RAM authorization-Alibaba Cloud Service Mesh-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Service Mesh for RAM permission policies. The RAM code (RamCode) for Service Mesh is servicemesh , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Service Mesh. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
servicemesh:InvokeApiServer	InvokeApiServer		All Resource ``	None	None
servicemesh:GrantUserPermissions	GrantUserPermissions	get	All Resource ``	None	None
servicemesh:DescribePluginConfig	DescribePluginConfig		All Resource ``	None	None
servicemesh:DescribeServiceMeshGatewayPodStatus	DescribeServiceMeshGatewayPodStatus	list	All Resource ``	None	None
servicemesh:DescribeVMsInServiceMesh	DescribeVMsInServiceMesh	get	All Resource ``	None	None
servicemesh:AddMeshTagToEcs	AddMeshTagToEcs	none	All Resource ``	None	None
servicemesh:DeleteSwimLane	DeleteSwimLane	delete	All Resource ``	None	None
servicemesh:DescribeClusterGrafana	DescribeClusterGrafana	get	All Resource ``	None	None
servicemesh:UpdateMeshForCancelCanary	UpdateMeshForCancelCanary		All Resource ``	None	None
servicemesh:DescribeExtensionProvider	DescribeExtensionProvider		All Resource ``	None	None
servicemesh:DescribeReusableSlb	DescribeReusableSlb	get	All Resource ``	None	None
servicemesh:AddVMIntoServiceMesh	AddVMIntoServiceMesh	create	All Resource ``	None	None
servicemesh:GetKialiAddress	GetKialiAddress		All Resource ``	None	None
servicemesh:DescribeIstioGatewayRouteDetail	DescribeIstioGatewayRouteDetail	get	All Resource ``	None	None
servicemesh:DescribeEnvoyFilterTemplateInfo	DescribeEnvoyFilterTemplateInfo		All Resource ``	None	None
servicemesh:DescribeAvailableNacosInstances	DescribeAvailableNacosInstances		All Resource ``	None	None
servicemesh:DescribeWorkloadASMProxyConfigList	DescribeWorkloadASMProxyConfigList		All Resource ``	None	None
servicemesh:DescribeGuestClusterPods	DescribeGuestClusterPods	get	All Resource ``	None	None
servicemesh:CheckProductActiveStatus	CheckProductActiveStatus	none	All Resource ``	None	None
servicemesh:DescribeManagedServices	DescribeManagedServices		All Resource ``	None	None
servicemesh:CreateOrUpdateSwimLaneIngressRule	CreateOrUpdateSwimLaneIngressRule	update	All Resource ``	None	None
servicemesh:UpdateGuestClusterConfig	UpdateGuestClusterConfig	update	All Resource ``	None	None
servicemesh:DescribeGuestClusterNamespaces	DescribeGuestClusterNamespaces	get	All Resource ``	None	None
servicemesh:GetSwimLaneDetail	GetSwimLaneDetail	get	All Resource ``	None	None
servicemesh:DescribeNodesInstanceType	DescribeNodesInstanceType	get	All Resource ``	None	None
servicemesh:DescribeVpcs	DescribeVpcs	get	All Resource ``	None	None
servicemesh:GetRegisteredServices	GetRegisteredServices	list	All Resource ``	None	None
servicemesh:UpdateNamespaceScopeSidecarConfig	UpdateNamespaceScopeSidecarConfig	update	All Resource ``	None	None
servicemesh:DescribeMeshWorkloadVersionStatus	DescribeMeshWorkloadVersionStatus	get	All Resource ``	None	None
servicemesh:DescribePluginGuide	DescribePluginGuide		All Resource ``	None	None
servicemesh:GetVmMeta	GetVmMeta	get	All Resource ``	None	None
servicemesh:CreateServiceMesh	CreateServiceMesh	create	All Resource ``	None	None
servicemesh:CreateSwimLane	CreateSwimLane	create	All Resource ``	None	None
servicemesh:UpdateMeshAdaptiveXds	UpdateMeshAdaptiveXds		All Resource ``	None	None
servicemesh:DeleteGatewaySecret	DeleteGatewaySecret	delete	All Resource ``	None	None
servicemesh:ModifyPilotEipResource	ModifyPilotEipResource	update	All Resource ``	None	None
servicemesh:UpdateMeshMultiClusterNetwork	UpdateMeshMultiClusterNetwork	update	All Resource ``	None	None
servicemesh:CreateKialiRAMIntegration	CreateKialiRAMIntegration		All Resource ``	None	None
servicemesh:DescribeIstioGatewayDomains	DescribeIstioGatewayDomains	get	All Resource ``	None	None
servicemesh:DescribeVersionManagement	DescribeVersionManagement		All Resource ``	None	None
servicemesh:DescribeASMGatewayImportedServices	DescribeASMGatewayImportedServices	get	All Resource ``	None	None
servicemesh:GetBuiltinEnvoyFilterCatalog	GetBuiltinEnvoyFilterCatalog	none	All Resource ``	None	None
servicemesh:ModifyApiServerEipResource	ModifyApiServerEipResource	update	All Resource ``	None	None
servicemesh:DescribeServiceMeshPermissions	DescribeServiceMeshPermissions		All Resource ``	None	None
servicemesh:DescribeMeshMultiClusterNetwork	DescribeMeshMultiClusterNetwork	get	All Resource ``	None	None
servicemesh:DescribeMeshSlbMetricAlertRules	DescribeMeshSlbMetricAlertRules		All Resource ``	None	None
servicemesh:DescribeCens	DescribeCens	none	All Resource ``	None	None
servicemesh:DescribeServiceMeshGatewaySLBStatus	DescribeServiceMeshGatewaySLBStatus	none	All Resource ``	None	None
servicemesh:DeleteTelemetryConfiguration	DeleteTelemetryConfiguration		All Resource ``	None	None
servicemesh:GetObservabilityStatus	GetObservabilityStatus		All Resource ``	None	None
servicemesh:DescribeMetadata	DescribeMetadata	get	All Resource ``	None	None
servicemesh:DescribeControlPlaneLogAlertRules	DescribeControlPlaneLogAlertRules		All Resource ``	None	None
servicemesh:GetRegisteredServiceEndpoints	GetRegisteredServiceEndpoints	get	All Resource ``	None	None
servicemesh:GetGrafanaDashboardUrl	GetGrafanaDashboardUrl	get	All Resource ``	None	None
servicemesh:DescribeAvailablePlugins	DescribeAvailablePlugins		All Resource ``	None	None
servicemesh:UpdateKServeConfig	UpdateKServeConfig	update	All Resource ``	None	None
servicemesh:UpdateDeploymentRedeployTime	UpdateDeploymentRedeployTime		All Resource ``	None	None
servicemesh:DescribeServiceAccessDetail	DescribeServiceAccessDetail		All Resource ``	None	None
servicemesh:GetRegisteredDeployments	GetRegisteredDeployments	list	All Resource ``	None	None
servicemesh:DescribeServiceMeshVMs	DescribeServiceMeshVMs	get	All Resource ``	None	None
servicemesh:GetCaCert	GetCaCert	get	All Resource ``	None	None
servicemesh:DescribeGatewaySecretDetails	DescribeGatewaySecretDetails	get	All Resource ``	None	None
servicemesh:DescribeCCMVersion	DescribeCCMVersion	get	All Resource ``	None	None
servicemesh:GetAutoInjectionLabelSyncStatus	GetAutoInjectionLabelSyncStatus		All Resource ``	None	None
servicemesh:UpdateSwimLane	UpdateSwimLane	update	All Resource ``	None	None
servicemesh:UpgradeASMGatewayInCanary	UpgradeASMGatewayInCanary		All Resource ``	None	None
servicemesh:DescribeRecommendedSidecar	DescribeRecommendedSidecar		All Resource ``	None	None
servicemesh:CreateWaypoint	CreateWaypoint	none	All Resource ``	None	None
servicemesh:UpdateKialiConfiguration	UpdateKialiConfiguration	update	All Resource ``	None	None
servicemesh:GetDiagnosis	GetDiagnosis		All Resource ``	None	None
servicemesh:DescribeServiceMeshProxyStatus	DescribeServiceMeshProxyStatus	get	All Resource ``	None	None
servicemesh:DescribeKialiRAMIntegrationStatus	DescribeKialiRAMIntegrationStatus		All Resource ``	None	None
servicemesh:UpdateControlPlaneLogConfig	UpdateControlPlaneLogConfig		All Resource ``	None	None
servicemesh:ModifyServiceMesh	ModifyServiceMesh		All Resource ``	None	None
servicemesh:UpgradeMeshEditionPartially	UpgradeMeshEditionPartially	update	All Resource ``	None	None
servicemesh:GetCanaryUpgradeVersions	GetCanaryUpgradeVersions		All Resource ``	None	None
servicemesh:DescribeServiceMeshKubeconfig	DescribeServiceMeshKubeconfig	get	All Resource ``	None	None
servicemesh:RevokeKubeconfig	RevokeKubeconfig	update	All Resource ``	None	None
servicemesh:DescribeServiceSidecarInjectStatus	DescribeServiceSidecarInjectStatus		All Resource ``	None	None
servicemesh:UpdateIstioGatewayRoutes	UpdateIstioGatewayRoutes	update	All Resource ``	None	None
servicemesh:SetServiceRegistrySource	SetServiceRegistrySource		All Resource ``	None	None
servicemesh:UpdateMeshForSwitchCanary	UpdateMeshForSwitchCanary		All Resource ``	None	None
servicemesh:CreateLlmSessionMessage	CreateLlmSessionMessage	none	All Resource ``	None	None
servicemesh:UpdateIstioInjectionConfig	UpdateIstioInjectionConfig	update	All Resource ``	None	None
servicemesh:DescribeASMSidecarExpectedVersion	DescribeASMSidecarExpectedVersion		All Resource ``	None	None
servicemesh:DescribeServiceMeshes	DescribeServiceMeshes	get	All Resource ``	None	None
servicemesh:CreateSwimLaneGroup	CreateSwimLaneGroup	create	All Resource ``	None	None
servicemesh:DisableControlPlaneLogAlert	DisableControlPlaneLogAlert		All Resource ``	None	None
servicemesh:DescribeClusterPrometheus	DescribeClusterPrometheus	get	All Resource ``	None	None
servicemesh:RunCanaryUpgrade	RunCanaryUpgrade		All Resource ``	None	None
servicemesh:CreateGatewaySecret	CreateGatewaySecret	create	All Resource ``	None	None
servicemesh:CreateASMGateway	CreateASMGateway	create	All Resource ``	None	None
servicemesh:UpgradeMeshVersion	UpgradeMeshVersion	update	All Resource ``	None	None
servicemesh:DescribeVSwitches	DescribeVSwitches	get	All Resource ``	None	None
servicemesh:DescribePlaygroundControlPanel	DescribePlaygroundControlPanel	get	All Resource ``	None	None
servicemesh:UpdateEnvoyFilterToTemplate	UpdateEnvoyFilterToTemplate		All Resource ``	None	None
servicemesh:DescribeTelemetryConfiguration	DescribeTelemetryConfiguration		All Resource ``	None	None
servicemesh:DescribeUserPermissions	DescribeUserPermissions	get	All Resource ``	None	None
servicemesh:GetSwimLaneGroupList	GetSwimLaneGroupList	get	All Resource ``	None	None
servicemesh:AddClusterIntoServiceMesh	AddClusterIntoServiceMesh	create	All Resource ``	None	None
servicemesh:UpdateServiceMeshOwner	UpdateServiceMeshOwner		All Resource ``	None	None
servicemesh:GetClusterSpecInfo	GetClusterSpecInfo		All Resource ``	None	None
servicemesh:ModifyBuiltinEnvoyFilter	ModifyBuiltinEnvoyFilter	none	All Resource ``	None	None
servicemesh:ListDashboard	ListDashboard		All Resource ``	None	None
servicemesh:DescribeEipResources	DescribeEipResources	get	All Resource ``	None	None
servicemesh:DescribeServiceMeshLogs	DescribeServiceMeshLogs	get	All Resource ``	None	None
servicemesh:DescribeServiceMeshTasks	DescribeServiceMeshTasks	get	All Resource ``	None	None
servicemesh:GetDeploymentBySelector	GetDeploymentBySelector		All Resource ``	None	None
servicemesh:DeleteServiceMesh	DeleteServiceMesh	delete	All Resource ``	None	None
servicemesh:RunDiagnosis	RunDiagnosis		All Resource ``	None	None
servicemesh:DescribeMeshMaintenanceWindow	DescribeMeshMaintenanceWindow	get	All Resource ``	None	None
servicemesh:DeleteIstioGatewayDomains	DeleteIstioGatewayDomains	delete	All Resource ``	None	None
servicemesh:DescribeServiceManagedResource	DescribeServiceManagedResource		All Resource ``	None	None
servicemesh:InitializeASMRole	InitializeASMRole		All Resource ``	None	None
servicemesh:UpdateSidecarSet	UpdateSidecarSet	none	All Resource ``	None	None
servicemesh:UpdateMeshCRAggregation	UpdateMeshCRAggregation	update	All Resource ``	None	None
servicemesh:ReActivateAudit	ReActivateAudit	update	All Resource ``	None	None
servicemesh:RequestApiServer	RequestApiServer	none	All Resource ``	None	None
servicemesh:DescribeFeaturesAvailable	DescribeFeaturesAvailable		All Resource ``	None	None
servicemesh:GetSwimLaneList	GetSwimLaneList	get	All Resource ``	None	None
servicemesh:DescribeRelatedResourcesReuse	DescribeRelatedResourcesReuse		All Resource ``	None	None
servicemesh:UpdateSwimLaneGroup	UpdateSwimLaneGroup	update	All Resource ``	None	None
servicemesh:TagResources	TagResources		All Resource ``	None	None
servicemesh:SyncAutoInjectionLabelStatus	SyncAutoInjectionLabelStatus		All Resource ``	None	None
servicemesh:RemoveVMFromServiceMesh	RemoveVMFromServiceMesh	delete	All Resource ``	None	None
servicemesh:ListWaypoints	ListWaypoints	none	All Resource ``	None	None
servicemesh:DescribeUsersWithPermissions	DescribeUsersWithPermissions	get	All Resource ``	None	None
servicemesh:DescribeRenderedEnvoyFilterTemplate	DescribeRenderedEnvoyFilterTemplate		All Resource ``	None	None
servicemesh:DescribeIstioGatewayRoutes	DescribeIstioGatewayRoutes	get	All Resource ``	None	None
servicemesh:UpdateServiceSidecarInject	UpdateServiceSidecarInject		All Resource ``	None	None
servicemesh:DescribeServiceMeshAdditionalStatus	DescribeServiceMeshAdditionalStatus	get	All Resource ``	None	None
servicemesh:UpdatePluginConfig	UpdatePluginConfig		All Resource ``	None	None
servicemesh:ListBuiltinEnvoyFilter	ListBuiltinEnvoyFilter	none	All Resource ``	None	None
servicemesh:DescribeCrTemplates	DescribeCrTemplates	get	All Resource ``	None	None
servicemesh:DescribeCanaryStatus	DescribeCanaryStatus		All Resource ``	None	None
servicemesh:DescribeKialiConfiguration	DescribeKialiConfiguration	get	All Resource ``	None	None
servicemesh:EnableControlPlaneLogAlert	EnableControlPlaneLogAlert		All Resource ``	None	None
servicemesh:UpdateSidecarRecommendationState	UpdateSidecarRecommendationState		All Resource ``	None	None
servicemesh:DescribeRelatedResources	DescribeRelatedResources		All Resource ``	None	None
servicemesh:UpdateASMNamespaceFromGuestCluster	UpdateASMNamespaceFromGuestCluster	update	All Resource ``	None	None
servicemesh:UpdateASMGatewayImportedServices	UpdateASMGatewayImportedServices	update	All Resource ``	None	None
servicemesh:DeleteWorkloadASMProxyConfig	DeleteWorkloadASMProxyConfig	delete	All Resource ``	None	None
servicemesh:CreateExtensionProvider	CreateExtensionProvider		All Resource ``	None	None
servicemesh:ListTagResources	ListTagResources		All Resource ``	None	None
servicemesh:DescribeVersions	DescribeVersions	get	All Resource ``	None	None
servicemesh:DeleteExtensionProvider	DeleteExtensionProvider		All Resource ``	None	None
servicemesh:CreateIstioGatewayDomains	CreateIstioGatewayDomains	create	All Resource ``	None	None
servicemesh:CreateIstioGatewayRoutes	CreateIstioGatewayRoutes	create	All Resource ``	None	None
servicemesh:UpdateMeshForFinishCanary	UpdateMeshForFinishCanary		All Resource ``	None	None
servicemesh:DescribeGlobalSidecarConfig	DescribeGlobalSidecarConfig	get	All Resource ``	None	None
servicemesh:DescribeGuestClusterAccessLogDashboards	DescribeGuestClusterAccessLogDashboards	get	All Resource ``	None	None
servicemesh:RemoveBuiltinEnvoyFilter	RemoveBuiltinEnvoyFilter	none	All Resource ``	None	None
servicemesh:ModifyServiceMeshName	ModifyServiceMeshName	update	All Resource ``	None	None
servicemesh:UpdateControlPlaneLogAlertActionPolicy	UpdateControlPlaneLogAlertActionPolicy		All Resource ``	None	None
servicemesh:UpdateCentralizedKialiConfig	UpdateCentralizedKialiConfig	get	All Resource ``	None	None
servicemesh:GetBuiltinEnvoyFilter	GetBuiltinEnvoyFilter	none	All Resource ``	None	None
servicemesh:UpdateUnlabeledServiceManagedResource	UpdateUnlabeledServiceManagedResource		All Resource ``	None	None
servicemesh:UpdateMeshMaintenanceWindow	UpdateMeshMaintenanceWindow		All Resource ``	None	None
servicemesh:DescribeNamespaceScopeSidecarConfig	DescribeNamespaceScopeSidecarConfig	get	All Resource ``	None	None
servicemesh:GetRegisteredServiceNamespaces	GetRegisteredServiceNamespaces	get	All Resource ``	None	None
servicemesh:GetEcsList	GetEcsList	none	All Resource ``	None	None
servicemesh:DescribeUpgradeVersion	DescribeUpgradeVersion	get	All Resource ``	None	None
servicemesh:DescribeClustersInServiceMesh	DescribeClustersInServiceMesh	get	All Resource ``	None	None
servicemesh:UpdateIstioRouteAdditionalStatus	UpdateIstioRouteAdditionalStatus	update	All Resource ``	None	None
servicemesh:DescribeAlertActionPolicies	DescribeAlertActionPolicies		All Resource ``	None	None
servicemesh:DescribeServiceMeshClusters	DescribeServiceMeshClusters	get	All Resource ``	None	None
servicemesh:UpdateGuestClusterSyncStatus	UpdateGuestClusterSyncStatus		All Resource ``	None	None
servicemesh:UpdateMeshFeature	UpdateMeshFeature	update	All Resource ``	None	None
servicemesh:UpdatePlaygroundControlPanel	UpdatePlaygroundControlPanel	get	All Resource ``	None	None
servicemesh:RemoveClusterFromServiceMesh	RemoveClusterFromServiceMesh	delete	All Resource ``	None	None
servicemesh:DescribeServiceMeshUpgradeStatus	DescribeServiceMeshUpgradeStatus	get	All Resource ``	None	None
servicemesh:GetSaToken	GetSaToken		All Resource ``	None	None
servicemesh:UpdateTelemetryConfiguration	UpdateTelemetryConfiguration		All Resource ``	None	None
servicemesh:UpdateExtensionProvider	UpdateExtensionProvider		All Resource ``	None	None
servicemesh:GetServiceRegistrySource	GetServiceRegistrySource		All Resource ``	None	None
servicemesh:AddBuiltinEnvoyFilter	AddBuiltinEnvoyFilter	none	All Resource ``	None	None
servicemesh:UpdateWaypoint	UpdateWaypoint	none	All Resource ``	None	None
servicemesh:DeleteWaypoint	DeleteWaypoint	none	All Resource ``	None	None
servicemesh:DescribeImportedServicesDetail	DescribeImportedServicesDetail	get	All Resource ``	None	None
servicemesh:DescribeAvailableGuestClusters	DescribeAvailableGuestClusters		All Resource ``	None	None
servicemesh:DescribeSidecarSets	DescribeSidecarSets	none	All Resource ``	None	None
servicemesh:DescribeWorkloadScopeSidecarConfig	DescribeWorkloadScopeSidecarConfig	get	All Resource ``	None	None
servicemesh:DescribeServiceMeshDetail	DescribeServiceMeshDetail	get	All Resource ``	None	None
servicemesh:DeleteSwimLaneGroup	DeleteSwimLaneGroup	delete	All Resource ``	None	None
servicemesh:DeleteGatewayRoute	DeleteGatewayRoute	delete	All Resource ``	None	None
servicemesh:DescribeSidecarRecommendableTasks	DescribeSidecarRecommendableTasks		All Resource ``	None	None
servicemesh:UpdateASMGateway	UpdateASMGateway	update	All Resource ``	None	None
servicemesh:UpdateWorkloadScopeSidecarConfig	UpdateWorkloadScopeSidecarConfig	update	All Resource ``	None	None
servicemesh:UpdateInjectedProxyConfig	UpdateInjectedProxyConfig		All Resource ``	None	None
servicemesh:ListServiceAccounts	ListServiceAccounts	none	All Resource ``	None	None
servicemesh:CheckSidecarSet	CheckSidecarSet	none	All Resource ``	None	None
servicemesh:GetVmAppMeshInfo	GetVmAppMeshInfo	get	All Resource ``	None	None
servicemesh:DescribeServiceMeshProxyCount	DescribeServiceMeshProxyCount		All Resource ``	None	None
servicemesh:UntagResources	UntagResources		All Resource ``	None	None
servicemesh:DescribeNamespaceSyncStatus	DescribeNamespaceSyncStatus	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Service Mesh. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Service Mesh does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: