RAM authorization-AI Guardrails(AI Guardrails)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by AI Guardrails for RAM permission policies. The RAM code (RamCode) for AI Guardrails is yundun-greenweb , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by AI Guardrails. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
yundun-greenweb:UpdateServiceConfig	UpdateServiceConfig	update	All Resource ``	None	None
yundun-greenweb:ModifyServiceInfo	ModifyServiceInfo	update	All Resource ``	None	None
yundun-greenweb:CreateImageLib	CreateImageLib	create	All Resource ``	None	None
yundun-greenweb:UpdateOssCheckResultsFeedBack	UpdateOssCheckResultsFeedBack	update	All Resource ``	None	None
yundun-greenweb:DeleteKeywordLib	DeleteKeywordLib	delete	All Resource ``	None	None
yundun-greenweb:ExportScanResult	ExportScanResult	list	All Resource ``	None	None
yundun-greenweb:GetTuneProposalById	GetTuneProposalById	get	All Resource ``	None	None
yundun-greenweb:GetOssCheckStat	GetOssCheckStat	get	All Resource ``	None	None
yundun-greenweb:UpdateKeywordLib	UpdateKeywordLib	update	All Resource ``	None	None
yundun-greenweb:GetKeywordLib	GetKeywordLib	get	All Resource ``	None	None
yundun-greenweb:AddKeywordsToLib	AddKeywordsToLib	create	All Resource ``	None	None
yundun-greenweb:GetKeywordImportResult	GetKeywordImportResult	get	All Resource ``	None	None
yundun-greenweb:ListAppConfigs	ListAppConfigs	list	All Resource ``	None	None
yundun-greenweb:QueryCallback	QueryCallback	list	All Resource ``	None	None
yundun-greenweb:GetAiAppNodeDetail	GetAiAppNodeDetail	none	All Resource ``	None	None
yundun-greenweb:GetScanResult	GetScanResult	get	All Resource ``	None	None
yundun-greenweb:GetJobNameList	GetJobNameList	get	All Resource ``	None	None
yundun-greenweb:ExportResult	ExportResult	list	All Resource ``	None	None
yundun-greenweb:ListAiAppRiskEventByPage	ListAiAppRiskEventByPage	list	All Resource ``	None	None
yundun-greenweb:GetAiAppStats	GetAiAppStats	none	All Resource ``	None	None
yundun-greenweb:GetTextScanResult	GetTextScanResult	get	All Resource ``	None	None
yundun-greenweb:GetScanNum	GetScanNum	get	All Resource ``	None	None
yundun-greenweb:UpdateOssCheckResultsUnfreeze	UpdateOssCheckResultsUnfreeze	update	All Resource ``	None	None
yundun-greenweb:UpdateEventStatus	UpdateEventStatus	none	All Resource ``	None	None
yundun-greenweb:ListAnswerLib	ListAnswerLib	list	All Resource ``	None	None
yundun-greenweb:ListAiAppWarningByPage	ListAiAppWarningByPage	none	All Resource ``	None	None
yundun-greenweb:ListImageLib	ListImageLib	list	All Resource ``	None	None
yundun-greenweb:ExportKeyword	ExportKeyword	list	All Resource ``	None	None
yundun-greenweb:ListImagesFromLib	ListImagesFromLib	list	All Resource ``	None	None
yundun-greenweb:DeleteAnswerLib	DeleteAnswerLib	delete	All Resource ``	None	None
yundun-greenweb:GetBucketsList	GetBucketsList	get	All Resource ``	None	None
yundun-greenweb:CopyServiceConfig	CopyServiceConfig	create	All Resource ``	None	None
yundun-greenweb:GetServiceConfig	GetServiceConfig	get	All Resource ``	None	None
yundun-greenweb:GetExecuteTime	GetExecuteTime	get	All Resource ``	None	None
yundun-greenweb:UpdateOssCheckResultsFreeze	UpdateOssCheckResultsFreeze	update	All Resource ``	None	None
yundun-greenweb:CreateAppConfig	CreateAppConfig	create	All Resource ``	None	None
yundun-greenweb:ListServiceConfigs	ListServiceConfigs	list	All Resource ``	None	None
yundun-greenweb:CopyAppConfig	CopyAppConfig	create	All Resource ``	None	None
yundun-greenweb:CreateCallback	CreateCallback	create	All Resource ``	None	None
yundun-greenweb:UpdateOssCheckResultsBatchFeedback	UpdateOssCheckResultsBatchFeedback	update	All Resource ``	None	None
yundun-greenweb:GetAiAppOverview	GetAiAppOverview	none	All Resource ``	None	None
yundun-greenweb:DeleteImagesFromLib	DeleteImagesFromLib	delete	All Resource ``	None	None
yundun-greenweb:GetAnswerImportProgress	GetAnswerImportProgress	get	All Resource ``	None	None
yundun-greenweb:QueryAnswerSampleByPage	QueryAnswerSampleByPage	list	All Resource ``	None	None
yundun-greenweb:DeleteAnswerSample	DeleteAnswerSample	delete	All Resource ``	None	None
yundun-greenweb:ListOssCheckResult	ListOssCheckResult	list	All Resource ``	None	None
yundun-greenweb:GetGuardStatus	GetGuardStatus	none	All Resource ``	None	None
yundun-greenweb:GetAppConfig	GetAppConfig	get	All Resource ``	None	None
yundun-greenweb:ExportCipStats	ExportCipStats	list	All Resource ``	None	None
yundun-greenweb:AddImages2Lib	AddImages2Lib	create	All Resource ``	None	None
yundun-greenweb:DeleteKeyword	DeleteKeyword	delete	All Resource ``	None	None
yundun-greenweb:GetAiAppTraceDetail	GetAiAppTraceDetail	none	All Resource ``	None	None
yundun-greenweb:DeleteCallback	DeleteCallback	delete	All Resource ``	None	None
yundun-greenweb:GetCipStats	GetCipStats	get	All Resource ``	None	None
yundun-greenweb:GetAiAppDetailStat	GetAiAppDetailStat	none	All Resource ``	None	None
yundun-greenweb:CreateAnswerLib	CreateAnswerLib	create	All Resource ``	None	None
yundun-greenweb:AddAppAgent	AddAppAgent	update	All Resource ``	None	None
yundun-greenweb:ListKeywords	ListKeywords	list	All Resource ``	None	None
yundun-greenweb:GetFeatureConfig	GetFeatureConfig	get	All Resource ``	None	None
yundun-greenweb:RecoverAppConfigHistory	RecoverAppConfigHistory	update	All Resource ``	None	None
yundun-greenweb:CreatStockOssCheckTask	CreatStockOssCheckTask	create	All Resource ``	None	None
yundun-greenweb:ExportOssCheckStat	ExportOssCheckStat	list	All Resource ``	None	None
yundun-greenweb:LlmStreamChat	LlmStreamChat	get	All Resource ``	None	None
yundun-greenweb:StopOnlineTest	StopOnlineTest	update	All Resource ``	None	None
yundun-greenweb:ModifyCallback	ModifyCallback	update	All Resource ``	None	None
yundun-greenweb:GetAiAppDetail	GetAiAppDetail	none	All Resource ``	None	None
yundun-greenweb:ExportTextScanResult	ExportTextScanResult	list	All Resource ``	None	None
yundun-greenweb:AddAppConfig	AddAppConfig	create	All Resource ``	None	None
yundun-greenweb:DeleteFeatureConfig	DeleteFeatureConfig	delete	All Resource ``	None	None
yundun-greenweb:CreateOnlineTest	CreateOnlineTest	create	All Resource ``	None	None
yundun-greenweb:GetImageSceneLabelListConf	GetImageSceneLabelListConf	get	All Resource ``	None	None
yundun-greenweb:GetRiskStats	GetRiskStats	none	All Resource ``	None	None
yundun-greenweb:DeleteAppAgent	DeleteAppAgent	delete	All Resource ``	None	None
yundun-greenweb:QueryLabelConfig	QueryLabelConfig	get	All Resource ``	None	None
yundun-greenweb:DescribeOssV2Result	DescribeOssV2Result	list	All Resource ``	None	None
yundun-greenweb:QueryCallbackByPage	QueryCallbackByPage	list	All Resource ``	None	None
yundun-greenweb:ListAiAppByPage	ListAiAppByPage	none	All Resource ``	None	None
yundun-greenweb:GetServiceLabelConfig	GetServiceLabelConfig	get	All Resource ``	None	None
yundun-greenweb:GetBackupStatus	GetBackupStatus	get	All Resource ``	None	None
yundun-greenweb:PublishAppConfig	PublishAppConfig	update	All Resource ``	None	None
yundun-greenweb:GetBackupConfig	GetBackupConfig	get	All Resource ``	None	None
yundun-greenweb:GetStockOssCheckTasksList	GetStockOssCheckTasksList	get	All Resource ``	None	None
yundun-greenweb:GetPromptTestResult	GetPromptTestResult	get	All Resource ``	None	None
yundun-greenweb:InitAiAppScan	InitAiAppScan	get	All Resource ``	None	None
yundun-greenweb:GetUploadInfo	GetUploadInfo	get	All Resource ``	None	None
yundun-greenweb:ListCallback	ListCallback	list	All Resource ``	None	None
yundun-greenweb:CreatePreCheck	CreatePreCheck	create	All Resource ``	None	None
yundun-greenweb:ModifyFeatureConfig	ModifyFeatureConfig	update	All Resource ``	None	None
yundun-greenweb:ModifyAppAgent	ModifyAppAgent	update	All Resource ``	None	None
yundun-greenweb:GetUploadContent	GetUploadContent	none	All Resource ``	None	None
yundun-greenweb:DescribeOnlineTestResult	DescribeOnlineTestResult	get	All Resource ``	None	None
yundun-greenweb:MarkOssV2Result	MarkOssV2Result	update	All Resource ``	None	None
yundun-greenweb:ExportAnswerSample	ExportAnswerSample	list	All Resource ``	None	None
yundun-greenweb:ListAppConfigHistory	ListAppConfigHistory	list	All Resource ``	None	None
yundun-greenweb:AddImageLib	AddImageLib	create	All Resource ``	None	None
yundun-greenweb:DeleteOnlineTest	DeleteOnlineTest	delete	All Resource ``	None	None
yundun-greenweb:GetGuardLogStats	GetGuardLogStats	get	All Resource ``	None	None
yundun-greenweb:ModifyAnswerLib	ModifyAnswerLib	update	All Resource ``	None	None
yundun-greenweb:ConfirmAiAppScan	ConfirmAiAppScan	none	All Resource ``	None	None
yundun-greenweb:GetImageSceneLabelConf	GetImageSceneLabelConf	get	All Resource ``	None	None
yundun-greenweb:UpdateScanResultFeedback	UpdateScanResultFeedback	update	All Resource ``	None	None
yundun-greenweb:GetOssCheckFreezeResult	GetOssCheckFreezeResult	get	All Resource ``	None	None
yundun-greenweb:CancelStockOssCheckTask	CancelStockOssCheckTask	none	All Resource ``	None	None
yundun-greenweb:UpdateMetaLog	UpdateMetaLog	update	All Resource ``	None	None
yundun-greenweb:GetUserBuyStatus	GetUserBuyStatus	get	All Resource ``	None	None
yundun-greenweb:GetAiAppDetailTopo	GetAiAppDetailTopo	none	All Resource ``	None	None
yundun-greenweb:GetOssCheckStatus	GetOssCheckStatus	get	All Resource ``	None	None
yundun-greenweb:AddKeywordLib	AddKeywordLib	create	All Resource ``	None	None
yundun-greenweb:UpdateAiAppScanStatus	UpdateAiAppScanStatus	none	All Resource ``	None	None
yundun-greenweb:OssCheckResultList	OssCheckResultList	list	All Resource ``	None	None
yundun-greenweb:GetOssCheckResultDetail	GetOssCheckResultDetail	get	All Resource ``	None	None
yundun-greenweb:AddAnswerSample	AddAnswerSample	create	All Resource ``	None	None
yundun-greenweb:GetOssCheckTaskInfo	GetOssCheckTaskInfo	get	All Resource ``	None	None
yundun-greenweb:GetQpsStats	GetQpsStats	get	All Resource ``	None	None
yundun-greenweb:ListKeywordLibs	ListKeywordLibs	list	All Resource ``	None	None
yundun-greenweb:GetServiceConf	GetServiceConf	get	All Resource ``	None	None
yundun-greenweb:ModifyAppInfo	ModifyAppInfo	update	All Resource ``	None	None
yundun-greenweb:GetUploadLink	GetUploadLink	get	All Resource ``	None	None
yundun-greenweb:UpdateImageLibFreeInspection	UpdateImageLibFreeInspection	update	All Resource ``	None	None
yundun-greenweb:UpdateImageLib	UpdateImageLib	update	All Resource ``	None	None
yundun-greenweb:GetBackupBucketsList	GetBackupBucketsList	get	All Resource ``	None	None
yundun-greenweb:ListAiAppRiskEvent	ListAiAppRiskEvent	none	All Resource ``	None	None
yundun-greenweb:AddKeywords	AddKeywords	create	All Resource ``	None	None
yundun-greenweb:UpdateBackupConfig	UpdateBackupConfig	update	All Resource ``	None	None

Resource

The following table lists the resources defined by AI Guardrails. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

AI Guardrails does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: