RAM authorization-AI Guardrails(AI Guardrails)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by AI Guardrails for RAM permission policies. The RAM code (RamCode) for AI Guardrails is yundun-greenweb , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by AI Guardrails. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
yundun-greenweb:StopOssIncrementCheck	StopOssIncrementCheck	update	All Resource ``	None	None
yundun-greenweb:DeleteCallback	DeleteCallback	delete	Callback `acs:yundun-greenweb::{#accountId}:callback/{#CallbackId}`	None	None
yundun-greenweb:DeleteBizType	DeleteBizType	delete	BizType `acs:yundun-greenweb::{#accountId}:biztype/{#BizTypeName}`	None	None
yundun-greenweb:DescribeCloudMonitorServices	DescribeCloudMonitorServices	get	All Resource ``	None	None
yundun-greenweb:DescribeImageLib	DescribeImageLib	get	ImageLib `acs:yundun-greenweb::{#accountId}:imagelib/*`	None	None
yundun-greenweb:UpdateWebsiteInstance	UpdateWebsiteInstance	update	All Resource ``	None	None
yundun-greenweb:CreateKeyword	CreateKeyword	create	All Resource ``	None	None
yundun-greenweb:DescribeBizTypeTextLib	DescribeBizTypeTextLib	get	All Resource ``	None	None
yundun-greenweb:UpdateWebsiteInstanceKeyUrl	UpdateWebsiteInstanceKeyUrl	update	All Resource ``	None	None
yundun-greenweb:DescribeOssStockScanTaskStatData	DescribeOssStockScanTaskStatData	get	All Resource ``	None	None
yundun-greenweb:UpdateBizTypeTextLib	UpdateBizTypeTextLib	update	All Resource ``	None	None
yundun-greenweb:UpdateAuditRange	UpdateAuditRange	update	All Resource ``	None	None
yundun-greenweb:DescribeWebsiteIndexPageBaseline	DescribeWebsiteIndexPageBaseline	get	All Resource ``	None	None
yundun-greenweb:UpdateBizTypeResultBackupSetting	UpdateBizTypeResultBackupSetting	update	All Resource ``	None	None
yundun-greenweb:DescribeUserBizTypes	DescribeUserBizTypes	get	BizType `acs:yundun-greenweb::{#accountId}:biztype/*`	None	None
yundun-greenweb:DescribeBizTypeAuditRange	DescribeBizTypeAuditRange	get	All Resource ``	None	None
yundun-greenweb:ModifyAuditCallback	ModifyAuditCallback	update	AuditCallback `acs:yundun-greenweb::{#accountId}:auditcallback/{#AuditCallbackName}`	None	None
yundun-greenweb:DescribeWebsiteStat	DescribeWebsiteStat	get	All Resource ``	None	None
yundun-greenweb:DescribeBizTypeSetting	DescribeBizTypeSetting	get	All Resource ``	None	None
yundun-greenweb:GetAuditItemList	GetAuditItemList	get	All Resource ``	None	None
yundun-greenweb:DescribeWebsiteInstanceId	DescribeWebsiteInstanceId	get	All Resource ``	None	None
yundun-greenweb:DescribeWebsiteScanResult	DescribeWebsiteScanResult	get	All Resource ``	None	None
yundun-greenweb:ExportOpenApiRcpStats	ExportOpenApiRcpStats	get	All Resource ``	None	None
yundun-greenweb:UpdateOssIncrementCheckSetting	UpdateOssIncrementCheckSetting	update	All Resource ``	None	None
yundun-greenweb:ExportOpenApiUsage	ExportOpenApiUsage	get	All Resource ``	None	None
yundun-greenweb:UpdateOssStockTask	UpdateOssStockTask	update	All Resource ``	None	None
yundun-greenweb:DescribeOssConfiguration	DescribeOssConfiguration	none	All Resource ``	None	None
yundun-greenweb:MarkAuditContent	MarkAuditContent	none	All Resource ``	None	None
yundun-greenweb:VerifyWebsiteInstance	VerifyWebsiteInstance	none	All Resource ``	None	None
yundun-greenweb:UpdateBizType	UpdateBizType	update	BizType `acs:yundun-greenweb::{#accountId}:biztype/{#BizTypeName}`	None	None
yundun-greenweb:DescribeOssIncrementCheckSetting	DescribeOssIncrementCheckSetting	get	All Resource ``	None	None
yundun-greenweb:DescribeAuditRange	DescribeAuditRange	get	All Resource ``	None	None
yundun-greenweb:CreateAuditCallback	CreateAuditCallback	create	AuditCallback `acs:yundun-greenweb::{#accountId}:auditcallback/{#AuditCallbackName}`	None	None
yundun-greenweb:DescribeOpenApiMonitorAlarmSetting	DescribeOpenApiMonitorAlarmSetting	get	All Resource ``	None	None
yundun-greenweb:DeleteKeywordLib	DeleteKeywordLib	delete	KeywordLib `acs:yundun-greenweb::{#accountId}:keywordlib/{#KeywordLibId}`	None	None
yundun-greenweb:AuditItemSubmit	AuditItemSubmit	none	All Resource ``	None	None
yundun-greenweb:DescribeImageUploadInfo	DescribeImageUploadInfo	get	All Resource ``	None	None
yundun-greenweb:DescribeOpenApiRcpStats	DescribeOpenApiRcpStats	get	All Resource ``	None	None
yundun-greenweb:DescribeBizTypeResultBackupSetting	DescribeBizTypeResultBackupSetting	get	All Resource ``	None	None
yundun-greenweb:DescribeOssCallbackSetting	DescribeOssCallbackSetting	get	All Resource ``	None	None
yundun-greenweb:DescribeOpenApiMonitorData	DescribeOpenApiMonitorData	get	All Resource ``	None	None
yundun-greenweb:GetAuditUserConf	GetAuditUserConf	get	All Resource ``	None	None
yundun-greenweb:UpdateKeywordLib	UpdateKeywordLib	update	KeywordLib `acs:yundun-greenweb::{#accountId}:keywordlib/{#KeywordLibId}`	None	None
yundun-greenweb:UpdateCustomOcrTemplate	UpdateCustomOcrTemplate	update	All Resource ``	None	None
yundun-greenweb:UpdateBizTypeSetting	UpdateBizTypeSetting	update	All Resource ``	None	None
yundun-greenweb:DeleteCustomOcrTemplate	DeleteCustomOcrTemplate	delete	All Resource ``	None	None
yundun-greenweb:DescribeAuditCallback	DescribeAuditCallback	get	All Resource ``	None	None
yundun-greenweb:DeleteImageLib	DeleteImageLib	delete	ImageLib `acs:yundun-greenweb::{#accountId}:imagelib/{#ImageLibId}`	None	None
yundun-greenweb:DescribeBizTypes	DescribeBizTypes	get	All Resource ``	None	None
yundun-greenweb:DescribeKeyword	DescribeKeyword	get	All Resource ``	None	None
yundun-greenweb:DescribeUserOssBuckets	DescribeUserOssBuckets	get	All Resource ``	None	None
yundun-greenweb:DescribeAuditContent	DescribeAuditContent	get	All Resource ``	None	None
yundun-greenweb:DescribeOssStockScanUserStatus	DescribeOssStockScanUserStatus	get	All Resource ``	None	None
yundun-greenweb:DescribeWebsiteInstanceKeyUrl	DescribeWebsiteInstanceKeyUrl	get	All Resource ``	None	None
yundun-greenweb:UpdateCallbackBind	UpdateCallbackBind	update	All Resource ``	None	None
yundun-greenweb:MarkOssResult	MarkOssResult	none	All Resource ``	None	None
yundun-greenweb:CreateCallback	CreateCallback	create	Callback `acs:yundun-greenweb::{#accountId}:callback/*`	None	None
yundun-greenweb:UpdateWebsiteInstanceStatus	UpdateWebsiteInstanceStatus	update	All Resource ``	None	None
yundun-greenweb:UpdateNotificationSetting	UpdateNotificationSetting	update	All Resource ``	None	None
yundun-greenweb:DescribeAppInfo	DescribeAppInfo	get	All Resource ``	None	None
yundun-greenweb:VerifyCustomOcrTemplate	VerifyCustomOcrTemplate	none	All Resource ``	None	None
yundun-greenweb:CreateOssStockTask	CreateOssStockTask	create	OssStockTask `acs:yundun-greenweb::{#accountId}:ossstocktask/*`	None	None
yundun-greenweb:DescribeOssIncrementStats	DescribeOssIncrementStats	get	All Resource ``	None	None
yundun-greenweb:DeleteKeyword	DeleteKeyword	delete	All Resource ``	None	None
yundun-greenweb:UpdateImageLib	UpdateImageLib	update	ImageLib `acs:yundun-greenweb::{#accountId}:imagelib/{#ImageLibId}`	None	None
yundun-greenweb:UploadImageToLib	UploadImageToLib	none	All Resource ``	None	None
yundun-greenweb:DescribeWebsiteVerifyInfo	DescribeWebsiteVerifyInfo	get	All Resource ``	None	None
yundun-greenweb:DescribeBizTypeImageLib	DescribeBizTypeImageLib	get	All Resource ``	None	None
yundun-greenweb:DescribeNotificationSetting	DescribeNotificationSetting	get	All Resource ``	None	None
yundun-greenweb:DescribeOssStockTaskSetting	DescribeOssStockTaskSetting	get	OssStockTask `acs:yundun-greenweb::{#accountId}:ossstocktask/{#OssStockTaskId}`	None	None
yundun-greenweb:CreateBizType	CreateBizType	create	BizType `acs:yundun-greenweb::{#accountId}:biztype/{#BizTypeName}`	None	None
yundun-greenweb:DeleteAuditCallback	DeleteAuditCallback	delete	AuditCallback `acs:yundun-greenweb::{#accountId}:auditcallback/{#AuditCallbackName}`	None	None
yundun-greenweb:DescribeWebsiteInstance	DescribeWebsiteInstance	get	All Resource ``	None	None
yundun-greenweb:DescribeOssIncrementOverview	DescribeOssIncrementOverview	get	All Resource ``	None	None
yundun-greenweb:DescribeAuditSetting	DescribeAuditSetting	get	All Resource ``	None	None
yundun-greenweb:UpdateCallback	UpdateCallback	update	Callback `acs:yundun-greenweb::{#accountId}:callback/{#CallbackId}`	None	None
yundun-greenweb:DescribeOssResultItems	DescribeOssResultItems	get	All Resource ``	None	None
yundun-greenweb:UpdateAuditCallback	UpdateAuditCallback	update	All Resource ``	None	None
yundun-greenweb:DeleteImageFromLib	DeleteImageFromLib	delete	All Resource ``	None	None
yundun-greenweb:DescribeUsageBill	DescribeUsageBill	get	All Resource ``	None	None
yundun-greenweb:ExportKeywords	ExportKeywords	get	All Resource ``	None	None
yundun-greenweb:DescribeViewContent	DescribeViewContent	get	All Resource ``	None	None
yundun-greenweb:DescribeImageFromLib	DescribeImageFromLib	get	All Resource ``	None	None
yundun-greenweb:CreateWebsiteIndexPageBaseline	CreateWebsiteIndexPageBaseline	create	All Resource ``	None	None
yundun-greenweb:DescribeBizTypeTemplates	DescribeBizTypeTemplates	get	All Resource ``	None	None
yundun-greenweb:DescribeOssStockStatus	DescribeOssStockStatus	get	All Resource ``	None	None
yundun-greenweb:DescribeUploadInfo	DescribeUploadInfo	get	All Resource ``	None	None
yundun-greenweb:UpdateBizTypeImageLib	UpdateBizTypeImageLib	update	All Resource ``	None	None
yundun-greenweb:DescribeCallbackList	DescribeCallbackList	get	Callback `acs:yundun-greenweb::{#accountId}:callback/*`	None	None
yundun-greenweb:DescribeAuditContentItem	DescribeAuditContentItem	get	All Resource ``	None	None
yundun-greenweb:CreateKeywordLib	CreateKeywordLib	create	KeywordLib `acs:yundun-greenweb::{#accountId}:keywordlib/*`	None	None
yundun-greenweb:DescribeKeywordLib	DescribeKeywordLib	get	KeywordLib `acs:yundun-greenweb::{#accountId}:keywordlib/*`	None	None
yundun-greenweb:DescribeCallbackBind	DescribeCallbackBind	get	All Resource ``	None	None
yundun-greenweb:CreatCustomOcrTemplate	CreatCustomOcrTemplate	create	All Resource ``	None	None
yundun-greenweb:DescribeOpenApiUsage	DescribeOpenApiUsage	get	All Resource ``	None	None
yundun-greenweb:ExportOssResult	ExportOssResult	get	All Resource ``	None	None
yundun-greenweb:UpdateBizTypeAuditRange	UpdateBizTypeAuditRange	update	All Resource ``	None	None
yundun-greenweb:DescribeCustomOcrTemplate	DescribeCustomOcrTemplate	get	All Resource ``	None	None
yundun-greenweb:ImportKeywords	ImportKeywords	none	All Resource ``	None	None
yundun-greenweb:DescribeUserStatus	DescribeUserStatus	get	All Resource ``	None	None
yundun-greenweb:CreateImageLib	CreateImageLib	create	ImageLib `acs:yundun-greenweb::{#accountId}:imagelib/*`	None	None
yundun-greenweb:GetAuditItemDetail	GetAuditItemDetail	get	All Resource ``	None	None
yundun-greenweb:DescribeAuditCallbackList	DescribeAuditCallbackList	get	AuditCallback `acs:yundun-greenweb::{#accountId}:auditcallback/*`	None	None
yundun-greenweb:DescribeOssStockScanTasks	DescribeOssStockScanTasks	get	OssStockTask `acs:yundun-greenweb::{#accountId}:ossstocktask/*`	None	None

Resource

The following table lists the resources defined by AI Guardrails. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Callback	acs:yundun-greenweb::{#accountId}:callback/{#CallbackId} acs:yundun-greenweb::{#accountId}:callback/*
BizType	acs:yundun-greenweb::{#accountId}:biztype/{#BizTypeName} acs:yundun-greenweb::{#accountId}:biztype/*
ImageLib	acs:yundun-greenweb::{#accountId}:imagelib/ acs:yundun-greenweb:*:{#accountId}:imagelib/{#ImageLibId}
AuditCallback	acs:yundun-greenweb::{#accountId}:auditcallback/{#AuditCallbackName} acs:yundun-greenweb::{#accountId}:auditcallback/*
KeywordLib	acs:yundun-greenweb::{#accountId}:keywordlib/{#KeywordLibId} acs:yundun-greenweb::{#accountId}:keywordlib/*
OssStockTask	acs:yundun-greenweb::{#accountId}:ossstocktask/ acs:yundun-greenweb:*:{#accountId}:ossstocktask/{#OssStockTaskId}

Condition

AI Guardrails does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: