How to implement fine-grained access control-Scalable Open Financial Architecture(SOFAStack)-阿里云帮助中心

SOFAStack integrates with the Alibaba Cloud Resource Access Management (RAM) account system. This lets you configure permissions for Alibaba Cloud products using a unified account system. SOFAStack provides default platform-level access policies. For more fine-grained permission settings, SOFAStack provides enhanced access control for the entire deployment pipeline. This applies to the LDC, Container Application Service (AKS), and Classic Application Service (CAS) modules within SOFAStack operations management.

Permission breakdown rules

The following tables show the mapping between the LHC, AKS, and CAS APIs and the access policies in RAM.

Note

For more information about Action and Resource, see Basic elements of an access policy.

Table 1. Mapping between LHC Deployment Pipeline APIs and Resources

Module classification	Description	Action	Resource	Isolation level
Application service	Create container application service	CreateLDCContainerService	*	App Workspace
Application service	Update container application service	UpdateLDCContainerService	*	App Workspace
ConfigMap	Create configuration item	CreateLDCFederationConfigmap	*	Workspace
	Update configuration item	UpdateLDCFederationConfigmap	*	Workspace
	Delete configuration item	DeleteLDCFederationConfigmap	*	Workspace
	View configuration item	GetLDCFederationConfigmap	*	Workspace
Secret	Create secret	CreateLDCFederationSecret	*	Workspace
	Update secret	UpdateLDCFederationSecret	*	Workspace
	Delete secret	DeleteLDCFederationSecret	*	Workspace
Deployment	Create deployment	CreateLDCContainerserviceDeployment	*	Workspace

Table 2. Mapping between AKS Deployment Pipeline APIs and Resources

Module classification	Description	Action	Resource
Workspace	Create workspace	CreateWorkspace	tenant/$tenantId
Workspace	Query workspace list	ListWorkspace	tenant/$tenantId
Cluster management	Create cluster	CreateCluster	workspace/$workspaceId/cluster/
	Import cluster	ImportCluster	workspace/$workspaceId/cluster/
	Release cluster	ReleaseCluster	workspace/$workspaceId/cluster/$clusterId/
	Scale out cluster	ScaleCluster	workspace/$workspaceId/cluster/$clusterId/
	Import nodes to cluster	ImportClusterNodes	workspace/$workspaceId/cluster/$clusterId/
	Delete cluster nodes	ReleaseClusterNodes	workspace/$workspaceId/cluster/$clusterId/
	Query cluster list	ListClusters	workspace/$workspaceId/cluster/
	Query cluster logs	DescribeClusterLogs	workspace/$workspaceId/cluster/$clusterId/
Application metadata	Create application	CreateApp	application/
	Query application	GetApp	application/$appId
	Query application list	QueryApp	application/
Application service	Create container service	CreateAKSContainerServices	application/$appId/workspace/$workspaceId/containerservice
	Query container service list	ListAKSContainerservices	application///containerservice
	Create/Update container application service edition	SaveAKSContainerservicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Query container application service edition list	ListAKSContainerServicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Query container application service edition	GetAKSContainerServicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Query service list	GetAKSContainerservices	application/$appId/workspace/$workspaceId/containerservice
	Get description of a container service	ReceiveAKSContainerservices	application/$appId/workspace/$workspaceId/containerservice
	Get the latest revision for editing	ReceiveAKSContainerservicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Copy a new draft of a container service	CloneAKSContainerservicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Create container service edition	UpdateAKSContainerservicesRevisions	application/$appId/workspace/$workspaceId/containerservice
	Quickly update image	UpdateAKSContainerservicesImage	application/$appId/workspace/$workspaceId/containerservice
	Quickly update replicas	UpdateAKSContainerservicesReplicas	application/$appId/workspace/$workspaceId/containerservice
	Delete container service	DeleteAKSContainerservices	application/$appId/workspace/$workspaceId/containerservice
	Delete container service pod	DeleteAKSContainerservicesPods	application/$appId/workspace/$workspaceId/containerservice
	Update container service edition remark	UpdateAKSContainerservicesRevisionremark	application/$appId/workspace/$workspaceId/containerservice
	Update a deployment package for a container service	UploadAKSContainerservicesPackage	application//workspace//containerservice
	Download container service deployment package	DownloadAKSContainerservicesPackage	application//workspace//containerservice
	Delete container service deployment package	DeleteAKSContainerservicesPackage	application//workspace//containerservice
	Delete OSS storage resource by path	DeleteAKSStorage	application//workspace//containerservice
	Download OSS resource by path	DownloadAKSStorage	application//workspace//containerservice
	Query container service events	ListAKSEvent	application//workspace//containerservice
Deployment plan	Roll back deployment plan	RollbackAKSOpsContainerService	workspace/$workspaceId/opsplan
	Cancel rollback	CancelAKSOpsContainerService	workspace/$workspaceId/opsplan
	Create deployment plan	CreateAKSPlan	workspace/$workspaceId/opsplan
	Execute deployment plan	ExecAKSPlan	workspace/$workspaceId/opsplan
	Cancel deployment plan	CancelAKSPlan	workspace/$workspaceId/opsplan
	Query deployment plan	GetAKSPlan	workspace/$workspaceId/opsplan

Table 3. Mapping between CAS Deployment Pipeline APIs and Resources

Note

The Workspace and Application metadata modules are common modules. The CAS content for these modules is the same as the AKS content shown in Table 2.
For resource-related APIs, only ECS resources are listed. Other resource APIs, such as those for Server Load Balancer (SLB), ApsaraDB RDS, ApsaraDB for Memcache, and ApsaraDB for Redis, have a similar structure.

Module classification	Description	Action	Resource
Application service	Create application service	CreateCASAppservice	workspace/$workspaceId/classicservice/
	Query application service list	ListCASAppservices	workspace/$workspaceId/classicservice/
	Query application service	GetCASAppserviceDetail	workspace/$workspaceId/classicservice/$serviceId
	Delete application service	DeleteCASAppservice	workspace/$workspaceId/classicservice/$serviceId
ECS resources	Create machine resource	CreateCasComputer	workspace/$workspaceId/computer/
	Query machine list	DescribeCasComputers	workspace/$workspaceId/computer/
	Release machine resource	ReleaseCasComputer	workspace/$workspaceId/computer/$computerId
Deployment plan	Create application deployment plan	CreateDEPSPlan	workspace/$workspaceId/classicopsplan
	Query application deployment plan list	QueryDEPSPlan	workspace/$workspaceId/classicopsplan
	Execute deployment plan	ExecDEPSPlan	workspace/$workspaceId/classicopsplan
	Query application execution details in a deployment plan	GetDEPSPlanProgress	workspace/$workspaceId/classicopsplan
	Create application O&M deployment plan	CreateDEPSPlanOperation	workspace/$workspaceId/classicopsplan
	Check application O&M deployment plan	CheckDEPSPlanOperation	workspace/$workspaceId/classicopsplan

System roles

AKS and CAS provide three default roles: Admin, DevOps, and Observer. The following table classifies the APIs mentioned previously and describes the API permissions for each role.

Note

The following access policies are examples only. The policies displayed in the console take precedence.

Role type	Role name	Resource operation permissions (Action)	Access policy (RAM Policy)
Admin	AliyunSOFAAdmin	Has permissions to perform all operations on all resources.	`json { "Statement": [ { "Action": "sofa:", "Effect": "Allow", "Resource": "" } ], "Version": "1" }`
DevOps engineer	AliyunSOFADevOps	AKS: DevOps engineers cannot create workspaces or clusters. They also cannot roll back or cancel the rollback of a deployment plan. CAS: DevOps engineers cannot create workspaces. They have the following permissions: Query workspace list Create/Update/Query/Delete application groups Create/Query/Update/Delete applications Create/Query/Attach/Detach machine resources Create/Query/Update/Delete application services Create/Query/Update/Delete deployment plans	`json { "Statement": [ { "Action": [ "sofa:CreateCluster", "sofa:CreateWorkspace", "sofa:CancelAKSOpsContainerService", "sofa:CancelAKSPlan" ], "Effect": "Deny", "Resource": "" }, { "Action": "sofa:", "Effect": "Allow", "Resource": "*" } ], "Version": "1" }`
Observer	AliyunSOFAObserver	Has read-only permissions.	`json { "Statement": [ { "Effect": "Allow", "Action": [ "sofa:Get", "sofa:List", "sofa:Query", "sofa:Find", "sofa:Exist", "sofa:Count", "sofa:Receive" ], "Resource": "" ], "Version": "1" }`

Variables in the Resource element of an access policy

The following variables can be used in the Resource element of an access policy statement:

$workspaceId: The workspace ID. You can obtain it from the workspace details page under Global Settings.
$namespace: The namespace name. In the SOFAStack console, go to Container Service for Kubernetes > Cluster Management > Namespaces in the navigation pane on the left to obtain the name from the list page.
$clusterId: The cluster ID. For an ACK cluster, you can obtain the ID from the Overview tab of the cluster details page.
$appId: The application ID. You can obtain it from the Basic Information tab on the application list page in Application Management.
$serviceId: The Classic Application Service ID. You can obtain it from the service instance details page of the classic application service.
$computerId: The Elastic Compute Service (ECS) ID. You can obtain it from the Elastic Compute Service tab on the service instance details page of the classic application service.

LHC access policy examples

Example: Restrict a role to creating application services only within a specific workspace using the workspace ID.

 {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "sofa:CreateLDCContainerService"
              ],
              "Resource": "acs:sofa:*:*:*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "sofa:Workspace": [
                          "2183736860"
                      ]
                  }
              }
          }
      ]
  }

Note

For other APIs, you can replace the Action.

AKS access policy examples

Release

Example 1: Prevent a role from performing deployment operations on a specific application using the app ID.

// Prevents deployment operations on a specific app.
{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "sofa:ExecAKSPlan"
            ],
            "Resource": "acs:sofa:*:*:workspace/*/opsplan",
            "Effect": "Deny",
            "Condition": {
                "StringEquals": {
                    "sofa:App": [
                        "0000000000560002"
                    ]
                }
            }
        }
    ]
}

Example 2: Prevent a role from performing deployment operations in a specific workspace using the workspace ID.

// Prevents deployment operations in a specific workspace.
{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "sofa:ExecAKSPlan"
            ],
            "Resource": "acs:sofa:*:*:workspace/*/opsplan",
            "Effect": "Deny",
            "Condition": {
                "StringEquals": {
                    "sofa:Workspace": [
                        "2183736860"
                    ]
                }
            }
        }
    ]
}

Create and grant a custom policy

If the default system policies do not meet your requirements, you can create custom policies to implement fine-grained permission management.

Prerequisites

Before you create a custom policy, you must understand the basic structure and syntax of the access policy language. For more information, see Syntax and structure of RAM policies.

Fine-grained access control

Permission breakdown rules

System roles

Variables in the Resource element of an access policy

LHC access policy examples

AKS access policy examples

Create and grant a custom policy

Prerequisites

Procedure