How to grant a RAM user read-only permissions on AI Guardrails-AI Guardrails(AI Guardrails)-阿里云帮助中心

The built-in AliyunYundunGreenWebFullAccess policy grants full administrative access to AI Guardrails. To grant a RAM user read-only access instead, create a custom policy that permits only List, Get, Describe, and Query operations, and then attach it to the user.

A RAM user with read-only permissions cannot perform write operations such as configuring OSS violation detection scan settings or managing detection results in the console.

Prerequisites

Make sure the following conditions are met:

The AliyunYundunGreenWebFullAccess policy is not attached directly to the RAM user. If it is, revoke it from the user.
If the RAM user inherits AliyunYundunGreenWebFullAccess from a user group, either revoke it from the group or remove the user from the group.

Grant read-only permissions

Complete the following two stages: create a custom read-only policy, and then attach it to the RAM user.

Step 1: Create the custom policy

Log on to the RAM console as a RAM administrator.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON tab.

Replace the default content with the following policy, then click OK.

{
    "Version": "1",
    "Statement": [{
        "Action": [
            "yundun-greenweb:List*",
            "yundun-greenweb:Get*",
            "yundun-greenweb:Describe*",
            "yundun-greenweb:Query*"
            ],
        "Resource": "*",
        "Effect": "Allow"
    }]
}

In the Create Policy dialog box, enter a Policy Name and a Description, then click OK.

Step 2: Attach the policy to the RAM user

In the left navigation pane, choose Identities > Users. Find the RAM user, then click Add Permissions in the Actions column.
In the Add Permissions panel, select the custom policy you created, then click OK.

The RAM user now has read-only access to AI Guardrails.