Ant Blockchain RAM authentication

Authorizable Ant Blockchain resource types

When you grant permissions to a RAM user, use the following format to specify Ant Blockchain resources:

In these formats, $consortiumId is the consortium ID, $blockchainId is the blockchain ID, and $projectId is the contract project ID within the consortium.

Authorizable Ant Blockchain APIs

The following table lists the authorizable Ant Blockchain APIs and their descriptions.

Ant Blockchain RAM rule examples

Example 1: Grant read-only permissions for BaaS operations. These permissions allow a user to view the blockchain status and download the SDK from the console or using an API.

{

   "Statement": [{

       "Action": ["baas:DescribeAntChain*"],

        "Effect": "Allow",

        "Resource": "acs:baas:*:*:*"

   }],

   "Version": "1"

}

{

  "Statement": [{

     "Action": "baas:*AntChainConsortium*",

     "Effect": "Allow",
     "Resource": ["acs:baas:*:*:antChainConsortium/*"]

  }],

  "Version": "1"

}

Example 3: Grant fine-grained permissions to a chaincode developer. These permissions usually include all read operations and resource management operations for a specific consortium. To follow the principle of least privilege for contract management, you can restrict the user to operations on a specific contract project in a specific consortium. Replace antChainConsortium/$consortiumId/contractProject/$projectId with the ID of the resource in Blockchain as a Service.

{

 "Statement": [{

   "Action": ["baas:DescribeAntChain*"],

    "Effect": "Allow",

    "Resource": "acs:baas:*:*:*"

 },

 {

    "Action": "baas:*AntChainContract*",

    "Effect": "Allow",

    "Resource": ["acs:baas:*:*:antChainConsortium/$consortiumId/contractProject/$projectId"]

 }],

 "Version": "1"

}