grant a custom policy to a ram user-Enterprise Mobile Application Studio(EMAS)-阿里云帮助中心

For fine-grained permission control, you can create a custom policy and grant it to a Resource Access Management (RAM) user. This topic describes how to create a custom policy and grant it to a RAM user.

Prerequisites

A RAM user has been created. For more information, see Create a RAM user.
You are logged on to the RAM console using an Alibaba Cloud account or as a RAM administrator.

Create a custom policy

On the Resource Access Management page, choose Permission Management > Access Policies.
Click Create Policy. On the Create Policy page, click the Script Editor tab.
On the Script Editor tab, you can edit the policy in the text box. Alternatively, you can click Import Policy to import and then edit a policy template or a system policy.
This step uses the AliyunMHubFullAccess policy as an example. On the import policy page, enter the keyword MHub to search for the policy. In the search results, click the policy and import it. The policy is then added to the text box.
The following code block shows the policy content. You can modify the policy content as required. If you want to grant more permissions to the RAM user, see Mhub RAM authentication operations and resources for information about how to configure the Action and Resource elements. For more information about policy syntax, see Policy structure and syntax.

Note
The * in the policy content is a wildcard. For example, mhub:* grants permissions for all operations on the mHub service.

{
  "Version": "1",
  "Statement": [
    {
      "Action": "mhub:*",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "httpdns:QueryActivationStatus",
        "httpdns:GetResolveCountSummary"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "mpush:QueryActivationStatus",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "emasdevops:QueryActivationStatus",
        "emasdevops:GetPublishStatistics",
        "emasdevops:GetPipelineInstanceData"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "hotfix:QueryActivationStatus",
        "hotfix:QueryMonthUsageInfoByApp"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "feedback:QueryActivationStatus",
        "feedback:DescribeSessionOverview"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "mpserverless:QueryActivationStatus",
        "mpserverless:QuerySpaceUsage"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

6. Click OK. In the Create Policy dialog box, enter a Name and Note.

Grant a custom policy to a RAM user

On the Resource Access Management page, choose Permission Management > Grant Permission.
Click Grant Permission to open the side panel.
In the side panel, configure the authorization settings. The following table describes the configurations.

Option	Instructions
Resource Scope	Select an Account Level. Alibaba Cloud Account: The permissions take effect within the current Alibaba Cloud account. Resource Group: The permissions take effect within the specified resource group.
Principal	Enter a keyword to search for and select a RAM user. Note The RAM user must be created in advance. For more information, see Create a RAM user.
Access Policy	1. Select the Custom Policy option. 2. Enter a keyword to search for the policy. 3. Select one or more policies as needed and add them to the Selected list on the right.

Click OK to complete the authorization.