RAM access policies
This topic explains how the Data Online Migration service uses RAM for key features like user access control, operation-level authorization, and resource-level authorization.
RAM user access
When a RAM user accesses the Data Online Migration service, the service uses their credentials to verify permissions for the requested resources.
Credential management
An administrator creates credentials when creating a RAM user.
Console access: Requires a logon name and logon password.
API calls: Requires an AccessKey.
To improve the security of RAM user credentials, we recommend that you:
Change RAM user passwords periodically.
Avoid writing an AccessKey in plaintext within your project code.
An administrator account can be an Alibaba Cloud account, or a RAM user or RAM role with administrator permissions.
Access policy management
Access policy syntax and structure
An access policy contains a Version and one or more Statement elements. Each statement includes an Effect, an Action, a Resource, and an optional Condition. For more information about the syntax and structure of access policies, see Access policy syntax and structure.
After creating a RAM user, an administrator grants permissions by attaching an access policy.
There are two types of identity-based access policies:
System policies:
AliyunOSSImportFullAccess: Grants permissions to manage the Data Online Migration service.AliyunOSSImportReadOnlyAccess: Grants read-only permissions for the Data Online Migration service.
Custom policies:
Procedure
To manage a RAM user, follow these steps:
Operation-level authorization
The Data Online Migration service supports operation-level authorization for fine-grained permission control.
Because a full-access policy overrides more granular ones, you must detach it from the RAM user to enable fine-grained access control.
Operation-level elements
In an access policy, the Action element specifies which operations are allowed or denied. The format is mgw:<action-name>.
This allows you to specify permissions for a specific operation in an access policy, which helps you implement the principle of least privilege.
Operation-level authorization is typically used with custom policies for access control in enterprise environments that require strict permissions.
Operations are categorized into job-level, data address-level, agent-level, and tunnel-level operations.
Job-level operations
API | Action | Description |
CreateJob | mgw:CreateImportJob | Creates a job |
GetJob | mgw:GetImportJob | Queries job details |
ListJob | mgw:ListImportJob | Lists jobs |
UpdateJob | mgw:UpdateImportJob | Updates a job |
GetJobResult | mgw:GetImportJobResult | Gets job retry information |
ListJobHistory | mgw:ListImportJobHistory | Lists the history of a specified job |
CreateReport | mgw:CreateImportReport | Creates a migration report |
GetReport | mgw:GetImportReport | Queries a migration report |
DeleteJob | mgw:DeleteImportJob | Deletes a job |
Data address-level operations
API | Action | Description |
CreateAddress | mgw:CreateImportAddress | Creates a data address |
GetAddress | mgw:GetImportAddress | Queries data address details |
ListAddress | mgw:ListImportAddress | Lists data addresses |
VerifyAddress | mgw:VerifyImportAddress | Verifies a data address |
UpdateAddress | mgw:UpdateImportAddress | Updates a data address |
DeleteAddress | mgw:DeleteImportAddress | Deletes a data address |
Agent-level operations
API | Action | Description |
CreateAgent | mgw:CreateImportAgent | Creates an agent |
GetAgent | mgw:GetImportAgent | Queries agent details |
ListAgent | mgw:ListImportAgent | Lists agents |
GetAgentStatus | mgw:GetImportAgent | Queries agent status |
VerifyAgentTunnel | mgw:VerifyAgentTunnel | Authenticates an agent |
DeleteAgent | mgw:DeleteImportAgent | Deletes an agent |
Tunnel-level operations
API | Action | Description |
CreateTunnel | mgw:CreateImportTunnel | Creates a tunnel |
GetTunnel | mgw:GetImportTunnel | Queries tunnel details |
ListTunnel | mgw:ListImportTunnel | Lists tunnels |
UpdateTunnel | mgw:UpdateImportTunnel | Updates the rate limit of a tunnel |
DeleteTunnel | mgw:DeleteImportTunnel | Deletes a tunnel |
Resource-level authorization
The Data Online Migration service supports resource-level authorization, allowing you to control permissions for specific resources.
Resource-level elements
In an access policy, the Resource element specifies one or more resources that the action applies to. A resource is an object that you can interact with in an Alibaba Cloud service. For the Data Online Migration service, resources include:
Tunnel
Agent
Data address
Job
The Resource element uses the Aliyun Resource Name (ARN) to identify the resource. The ARN format is as follows:
acs:mgw:<region>:<account-id>:<action-type>/<resource-name>
You can use the wildcard character (*) to indicate that the operation applies to all resources of that type.
Resource-level authorization is often used with custom policies for access control.
ARN formats for resources
In RAM, the Resource element specifies one or more resources. You can use the wildcard character (*). A single access policy can contain multiple Resource elements.
Scope | Format | Example |
Account |
|
|
Job |
|
|
Data address |
|
|
Agent |
|
|
Tunnel |
|
|
The region field currently supports only the wildcard character (*).