RAM authorization

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Data Management for RAM permission policies. The RAM code (RamCode) for Data Management is dms , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Data Management. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dms:DescribeKnowledgeBaseUploadSignature	DescribeKnowledgeBaseUploadSignature	get	All Resource ``	None	None
dms:CreateAirflow	CreateAirflow	create	All Resource ``	None	None
dms:CreateDataAgentTheme	CreateDataAgentTheme	create	All Resource ``	None	None
dms:SendChatMessage	SendChatMessage	create	All Resource ``	None	None
dms:GetNotebookAndSubmitTask	GetNotebookAndSubmitTask	create	All Resource ``	None	None
dms:ListDataAgentAccuracyTestInstances	ListDataAgentAccuracyTestInstances	list	All Resource ``	None	None
dms:RetrieveKnowledgeBase	RetrieveKnowledgeBase	get	All Resource ``	None	None
dms:AddUserToDataAgentWorkspace	AddUserToDataAgentWorkspace	create	All Resource ``	None	None
dms:DeleteWorkspaceCode	DeleteWorkspaceCode	delete	All Resource ``	None	None
dms:CreateAgent	CreateAgent	create	All Resource ``	None	None
dms:ListDataAgentWorkspace	ListDataAgentWorkspace	list	All Resource ``	None	None
dms:DeleteDataAgent	DeleteDataAgent	get	All Resource ``	None	None
dms:ListDataAgentSkillMeta	ListDataAgentSkillMeta	list	All Resource ``	None	None
dms:DeleteDataAgentKnowledgeBase	DeleteDataAgentKnowledgeBase	delete	All Resource ``	None	None
dms:UpsertDocumentChunks	UpsertDocumentChunks	update	All Resource ``	None	None
dms:DescribeDataAgentMetrics	DescribeDataAgentMetrics	get	All Resource ``	None	None
dms:ListAirflows	ListAirflows	list	All Resource ``	None	None
dms:ListKnowledgeBases	ListKnowledgeBases	list	All Resource ``	None	None
dms:SearchAgenticDatabase	SearchAgenticDatabase	list	All Resource ``	None	None
dms:SearchAgenticCatalog	SearchAgenticCatalog	list	All Resource ``	None	None
dms:UploadDocument	UploadDocument	create	All Resource ``	None	None
dms:UpdateDataAgentWorkspaceMemberRole	UpdateDataAgentWorkspaceMemberRole	update	All Resource ``	None	None
dms:UpdateOneMetaOssieModel	UpdateOneMetaOssieModel	update	All Resource ``	None	None
dms:ListOneMetaSqlTemplates	ListOneMetaSqlTemplates	list	All Resource ``	None	None
dms:GetListMcpServerToolsResult	GetListMcpServerToolsResult	get	All Resource ``	None	None
dms:GetAgenticTableIndex	GetAgenticTableIndex	get	All Resource ``	None	None
dms:ImportOneMetaOssieModel	ImportOneMetaOssieModel	create	All Resource ``	None	None
dms:ConfigAirflow	ConfigAirflow	update	All Resource ``	None	None
dms:GetWorkspaceCodePublishSetting	GetWorkspaceCodePublishSetting	get	All Resource ``	None	None
dms:GetDataAgentWorkspaceInfo	GetDataAgentWorkspaceInfo	get	All Resource ``	None	None
dms:GetAirflow	GetAirflow	get	All Resource ``	None	None
dms:DeleteCustomAgent	DeleteCustomAgent	delete	All Resource ``	None	None
dms:ListDataAgentTheme	ListDataAgentTheme	list	All Resource ``	None	None
dms:DeleteDataAgentAccuracyTest	DeleteDataAgentAccuracyTest	delete	All Resource ``	None	None
dms:UpdateDataAgentAccuracyTest	UpdateDataAgentAccuracyTest	update	All Resource ``	None	None
dms:DeleteDataAgentWorkspace	DeleteDataAgentWorkspace	create	All Resource ``	None	None
dms:DeleteOneMetaOssieModel	DeleteOneMetaOssieModel	delete	All Resource ``	None	None
dms:OperateCustomAgent	OperateCustomAgent	update	All Resource ``	None	None
dms:DeleteFileUpload	DeleteFileUpload	delete	All Resource ``	None	None
dms:ModifyCustomAgent	ModifyCustomAgent	update	All Resource ``	None	None
dms:SetWorkspaceQuota	SetWorkspaceQuota	create	All Resource ``	None	None
dms:ResetAgenticApiKey	ResetAgenticApiKey	update	All Resource ``	None	None
dms:GetAgenticDataSource	GetAgenticDataSource	get	All Resource ``	None	None
dms:GetWorkspaceQuota	GetWorkspaceQuota	get	All Resource ``	None	None
dms:DescribeCustomAgent	DescribeCustomAgent	get	All Resource ``	None	None
dms:DescribeDocument	DescribeDocument	get	All Resource ``	None	None
dms:ListAgenticTableBaseInfo	ListAgenticTableBaseInfo	list	All Resource ``	None	None
dms:ModifyDataAgentMcp	ModifyDataAgentMcp	update	All Resource ``	None	None
dms:UpdateOneMetaSqlTemplate	UpdateOneMetaSqlTemplate	update	All Resource ``	None	None
dms:SetWorkspaceCodePublishSetting	SetWorkspaceCodePublishSetting	update	All Resource ``	None	None
dms:DeleteDataAgentSkillMeta	CreateDataAgentSkillMeta	create	All Resource ``	None	None
dms:CreateDataAgentWorkspace	CreateDataAgentWorkspace	create	All Resource ``	None	None
dms:ListDataAgentAccuracyTestTasks	ListDataAgentAccuracyTestTasks	list	All Resource ``	None	None
dms:DescribeKnowledgeBaseStats	DescribeKnowledgeBaseStats	get	All Resource ``	None	None
dms:AddDataAgentMemory	AddDataAgentMemory	create	All Resource ``	None	None
dms:ListDataAgentMcp	ListDataAgentMcp	list	All Resource ``	None	None
dms:DeleteDocumentChunks	DeleteDocumentChunks	delete	All Resource ``	None	None
dms:DeleteDataAgentMcp	DeleteDataAgentMcp	delete	All Resource ``	None	None
dms:ConfigDataAgentMemory	ConfigDataAgentMemory	update	All Resource ``	None	None
dms:SaveWorkspaceCode	SaveWorkspaceCode	update	All Resource ``	None	None
dms:DeleteDataAgentSkillMeta	DeleteDataAgentSkillMeta	delete	All Resource ``	None	None
dms:ListOneMetaOssieModels	ListOneMetaOssieModels	list	All Resource ``	None	None
dms:ListDataCenterDatabase	ListDataCenterDatabase	list	All Resource ``	None	None
dms:CheckDataAgentMemoryConfig	CheckDataAgentMemoryConfig	get	All Resource ``	None	None
dms:CreateDataAgentAccuracyTest	CreateDataAgentAccuracyTest	create	All Resource ``	None	None
dms:GetDataAgentTaskModelUsage	GetDataAgentTaskModelUsage	create	All Resource ``	None	None
dms:GetChatContent	GetChatContent	get	All Resource ``	None	None
dms:GetOneMetaOssieModel	GetOneMetaOssieModel	delete	All Resource ``	None	None
dms:InstallDataAgentMcp	InstallDataAgentMcp	create	All Resource ``	None	None
dms:CreateDataAgentSession	CreateDataAgentSession	create	All Resource ``	None	None
dms:DeleteAirflow	DeleteAirflow	delete	All Resource ``	None	None
dms:CreateAirflowLoginToken	CreateAirflowLoginToken	get	All Resource ``	None	None
dms:DescribeSkillFileUploadSignature	DescribeSkillFileUploadSignature	get	All Resource ``	None	None
dms:ListAgenticDatabase	ListAgenticDatabase	list	All Resource ``	None	None
dms:CreateCustomAgent	CreateCustomAgent	create	All Resource ``	None	None
dms:ListCustomAgentMonitorSessions	ListCustomAgentMonitorSessions	list	All Resource ``	None	None
dms:CreateOneMetaSqlTemplate	CreateOneMetaSqlTemplate	create	All Resource ``	None	None
dms:ListCustomAgent	ListCustomAgent	list	All Resource ``	None	None
dms:ListDocuments	ListDocuments	list	All Resource ``	None	None
dms:DescribeDataAgentSession	DescribeDataAgentSession	create	All Resource ``	None	None
dms:DeleteOneMetaSqlTemplate	DeleteOneMetaSqlTemplate	delete	All Resource ``	None	None
dms:DeleteDataAgentMemory	DeleteDataAgentMemory	delete	All Resource ``	None	None
dms:DescribeCustomAgentMonitorMetrics	DescribeCustomAgentMonitorMetrics	get	All Resource ``	None	None
dms:UpdateDataAgentSpaceInfo	UpdateDataAgentSpaceInfo	update	All Resource ``	None	None
dms:GetNotebookTaskStatus	GetNotebookTaskStatus	get	All Resource ``	None	None
dms:UpdateAirflow	UpdateAirflow	update	All Resource ``	None	None
dms:StartListMcpServerTools	StartListMcpServerTools	create	All Resource ``	None	None
dms:UpdateKnowledgeBase	UpdateKnowledgeBase	update	All Resource ``	None	None
dms:UpdateAgenticDataSource	UpdateAgenticDataSource	update	All Resource ``	None	None
dms:ListDataAgentWorkspaceMember	ListDataAgentWorkspaceMember	list	All Resource ``	None	None
dms:RedeployAirflow	RedeployAirflow	update	All Resource ``	None	None
dms:GetAgenticTableColumn	GetAgenticTableColumn	get	All Resource ``	None	None
dms:CreateDataAgentFeedback	CreateDataAgentFeedback	create	All Resource ``	None	None
dms:ListDocumentChunks	ListDocumentChunks	list	All Resource ``	None	None
dms:ListDataAgentSession	ListDataAgentSession	list	All Resource ``	None	None
dms:ListAgenticDataSources	ListAgenticDataSources	list	All Resource ``	None	None
dms:DescribeFileUploadSignature	DescribeFileUploadSignature	get	All Resource ``	None	None
dms:InitWorkspaceSystemMcpServer	InitWorkspaceSystemMcpServer	delete	All Resource ``	None	None
dms:GetDataAgentMcp	GetDataAgentMcp	get	All Resource ``	None	None
dms:FileUploadCallback	FileUploadCallback	update	All Resource ``	None	None
dms:DescribeDataAgentTheme	DescribeDataAgentTheme	get	All Resource ``	None	None
dms:ListWorkspaceCode	ListWorkspaceCode	get	All Resource ``	None	None
dms:StopDataAgentAccuracyTestTask	StopDataAgentAccuracyTestTask	create	All Resource ``	None	None
dms:DeleteDocument	DeleteDocument	delete	All Resource ``	None	None
dms:WorkspaceActionLog	WorkspaceActionLog	get	All Resource ``	None	None
dms:CreateDataAgentKnowledgeBase	CreateDataAgentKnowledgeBase	create	All Resource ``	None	None
dms:WorkspaceCodePublish	WorkspaceCodePublish	update	All Resource ``	None	None
dms:GetDataAgentThemeUploadSignature	GetDataAgentThemeUploadSignature	get	All Resource ``	None	None
dms:UpdateDataAgentMemory	UpdateDataAgentMemory	update	All Resource ``	None	None
dms:ListFileUpload	ListFileUpload	list	All Resource ``	None	None
dms:ListDataAgentAccuracyTestResults	ListDataAgentAccuracyTestResults	list	All Resource ``	None	None
dms:RemoveUserToDataAgentWorkspace	RemoveUserToDataAgentWorkspace	delete	All Resource ``	None	None
dms:AddAgenticDataSource	AddAgenticDataSource	create	All Resource ``	None	None
dms:WorkspaceActionStatus	WorkspaceActionStatus	get	All Resource ``	None	None
dms:ListAirflowVersions	ListAirflowVersions	get	All Resource ``	None	None
dms:GetDataAgentTaskModelUsageMetrics	GetDataAgentTaskModelUsageMetrics	create	All Resource ``	None	None
dms:ListDataCenterTable	ListDataCenterTable	list	All Resource ``	None	None
dms:StartDataAgentAccuracyTestTask	StartDataAgentAccuracyTestTask	create	All Resource ``	None	None
dms:ModifyDataAgentTheme	ModifyDataAgentTheme	update	All Resource ``	None	None
dms:GetSqlConsoleOperationLog	GetSqlConsoleOperationLog	get	All Resource ``	None	None
dms:GetAgenticAgentByInstallToken	GetAgenticAgentByInstallToken	get	All Resource ``	None	None
dms:UpdateDocument	UpdateDocument	update	All Resource ``	None	None
dms:GetDataAgentSubAccountInfo	GetDataAgentSubAccountInfo	get	All Resource ``	None	None
dms:TestAgenticDataSourceConnection	TestAgenticDataSourceConnection	none	All Resource ``	None	None
dms:ListDataAgentMemory	ListDataAgentMemory	get	All Resource ``	None	None
dms:ListAgenticCatalog	ListAgenticCatalog	list	All Resource ``	None	None
dms:GetAgenticCatalog	GetAgenticCatalog	get	All Resource ``	None	None
dms:GetWorkspaceCode	GetWorkspaceCode	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Data Management. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Data Management does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: