RAM authorization

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Data Management for RAM permission policies. The RAM code (RamCode) for Data Management is dms , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Data Management. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dms:BatchCreateDataLakePartitions	BatchCreateDataLakePartitions	create	All Resource ``	None	None
dms:ListAirflowVersions	ListAirflowVersions	get	All Resource ``	None	None
dms:DeleteDataAgentWorkspace	DeleteDataAgentWorkspace	create	All Resource ``	None	None
dms:UpdateDataLakeFunction	UpdateDataLakeFunction	create	All Resource ``	None	None
dms:DeleteFileUpload	DeleteFileUpload	delete	All Resource ``	None	None
dms:RemoveUserToDataAgentWorkspace	RemoveUserToDataAgentWorkspace	delete	All Resource ``	None	None
dms:CreateDataAgentSession	CreateDataAgentSession	create	All Resource ``	None	None
dms:DescribeKnowledgeBaseUploadSignature	DescribeKnowledgeBaseUploadSignature	get	All Resource ``	None	None
dms:CreateDataLakeDatabase	CreateDataLakeDatabase	create	All Resource ``	None	None
dms:ListDataLakePartitionName	ListDataLakePartitionName	get	All Resource ``	None	None
dms:WorkspaceActionStatus	WorkspaceActionStatus	get	All Resource ``	None	None
dms:GetAirflow	GetAirflow	get	All Resource ``	None	None
dms:AddUserToDataAgentWorkspace	AddUserToDataAgentWorkspace	create	All Resource ``	None	None
dms:ListDocumentChunks	ListDocumentChunks	list	All Resource ``	None	None
dms:ListDataLakeTablebaseInfo	ListDataLakeTablebaseInfo	get	All Resource ``	None	None
dms:DescribeKnowledgeBaseStats	DescribeKnowledgeBaseStats	get	All Resource ``	None	None
dms:CreateDataLakePartition	CreateDataLakePartition	create	All Resource ``	None	None
dms:ListDataLakePartition	ListDataLakePartition	get	All Resource ``	None	None
dms:CreateCustomAgent	CreateCustomAgent	create	All Resource ``	None	None
dms:GetDataLakeFunction	GetDataLakeFunction	create	All Resource ``	None	None
dms:ListDataLakeFunction	ListDataLakeFunction	get	All Resource ``	None	None
dms:GetDataLakeCatalog	GetDataLakeCatalog	get	All Resource ``	None	None
dms:UpdateAirflow	UpdateAirflow	update	All Resource ``	None	None
dms:ListCustomAgent	ListCustomAgent	list	All Resource ``	None	None
dms:UpdateDocument	UpdateDocument	update	All Resource ``	None	None
dms:DeleteDataLakeTable	DeleteDataLakeTable	delete	All Resource ``	None	None
dms:UpdateDataAgentSpaceInfo	UpdateDataAgentSpaceInfo	update	All Resource ``	None	None
dms:DescribeCustomAgent	DescribeCustomAgent	get	All Resource ``	None	None
dms:ConfigAirflow	ConfigAirflow	update	All Resource ``	None	None
dms:DescribeFileUploadSignature	DescribeFileUploadSignature	get	All Resource ``	None	None
dms:DescribeDocument	DescribeDocument	get	All Resource ``	None	None
dms:GetSqlConsoleOperationLog	GetSqlConsoleOperationLog	get	All Resource ``	None	None
dms:CreateAirflow	CreateAirflow	create	All Resource ``	None	None
dms:CreateDataAgentKnowledgeBase	CreateDataAgentKnowledgeBase	create	All Resource ``	None	None
dms:DeleteDataAgentKnowledgeBase	DeleteDataAgentKnowledgeBase	delete	All Resource ``	None	None
dms:ListDataLakeTableName	ListDataLakeTableName	get	All Resource ``	None	None
dms:GetWorkspaceCode	GetWorkspaceCode	get	All Resource ``	None	None
dms:ListDataLakeFunctionName	ListDataLakeFunctionName	get	All Resource ``	None	None
dms:SetWorkspaceQuota	SetWorkspaceQuota	create	All Resource ``	None	None
dms:ListKnowledgeBases	ListKnowledgeBases	list	All Resource ``	None	None
dms:ListAirflows	ListAirflows	list	All Resource ``	None	None
dms:DeleteCustomAgent	DeleteCustomAgent	delete	All Resource ``	None	None
dms:WorkspaceCodePublish	WorkspaceCodePublish	update	All Resource ``	None	None
dms:DeleteWorkspaceCode	DeleteWorkspaceCode	delete	All Resource ``	None	None
dms:SetWorkspaceCodePublishSetting	SetWorkspaceCodePublishSetting	update	All Resource ``	None	None
dms:GetWorkspaceQuota	GetWorkspaceQuota	get	All Resource ``	None	None
dms:RedeployAirflow	RedeployAirflow	update	All Resource ``	None	None
dms:GetDataAgentSubAccountInfo	GetDataAgentSubAccountInfo	get	All Resource ``	None	None
dms:UpsertDocumentChunks	UpsertDocumentChunks	update	All Resource ``	None	None
dms:RetrieveKnowledgeBase	RetrieveKnowledgeBase	get	All Resource ``	None	None
dms:BatchUpdateDataLakePartitions	BatchUpdateDataLakePartitions	update	All Resource ``	None	None
dms:ListDataAgentWorkspaceMember	ListDataAgentWorkspaceMember	list	All Resource ``	None	None
dms:GetDataLakePartition	GetDataLakePartition	get	All Resource ``	None	None
dms:CreateDataLakeTable	CreateDataLakeTable	create	All Resource ``	None	None
dms:GetDataLakeTable	GetDataLakeTable	get	All Resource ``	None	None
dms:DescribeDataAgentSession	DescribeDataAgentSession	create	All Resource ``	None	None
dms:UpdateDataLakePartition	UpdateDataLakePartition	update	All Resource ``	None	None
dms:DeleteDocumentChunks	DeleteDocumentChunks	delete	All Resource ``	None	None
dms:ListFileUpload	ListFileUpload	list	All Resource ``	None	None
dms:CreateDataLakeFunction	CreateDataLakeFunction	create	All Resource ``	None	None
dms:CreateDataAgentWorkspace	CreateDataAgentWorkspace	create	All Resource ``	None	None
dms:DeleteAirflow	DeleteAirflow	delete	All Resource ``	None	None
dms:UpdateDataAgentWorkspaceMemberRole	UpdateDataAgentWorkspaceMemberRole	update	All Resource ``	None	None
dms:ListWorkspaceCode	ListWorkspaceCode	get	All Resource ``	None	None
dms:ListDataAgentWorkspace	ListDataAgentWorkspace	list	All Resource ``	None	None
dms:ListDataLakeCatalog	ListDataLakeCatalog	get	All Resource ``	None	None
dms:UpdateKnowledgeBase	UpdateKnowledgeBase	update	All Resource ``	None	None
dms:OperateCustomAgent	OperateCustomAgent	update	All Resource ``	None	None
dms:ListDataLakeTable	ListDataLakeTable	get	All Resource ``	None	None
dms:UploadDocument	UploadDocument	create	All Resource ``	None	None
dms:ListDataAgentSession	ListDataAgentSession	list	All Resource ``	None	None
dms:CreateAirflowLoginToken	CreateAirflowLoginToken	get	All Resource ``	None	None
dms:ModifyCustomAgent	ModifyCustomAgent	update	All Resource ``	None	None
dms:SendChatMessage	SendChatMessage	create	All Resource ``	None	None
dms:ListDataLakeDatabase	ListDataLakeDatabase	get	All Resource ``	None	None
dms:FileUploadCallback	FileUploadCallback	update	All Resource ``	None	None
dms:ListDocuments	ListDocuments	list	All Resource ``	None	None
dms:UpdateDataLakeDatabase	UpdateDataLakeDatabase	update	All Resource ``	None	None
dms:WorkspaceActionLog	WorkspaceActionLog	get	All Resource ``	None	None
dms:UpdateDataLakeTable	UpdateDataLakeTable	update	All Resource ``	None	None
dms:GetDataAgentWorkspaceInfo	GetDataAgentWorkspaceInfo	get	All Resource ``	None	None
dms:GetChatContent	GetChatContent	get	All Resource ``	None	None
dms:SaveWorkspaceCode	SaveWorkspaceCode	update	All Resource ``	None	None
dms:DeleteDocument	DeleteDocument	delete	All Resource ``	None	None
dms:GetDataLakeDatabase	GetDataLakeDatabase	get	All Resource ``	None	None
dms:ListDataCenterDatabase	ListDataCenterDatabase	list	All Resource ``	None	None
dms:ListDataLakePartitionByFilter	ListDataLakePartitionByFilter	get	All Resource ``	None	None
dms:GetWorkspaceCodePublishSetting	GetWorkspaceCodePublishSetting	get	All Resource ``	None	None
dms:ListDataCenterTable	ListDataCenterTable	list	All Resource ``	None	None
dms:DeleteDataLakeDatabase	DeleteDataLakeDatabase	delete	All Resource ``	None	None

Resource

The following table lists the resources defined by Data Management. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Data Management does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: