RAM resource authorization
An Alibaba Cloud account has full permissions for its resources by default. You can use Resource Access Management (RAM) to grant permissions on Data Transmission Service (DTS) resources to RAM users.
Precautions
To ensure that RAM authentication works correctly, upgrade the SDK to version 2.0.18 or later. For more information, see Java SDK.
Use SDK version 2.0.18 or later. Earlier versions are no longer maintained, except in special cases.
Limits
Only resource-level authorization is supported. Action-level authorization is not supported.
Authentication rules for DTS APIs
When a RAM user or an Alibaba Cloud Security Token Service (STS) token is used to call a DTS API operation, RAM verifies the required permissions based on the operation semantics and the resources involved.
Authorizable resource types
|
Resource type |
Resource description format in an authorization policy |
Example |
|
Instance |
acs:dts:$regionid:$accountid:instance/$instanceid acs:dts:$regionid:$accountid:instance/* |
acs:dts:cn-hangzhou:1234567890123:instance/* |
-
$regionid: The region ID. You can also use an asterisk (
*) for a fuzzy match. -
$instanceid: The instance ID. You can also use an asterisk (
*) for a fuzzy match. -
$accountid: The ID of the Alibaba Cloud account. You can also use an asterisk (
*) as a wildcard.
Request parameter description
The AccountId parameter is included in each API operation for SDK versions 2.0.18 and later.
|
Name |
Type |
Required |
Example value |
Description |
|
AccountId |
String |
No |
1234567890123 |
The ID of the Alibaba Cloud account that owns the resource accessed by using an STS token. Note
If an Alibaba Cloud account ID is configured in the access policy, you must specify this parameter. |