RAM authorization-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Smart Conversation Analysis for RAM permission policies. The RAM code (RamCode) for Smart Conversation Analysis is sca , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Smart Conversation Analysis. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
sca:CreateAsrVocab	CreateAsrVocab	create	All Resource ``	None	None
sca:UploadAudioData	UploadAudioData	create	All Resource ``	None	None
sca:CreateSkillGroupConfig	CreateSkillGroupConfig	create	All Resource ``	None	None
sca:GetRuleDetail	GetRuleDetail	get	All Resource ``	None	None
sca:UpdateAgent	UpdateAgent	none	All Resource ``	None	None
sca:ListAgentMJobInfo	ListAgentMJobInfo	none	All Resource ``	None	None
sca:GetNextResultToVerify	GetNextResultToVerify		All Resource ``	None	None
sca:DeleteTaskAssignRule	DeleteTaskAssignRule		All Resource ``	None	None
sca:HandleComplaint	HandleComplaint		All Resource ``	None	None
sca:SaveConfigDataSet	SaveConfigDataSet	update	All Resource ``	None	None
sca:CreateSchemeTaskConfig	CreateSchemeTaskConfig	create	All Resource ``	None	None
sca:UploadRule	UploadRule		All Resource ``	None	None
sca:GetRuleV4	GetRuleV4		All Resource ``	None	None
sca:ListSessionGroup	ListSessionGroup	list	All Resource ``	None	None
sca:GetResultToReview	GetResultToReview	get	All Resource ``	None	None
sca:ListRulesV4	ListRulesV4	list	All Resource ``	None	None
sca:UpdateTaskAssignRule	UpdateTaskAssignRule		All Resource ``	None	None
sca:GetAgentTaskResult	GetAgentTaskResult	none	All Resource ``	None	None
sca:SubmitReviewInfoV4	SubmitReviewInfoV4	none	All Resource ``	None	None
sca:DeleteSkillGroupConfig	DeleteSkillGroupConfig	delete	All Resource ``	None	None
sca:UploadDataV4	UploadDataV4	create	All Resource ``	None	None
sca:DeleteSchemeTaskConfig	DeleteSchemeTaskConfig		All Resource ``	None	None
sca:CreateAgentTask	CreateAgentTask	none	All Resource ``	None	None
sca:GetTag	GetTag	none	All Resource ``	None	None
sca:GetResult	GetResult	list	All Resource ``	None	None
sca:CreateTaskAssignRule	CreateTaskAssignRule		All Resource ``	None	None
sca:CreateAgent	CreateAgent	none	All Resource ``	None	None
sca:DeleteQualityCheckScheme	DeleteQualityCheckScheme		All Resource ``	None	None
sca:ListRules	ListRules	list	All Resource ``	None	None
sca:SubmitQualityCheckTask	SubmitQualityCheckTask		All Resource ``	None	None
sca:AssignReviewerBySessionGroup	AssignReviewerBySessionGroup	update	All Resource ``	None	None
sca:ListDataSet	ListDataSet	list	All Resource ``	None	None
sca:ListWarningConfig	ListWarningConfig		All Resource ``	None	None
sca:DeleteAsrVocab	DeleteAsrVocab		All Resource ``	None	None
sca:AddBusinessCategory	AddBusinessCategory		All Resource ``	None	None
sca:GetAsrVocab	GetAsrVocab	get	All Resource ``	None	None
sca:RevertAssignedSession	RevertAssignedSession		All Resource ``	None	None
sca:BatchSubmitReviewInfo	BatchSubmitReviewInfo		All Resource ``	None	None
sca:GetAgent	GetAgent	none	All Resource ``	None	None
sca:UpdateRuleToScheme	UpdateRuleToScheme		All Resource ``	None	None
sca:GetSyncResult	GetSyncResult	get	All Resource ``	None	None
sca:ListSkillGroupConfig	ListSkillGroupConfig	list	All Resource ``	None	None
sca:GetRule	GetRule	get	All Resource ``	None	None
sca:UploadData	UploadData	create	All Resource ``	None	None
sca:GetAgentMJobInfo	GetAgentMJobInfo	get	All Resource ``	None	None
sca:GetBusinessCategoryList	GetBusinessCategoryList		All Resource ``	None	None
sca:GetRulesCountList	GetRulesCountList		All Resource ``	None	None
sca:DeleteCheckTypeToScheme	DeleteCheckTypeToScheme	none	All Resource ``	None	None
sca:AssignReviewer	AssignReviewer		All Resource ``	None	None
sca:SubmitComplaint	SubmitComplaint		All Resource ``	None	None
sca:GetRuleById	GetRuleById	get	All Resource ``	None	None
sca:SyncQualityCheck	SyncQualityCheck	create	All Resource ``	None	None
sca:TestRuleV4	TestRuleV4		All Resource ``	None	None
sca:DeleteDataSet	DeleteDataSet	delete	All Resource ``	None	None
sca:DelRuleCategory	DelRuleCategory		All Resource ``	None	None
sca:DeleteWarningConfig	DeleteWarningConfig		All Resource ``	None	None
sca:SubmitReviewInfo	SubmitReviewInfo		All Resource ``	None	None
sca:GetMiningTaskResult	GetMiningTaskResult	none	All Resource ``	None	None
sca:UpdateAsrVocab	UpdateAsrVocab		All Resource ``	None	None
sca:CreateQualityCheckScheme	CreateQualityCheckScheme		All Resource ``	None	None
sca:ListQualityCheckScheme	ListQualityCheckScheme		All Resource ``	None	None
sca:UpdateQualityCheckData	UpdateQualityCheckData	update	All Resource ``	None	None
sca:ListTag	ListTag	none	All Resource ``	None	None
sca:UpdateWarningConfig	UpdateWarningConfig		All Resource ``	None	None
sca:ListSchemeTaskConfig	ListSchemeTaskConfig	list	All Resource ``	None	None
sca:UpdateRuleV4	UpdateRuleV4		All Resource ``	None	None
sca:GetSkillGroupConfig	GetSkillGroupConfig	get	All Resource ``	None	None
sca:RunCompletionMessage	RunCompletionMessage	none	All Resource ``	None	None
sca:ListUsers	ListUsers		All Resource ``	None	None
sca:RevertAssignedSessionGroup	RevertAssignedSessionGroup	update	All Resource ``	None	None
sca:DeleteCustomizationConfig	DeleteCustomizationConfig		All Resource ``	None	None
sca:UpdateSyncQualityCheckData	UpdateSyncQualityCheckData		All Resource ``	None	None
sca:DeleteBusinessCategory	DeleteBusinessCategory		All Resource ``	None	None
sca:UpdateUser	UpdateUser		All Resource ``	None	None
sca:AddRuleCategory	AddRuleCategory	create	All Resource ``	None	None
sca:GetSchemeTaskConfig	GetSchemeTaskConfig	none	All Resource ``	None	None
sca:AddRuleV4	AddRuleV4		All Resource ``	None	None
sca:CreateWarningConfig	CreateWarningConfig		All Resource ``	None	None
sca:UpdateCheckTypeToScheme	UpdateCheckTypeToScheme		All Resource ``	None	None
sca:ListAsrVocab	ListAsrVocab	list	All Resource ``	None	None
sca:DeleteAgent	DeleteAgent	none	All Resource ``	None	None
sca:DeleteRule	DeleteRule	delete	All Resource ``	None	None
sca:ListTaskAssignRules	ListTaskAssignRules		All Resource ``	None	None
sca:UpdateRule	UpdateRule	update	All Resource ``	None	None
sca:CreateCheckTypeToScheme	CreateCheckTypeToScheme		All Resource ``	None	None
sca:GetQualityCheckScheme	GetQualityCheckScheme	none	All Resource ``	None	None
sca:UploadDataSync	UploadDataSync	none	All Resource ``	None	None
sca:UpdateSchemeTaskConfig	UpdateSchemeTaskConfig	update	All Resource ``	None	None
sca:UpdateRuleById	UpdateRuleById	update	All Resource ``	None	None
sca:GetRuleCategory	GetRuleCategory		All Resource ``	None	None
sca:UpdateSkillGroupConfig	UpdateSkillGroupConfig	update	All Resource ``	None	None
sca:GetCustomizationConfigList	GetCustomizationConfigList	list	All Resource ``	None	None
sca:ApplyWsToken	ApplyWsToken	none	All Resource ``	None	None
sca:InvalidRule	InvalidRule	delete	All Resource ``	None	None
sca:UpdateQualityCheckScheme	UpdateQualityCheckScheme		All Resource ``	None	None
sca:GetLabelAnalysisResult	GetLabelAnalysisResult	none	All Resource ``	None	None
sca:DeleteRuleV4	DeleteRuleV4		All Resource ``	None	None

Resource

The following table lists the resources defined by Smart Conversation Analysis. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Smart Conversation Analysis does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: