Grant permissions to RAM users and RAM roles-Alibaba Cloud Service Mesh-阿里云帮助中心

You can grant different permissions to RAM users and RAM roles as needed. Only authorized RAM users and RAM roles can perform operations in the ASM console, such as creating mesh instances or updating Service Mesh feature configurations. This practice prevents security risks caused by exposing your Alibaba Cloud account's AccessKey pair. This topic uses a RAM user as an example to describe how to grant permissions.

Prerequisites

You have created a RAM user and a RAM role. For more information, see Create a RAM user and Create a RAM role with an Alibaba Cloud account as the trusted entity.
You have a basic understanding of the structure and syntax of the permission policy language. For more information, see Policy structure and syntax.

Background information

Because RAM users and RAM roles have different use cases, their permission requirements vary:

If a RAM user or RAM role requires permissions only for Service Mesh operations and does not need to perform cluster operations, you only need to grant Service Mesh permissions. For more information, see Grant system policies to RAM users and RAM roles and Grant custom policies to RAM users and RAM roles.
If a RAM user or RAM role requires permissions for both Service Mesh and cluster operations, such as adding or removing an ACK cluster within a mesh, you must grant permissions for both the Service Mesh and the corresponding clusters. For more information, see Grant system policies to RAM users and RAM roles, Grant custom policies to RAM users and RAM roles, and Grant cluster permissions to a RAM user.

Grant system policies to RAM users and roles

ASM provides the AliyunASMReadOnlyAccess and AliyunASMFullAccess system policies by default. You can grant these policies directly. These policies are described as follows:

AliyunASMReadOnlyAccess

Grants read-only permissions to manage Alibaba Cloud Service Mesh (ASM). With this policy, you can only view the status of a Service Mesh and perform other read-only operations. You cannot make changes to the Service Mesh.
AliyunASMFullAccess

Grants full permissions to manage Alibaba Cloud Service Mesh (ASM). A RAM user with this policy has permissions on mesh resources equivalent to those of an Alibaba Cloud account and can perform any operation.

The following steps describe how to grant the AliyunASMReadOnlyAccess policy to a RAM user. For more information about how to grant permissions to a RAM user and a RAM role, see Manage permissions for RAM users and Manage permissions for RAM roles.

Log on to the RAM console as a RAM administrator.
In the left navigation pane, choose Identities > Users.
On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.
In the Grant Permission panel, add permissions to the RAM user.
1. Configure the Resource Scope parameter.
  - Account: The authorization takes effect on the current Alibaba Cloud account.
  - Resource Group: The authorization takes effect on a specific resource group.
    
    Important
    If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use resource groups to manage ECS access.
2. Configure the Principal parameter.
  
  The principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.
3. Under All Types, click System Policy. In the search box, enter AliyunASMReadOnlyAccess, and then click AliyunASMReadOnlyAccess.
  
  Note
  You can attach up to five policies at a time. To attach more policies, repeat this procedure.
4. Click OK.
Click Close.

Grant custom policies to RAM users and roles

If you need fine-grained access control, create a custom policy and then grant it to a RAM user or RAM role.

Create an access policy for a mesh instance

Log on to the RAM console as a RAM administrator.
In the left navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the Script Editor tab.

Enter the policy content and click Next to edit policy information.

You can implement fine-grained authorization for API operations by changing the Action field in the Statement. This topic uses a restricted access policy as an example. This policy grants all RAM permissions for a Service Mesh except for RBAC authorization. A RAM user with this policy can perform all operations except for granting RBAC permissions to other users. For more information about the policy syntax and structure, see Policy structure and syntax.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:Add*",
                "servicemesh:CRBatchDeletion",
                "servicemesh:Create*",
                "servicemesh:Delete*",
                "servicemesh:Describe*",
                "servicemesh:Enable*",
                "servicemesh:Disable*",
                "servicemesh:Get*",
                "servicemesh:InvokeApiServer",
                "servicemesh:List*",
                "servicemesh:Modify*",
                "servicemesh:Re*",
                "servicemesh:Run*",
                "servicemesh:Set*",
                "servicemesh:Sync*",
                "servicemesh:Update*",
                "servicemesh:Upgrade*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:ListLogStores",
                "log:ListDashboard",
                "log:GetDashboard",
                "log:ListSavedSearch",  
                "log:ListProject"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/audit-*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/istio-*"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "servicemesh.aliyuncs.com"
                }
            }
        }
    ],
    "Version": "1"
}

In the Basic Information section, enter a policy name. In this example, enter ASMPolicy1, and then click OK.

Grant a custom policy to RAM users and roles

This section describes how to grant the custom policy to a RAM user. For more information about how to grant permissions to a RAM role, see Manage permissions for RAM roles.

Log on to the RAM console as a RAM administrator.
In the left navigation pane, choose Identities > Users.
On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.
In the Grant Permission panel, add permissions to the RAM user.
1. Configure the Resource Scope parameter.
  - Account: The authorization takes effect on the current Alibaba Cloud account.
  - Resource Group: The authorization takes effect on a specific resource group.
    
    Important
    If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use resource groups to manage ECS access.
2. Configure the Principal parameter.
  
  The principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.
3. Under All Types, click Custom Policy. In the search box, enter ASMPolicy1, and then click ASMPolicy1.
  
  Note
  You can attach up to five policies at a time. To attach more policies, repeat this procedure.
4. Click OK.
Click Close.

Custom policy examples

Scenario 1: Grant permissions for a single mesh

You can use the following policy to grant permissions to manage a single mesh instance. After this policy is granted, the RAM user or RAM role can manage only the specified mesh instance.

Note

When you create the policy, replace <ServicemeshId> in the policy with the ID of the target mesh instance.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "servicemesh:*",
      "Resource": "acs:servicemesh:*:*:servicemesh/<ServicemeshId>"
    },
    {
      "Effect": "Allow",
      "Action": "servicemesh:DescribeServiceMeshes",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "log:GetLogStoreLogs",
      "Resource": "acs:log:*:*:project/*/logstore/audit-<ServicemeshId>"
    },
    {
      "Effect": "Allow",
      "Action": "log:GetLogStoreLogs",
      "Resource": "acs:log:*:*:project/*/logstore/istio-<ServicemeshId>"
    }
  ],
  "Version": "1"
}

Scenario 2: Grant read/write access to Istio resources

The built-in AliyunASMReadOnlyAccess system policy grants a RAM user or RAM role read-only permissions on Alibaba Cloud Service Mesh (ASM). However, a RAM user or role with this policy cannot manage Istio resources in the mesh.

You can use the following policy to grant read and write permissions for Istio resources. After this policy is granted to a RAM user or RAM role, the RAM user or RAM role can use the ASM console to manage Istio resources in the mesh, but cannot make changes to other parts of the mesh, such as feature settings.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:List*",
                "servicemesh:Describe*",
                "servicemesh:Get*",
                "servicemesh:InvokeApiServer"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:ListLogStores",
                "log:ListDashboard",
                "log:GetDashboard",
                "log:ListSavedSearch"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/audit-*"
        }
    ],
    "Version": "1"
}

Scenario 3: Grant RBAC authorization permissions

You can use the following policy to grant permissions to perform RBAC authorization for other users or roles. After this policy is granted to a RAM user or RAM role, the RAM user or RAM role can use the ASM console to manage the RBAC permissions of other RAM roles or RAM users, but cannot view or operate any mesh instances.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:DescribeUserPermissions",
                "servicemesh:GrantUserPermissions",
                "servicemesh:DescribeServiceMeshes",
                "servicemesh:DescribeUsersWithPermissions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ims:ListUserBasicInfos",
            "Resource": "*"
        }
    ],
    "Version": "1"
}