Grant permissions to a RAM user

Prerequisites

You have created a RAM user. For more information, see Create a RAM user.

Permissions

ECI provides the following policies.

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account.

2. To allow a RAM user to manage ECI resources from the console, create a custom policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. Click Create Policy.

   3. On the JSON Editor tab, copy the following policy document into the editor, and then click OK.

      {
          "Statement": [
              {
                  "Action": "ram:ListRoles",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "nas:DescribeFileSystems",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "oss:ListBuckets",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "vpc:DescribeCommonBandwidthPackages",
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "cr:GetRepoList",
                      "cr:GetRepoTags",
                      "cr:GetImageManifest",
                      "cr:SearchRepo"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ],
          "Version": "1"
      }

   4. Enter a name for the policy and click OK.

3. Attach the required policies to the RAM user.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Find the RAM user and click Add Permissions in the Actions column.

   3. In the panel that appears, configure the parameters.

      The following table describes the parameters.

      Parameter	Description
      Resource Scope	Select the permission scope: Entire Account: The permissions apply to the current Alibaba Cloud account. Specific Resource Group: The permissions apply only to a specific resource group.
      Principal	The RAM user to be authorized. This field is pre-filled with the user you selected. You can add other users.
      Policy	Select the policies based on your use case. To view ECI resources only: In the System Policies section, select AliyunECIReadOnlyAccess. To manage ECI resources by calling API operations: In the System Policies section, select AliyunECIFullAccess. To manage ECI resources in the console: select AliyunECIFullAccess from the System Policies section and the custom policy that you created in Step 2 from the Custom Policies section.

   4. Click OK and follow the on-screen instructions.

Related topics

To grant more granular permissions for ECI resources, you can use resource groups and labels. For more information, see the following topics:

• Use resource groups to authorize RAM users

• Use labels to authorize RAM users