginated. Selecting all applies only to the current page. After you switch pages, previously selected policies remain in the selected list, but policies on the new page are not automatically selected; you must select them page by page.
Quickly grant administrator permissions: To grant administrator permissions, search for AdministratorAccess in the search box and select it directly, instead of selecting policies page by page. Selecting this policy triggers a high-risk authorization warning.

(Optional) Description: Enter the authorization reason or scenario for audit purposes.
Click Confirm.

Review the authorization result and click Close.

From the Grants page

Log on to the RAM console.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Grant Permission.
In the Grant Permission panel, select the principal and configure the same settings as described above.
Review the authorization result and click Close.

Note

RAM users created through the Quick Start feature on the RAM console Overview page are automatically granted the corresponding system policy based on the selected scenario, with no manual authorization required:

Super user: Automatically granted the PowerUserAccess policy. This user can manage cloud services and resources, but cannot manage RAM identities and their permissions, resource directories, or billing accounts.
Account administrator: Automatically granted the AdministratorAccess policy. This user can manage all Alibaba Cloud resources, including RAM identities and permissions.

Use these options only when super administrator privileges are truly required. For routine operations, follow the principle of least privilege and grant only the permissions required for the specific task.

OpenAPI

Grant a custom policy

Call CreatePolicy to create a custom policy. For policy syntax, see Permission policy elements and Overview of sample policies.
Call AttachPolicyToUser to grant the policy at the account level (set PolicyType to Custom).

Alternatively, call AttachPolicy to grant the policy at the resource group level.

Grant a system policy

Call AttachPolicyToUser to attach the system policy to the RAM user (set PolicyType to System). For available PolicyName values, see System policy reference System policy reference.
Alternatively, call AttachPolicy to grant the policy at the resource group level.

Policy elements for Browser Monitoring

The following elements determine the Browser Monitoring permissions that a custom policy grants. Use this section as a reference when you write the policy document in Step 1. For a description of each element in a policy document, see Policy element reference.

Effect

Specifies the authorization effect. Valid values: Allow and Deny.

Action

Specifies the operations that the policy applies to. The following table describes the actions that you can specify for Browser Monitoring.

Action	Description
`arms:ReadRumApp`	The read-only permissions on Browser Monitoring, which allow you to view information such as the application overview, session trace, and JS error diagnostics.
`arms:SaveRumApp`	The save permissions on Browser Monitoring, which allow you to create an application in Browser Monitoring.
`arms:DeleteRumApp`	The delete permissions on Browser Monitoring, which allow you to delete an application in Browser Monitoring.

Resource

Specifies the objects on which the permissions are granted. Use the following format:

"Resource": [
     "acs:arms:<regionid>:*:armsweb/<appname>"
 ]

Replace <regionid> with the ID of the specified region. If the permissions apply to all regions, replace it with *.
Replace <appname> with the specified application name. If the permissions apply to all applications, replace it with *. If the permissions apply to applications that share the same name prefix, replace it with name prefix*, for example, test*.