Use RAM to limit the IP addresses that can be used to call the API operations of AI Guardrails-AI Guardrails(AI Guardrails)-阿里云帮助中心

If an AccessKey pair for a RAM user is exposed, an attacker can call AI Guardrails API operations from any IP address. To reduce this risk, attach a custom RAM policy that restricts API calls to a set of trusted IP addresses or CIDR ranges. Requests from any other address are denied.

Prerequisites

Before you begin, make sure you have:

Access to the RAM console as a RAM administrator
The IP addresses or CIDR ranges you want to allow

Restrict API access by IP address

Log on to the RAM console as a RAM administrator.
Create a RAM user, select OpenAPI Access, and record the AccessKey pair generated for the RAM user. For details, see Create a RAM user.
Create a custom policy. For background on IP-based RAM policies, see Use RAM to limit the IP addresses that are allowed to access Alibaba Cloud resources. The following example policy allows the RAM user to call all AI Guardrails API operations (yundun-greenweb:*) only from 192.X.X.X/24 and 203.X.X.X. Requests from any other IP address are denied.
```
{
    "Version": "1",
    "Statement": [
        {
            "Action": "yundun-greenweb:*",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "192.X.X.X/24",
                        "203.X.X.X"
                    ]
                }
            }
        }
    ]
}
```
Replace 192.X.X.X/24 and 203.X.X.X with your actual IP addresses or CIDR ranges.
Attach the custom policy to the RAM user. After the policy is attached, the RAM user can only call AI Guardrails API operations from the IP addresses specified in acs:SourceIp.