Grant RAM authorization for the monitoring and alert service

Prerequisites

Before you begin, ensure that you have:

• A RAM user created under your Alibaba Cloud account. See Create a RAM user.

Grant CloudMonitor permissions to a RAM user

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the RAM user and click Add Permissions in the Actions column.

4. In the Grant Permissions panel, set Resource Scope to Account, then select one or more policies.

   Choose a policy type

   Start with a system policy for most use cases. Switch to a custom policy only if you need to restrict access to specific CloudMonitor actions.

   • System policy (recommended): Select a policy from the list and click OK.

     Policy name	Description
     AliyunCloudMonitorFullAccess	Permissions to manage CloudMonitor resources
     AliyunCloudMonitorReadOnlyAccess	Read-only permissions for CloudMonitor resources

     

   • Custom policy: Select a custom policy from the list. To create one, see Create custom policies.

     Example: Allow exporting monitoring data

     The following policy grants permission to export CloudMonitor data using the cms:BatchGet and cms:Cursor actions.

     {
       "Version": "1",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": [
             "cms:BatchGet",
             "cms:Cursor"
           ],
           "Resource": [
             "*"
           ],
           "Condition": {}
         }
       ]
     }

   CloudMonitor allows you to grant RAM users the permissions only on an Alibaba Cloud account.

5. After the Succeed message appears, click Complete.

   

For more information about how to grant a RAM user the permissions to use CloudMonitor, see Grant permissions to a RAM user.