RAM authorization-CloudSSO(CloudSSO)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Resource Access Management for RAM permission policies. The RAM code (RamCode) for Resource Access Management is cloudsso , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Resource Access Management. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
cloudsso:GetUserProvisioningConfiguration	GetUserProvisioningConfiguration	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:DisableDelegateAccount	DisableDelegateAccount	update	All Resource ``	None	None
cloudsso:AddUserToGroup	AddUserToGroup	create	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}` Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}`	None	None
cloudsso:GetMFAAuthenticationSettingInfo	GetMFAAuthenticationSettingInfo	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetTaskStatus	GetTaskStatus	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:DeleteSCIMServerCredential	DeleteSCIMServerCredential	delete	*SCIMServerCredential `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/{#CredentialId}`	None	None
cloudsso:DeleteUser	DeleteUser	delete	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:ListUserProvisionings	ListUserProvisionings	list	All Resource ``	None	None
cloudsso:DeleteDirectory	DeleteDirectory	delete	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ListGroups	ListGroups	list	Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/`	None	None
cloudsso:UpdateDirectory	UpdateDirectory	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ListJoinedGroupsForUser	ListJoinedGroupsForUser	list	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:CreateUser	CreateUser	create	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/`	None	None
cloudsso:GetLoginPreference	GetLoginPreference	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:TagResources	TagResources	update	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}` AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:CreateUserProvisioning	CreateUserProvisioning	create	UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/` *Account `acs:resourcemanager::{#accountId}:account/{#AccountId}` Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:RemovePermissionPolicyFromAccessConfiguration	RemovePermissionPolicyFromAccessConfiguration	delete	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:CreateDirectory	CreateDirectory	create	Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/`	None	ram:CreateServiceLinkedRole
cloudsso:UpdateMFAAuthenticationSettings	UpdateMFAAuthenticationSettings	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:UpdateSCIMServerCredentialStatus	UpdateSCIMServerCredentialStatus	update	*SCIMServerCredential `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/{#CredentialId}`	None	None
cloudsso:UpdateDirectoryGlobalAccessStatus	UpdateDirectoryGlobalAccessStatus	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetUserProvisioning	GetUserProvisioning	get	*UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}`	None	None
cloudsso:UpdateUserMFAAuthenticationSettings	UpdateUserMFAAuthenticationSettings	update	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:DeprovisionAccessConfiguration	DeprovisionAccessConfiguration	update	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:DisableService	DisableService	update	All Resource ``	None	None
cloudsso:GetAccessConfiguration	GetAccessConfiguration	get	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:RetryUserProvisioningEvent	RetryUserProvisioningEvent	update	UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}` UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/*`	None	None
cloudsso:RemoveExternalSAMLIdPCertificate	RemoveExternalSAMLIdPCertificate	delete	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ProvisionAccessConfiguration	ProvisionAccessConfiguration	update	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:EnableService	EnableService	update	All Resource ``	None	None
cloudsso:ListAccessAssignments	ListAccessAssignments	list	All Resource ``	None	None
cloudsso:CreateAccessAssignment	CreateAccessAssignment	create	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}` Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}` Account `acs:resourcemanager::{#accountId}:account/{#AccountId}`	None	None
cloudsso:ListSCIMServerCredentials	ListSCIMServerCredentials	list	SCIMServerCredential `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/`	None	None
cloudsso:UpdateUser	UpdateUser	update	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:EnableDelegateAccount	EnableDelegateAccount	update	All Resource ``	None	None
cloudsso:UpdateUserStatus	UpdateUserStatus	update	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:GetMFAAuthenticationStatus	GetMFAAuthenticationStatus	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:CreateAccessConfiguration	CreateAccessConfiguration	create	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/`	None	None
cloudsso:GetGroup	GetGroup	get	*Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}`	None	None
cloudsso:DeleteAccessConfiguration	DeleteAccessConfiguration	delete	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:ListMFADevicesForUser	ListMFADevicesForUser	list	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:PreCheckForCreateUserProvisioning	PreCheckForCreateUserProvisioning	get	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}` Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}` UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/` *Account `acs:resourcemanager::{#accountId}:account/{#AccountId}`	None	None
cloudsso:ListDirectories	ListDirectories	list	Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/`	None	None
cloudsso:ListTagResources	ListTagResources	list	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:UpdateGroup	UpdateGroup	update	*Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}`	None	None
cloudsso:AddExternalSAMLIdPCertificate	AddExternalSAMLIdPCertificate	create	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetDirectory	GetDirectory	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetDirectoryGlobalAccessStatus	GetDirectoryGlobalAccessStatus	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetPasswordPolicy	GetPasswordPolicy	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:SetPasswordPolicy	SetPasswordPolicy	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:DeleteMFADeviceForUser	DeleteMFADeviceForUser	delete	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:GetUser	GetUser	get	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:ListAccessConfigurations	ListAccessConfigurations	list	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/`	None	None
cloudsso:DeleteAccessAssignment	DeleteAccessAssignment	delete	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}` Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}` Account `acs:resourcemanager::{#accountId}:account/{#AccountId}`	None	None
cloudsso:GetUserProvisioningRdAccountStatistics	GetUserProvisioningRdAccountStatistics	get	*Account `acs:resourcemanager::{#accountId}:account/{#AccountId}`	None	None
cloudsso:ListUserProvisioningEvents	ListUserProvisioningEvents	list	UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}` UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/*`	None	None
cloudsso:UntagResources	UntagResources	update	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:UpdateInlinePolicyForAccessConfiguration	UpdateInlinePolicyForAccessConfiguration	update	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:DeleteUserProvisioning	DeleteUserProvisioning	delete	*UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}`	None	None
cloudsso:GetMFAAuthenticationSettings	GetMFAAuthenticationSettings	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ResetUserPassword	ResetUserPassword	update	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:GetDirectorySAMLServiceProviderInfo	GetDirectorySAMLServiceProviderInfo	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetServiceStatus	GetServiceStatus	get	All Resource ``	None	None
cloudsso:ListGroupMembers	ListGroupMembers	list	*Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}`	None	None
cloudsso:ListTasks	ListTasks	list	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ListUsers	ListUsers	list	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/`	None	None
cloudsso:DeleteGroup	DeleteGroup	delete	*Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}`	None	None
cloudsso:GetDelegateAccount	GetDelegateAccount	get	All Resource ``	None	None
cloudsso:SetExternalSAMLIdentityProvider	SetExternalSAMLIdentityProvider	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:SetDirectorySAMLServiceProviderInfo	SetDirectorySAMLServiceProviderInfo	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetUserProvisioningStatistics	GetUserProvisioningStatistics	get	*UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}`	None	None
cloudsso:SetMFAAuthenticationStatus	SetMFAAuthenticationStatus	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:AddPermissionPolicyToAccessConfiguration	AddPermissionPolicyToAccessConfiguration	create	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:CreateSCIMServerCredential	CreateSCIMServerCredential	create	SCIMServerCredential `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/`	None	None
cloudsso:ListPermissionPoliciesInAccessConfiguration	ListPermissionPoliciesInAccessConfiguration	list	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:GetUserId	GetUserId	get	User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/`	None	None
cloudsso:GetUserProvisioningEvent	GetUserProvisioningEvent	get	UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}` UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/*`	None	None
cloudsso:RemoveUserFromGroup	RemoveUserFromGroup	delete	Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId}` User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:ClearExternalSAMLIdentityProvider	ClearExternalSAMLIdentityProvider	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:ListExternalSAMLIdPCertificates	ListExternalSAMLIdPCertificates	list	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:CreateGroup	CreateGroup	create	Group `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/`	None	None
cloudsso:EnableDirectoryRDFeature	EnableDirectoryRDFeature	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetTask	GetTask	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:CheckRDFeaturePrerequisite	CheckRDFeaturePrerequisite	get	All Resource ``	None	None
cloudsso:UpdateUserProvisioningConfiguration	UpdateUserProvisioningConfiguration	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:UpdateUserProvisioning	UpdateUserProvisioning	update	*UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}`	None	None
cloudsso:SetSCIMSynchronizationStatus	SetSCIMSynchronizationStatus	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetSCIMSynchronizationStatus	GetSCIMSynchronizationStatus	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetExternalSAMLIdentityProvider	GetExternalSAMLIdentityProvider	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:SetLoginPreference	SetLoginPreference	update	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:UpdateAccessConfiguration	UpdateAccessConfiguration	update	*AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}`	None	None
cloudsso:ListAccessConfigurationProvisionings	ListAccessConfigurationProvisionings	list	AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId}` AccessConfiguration `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/*`	None	None
cloudsso:GetUserMFAAuthenticationSettings	GetUserMFAAuthenticationSettings	get	*User `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId}`	None	None
cloudsso:GetDirectoryStatistics	GetDirectoryStatistics	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:GetDirectoryRDFeatureStatus	GetDirectoryRDFeatureStatus	get	*Directory `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}`	None	None
cloudsso:DeleteUserProvisioningEvent	DeleteUserProvisioningEvent	delete	UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}` UserProvisioning `acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/*`	None	None

Resource

The following table lists the resources defined by Resource Access Management. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Directory	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId} acs:cloudsso:{#regionId}:{#accountId}:directory/*
User	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/{#UserId} acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user/*
Group	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/{#GroupId} acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/group/*
SCIMServerCredential	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/{#CredentialId} acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/scim-credential/*
UserProvisioning	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/* acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/user-provisioning/{#UserProvisioningId}
Account	acs:resourcemanager::{#accountId}:account/* acs:resourcemanager::{#accountId}:account/{#AccountId}
AccessConfiguration	acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/{#AccessConfigurationId} acs:cloudsso:{#regionId}:{#accountId}:directory/{#DirectoryId}/access-configuration/*

Condition

Resource Access Management does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: