Grant permissions to RAM users

Create entity

You can control access using a user, user group, or RAM role. You can configure the principal based on your requirements.

Log on to the RAM console and do one of the following:

• Create a RAM user. For more information, see Create a RAM user.

• Create a user group. For more information, see Create a user group.

• Create a RAM role. For more information, see RAM role overview.

Create User List Read Permission

1. Log on to the Resource Access Management (RAM) console, choose Permission Management > Policies, and then click Create Policy.

2. On the Create Policy page, click the Script Editor tab.

3. Clear the default script, copy and paste the example script into the editor, and then click OK.

   {
       "Statement": [
           {
               "Action": "ram:ListUsers",
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

4. In the dialog box that appears, enter a name for the policy and save the custom policy.

5. Return to the Policies page, where you can search for or view the custom policy that you created.

Grant permissions

1. On the Resource Access Management page, choose Permission Management > Authorization. The Authorization page opens.

2. On the Authorization page, click Add Authorization to open the Add Permission right-side panel.

   

3. In the Add Permission right-side pane, perform the following operations:

   The configuration is as follows:

   Option	Description
   Authorization Scope	Select All Alibaba Cloud Account Resources.
   Principal	Enter a keyword to search for and select the user, user group, or RAM role that you created.
   Select Permissions	Select the System Policy or Custom Policy option. Enter keywords to search for the system policies for Remote Log Access and Multiexperience Development Platform (EMAS). These include the following: AliyunMHubFullAccess: Permissions to manage Multiexperience Development Platform EMAS. AliyunMHubReadOnlyAccess: Read-only permissions for Multiexperience Development Platform EMAS. AliyunEmasDevOpsFullAccess: Permissions to manage Cloud Build. AliyunEmasDevOpsReadOnlyAccess: Grants read-only access to Cloud Build. Custom policies include the read-only permission for the user list that you added. As needed, select the system policies for Multiexperience Development Platform EMAS and Remote Log Access, and add them to the Selected list on the right. Important Select at least one system policy for Multiexperience Development Platform (EMAS). Select at least one system policy for Cloud Build.

4. Click OK to save the settings.