RAM authorization-Enterprise Distributed Application Service(EDAS)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Enterprise Distributed Application Service for RAM permission policies. The RAM code (RamCode) for Enterprise Distributed Application Service is edas , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Enterprise Distributed Application Service. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
edas:ManageApplication	AbortChangeOrder	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:DeleteConfigTemplate	DeleteConfigTemplate	delete	All Resource ``	None	None
edas:ReadCluster	ListCluster	list	All Resource ``	None	None
edas:ManageApplication	UnbindSlb	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageAppLog	DeleteLogPath	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	ConvertK8sResource	get	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ListConfigTemplates	ListConfigTemplates	get	All Resource ``	None	None
edas:ReadApplication	ListApplicationEcu	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:InsertSwimmingLaneGroup	InsertSwimmingLaneGroup	create	All Resource ``	None	None
edas:AuthorizeRole	AuthorizeRole	none	All Resource ``	None	None
edas:ManageTraffic	DeleteSwimmingLane	delete	All Resource ``	None	None
edas:UpdateAccountInfo	UpdateAccountInfo	update	All Resource ``	None	None
edas:ManageApplication	BindSlb	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:SynchronizeResource	SynchronizeResource	none	All Resource ``	None	None
edas:ManageApplication	DeployApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	TransformClusterMember	none	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	RollbackChangeOrder	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadService	GetServiceConsumersPage	get	All Resource ``	None	None
edas:ReadApplication	QueryApplicationStatus	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	UpdateK8sResource	update	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadService	ListPublishedServices	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ResetApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	UpdateHookConfiguration	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ConfigApplication	UpdateJvmConfiguration	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListVpc	ListVpc	list	All Resource ``	None	None
edas:ReadCluster	GetK8sAppPrecheckResult	get	All Resource ``	None	None
edas:ManageTraffic	InsertSwimmingLane	create	All Resource ``	None	None
edas:ManageApplication	UpdateContainerConfiguration	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageAppLog	UpdateSlsLogStore	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	RestartK8sApplication	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	edas:tag	None
edas:ListSwimmingLane	ListSwimmingLane	list	All Resource ``	None	None
edas:DeleteNamespace	DeleteUserDefineRegion	get	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ListEcuByRegion	ListEcuByRegion	list	All Resource ``	None	None
edas:ReadService	ListMethods	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:AuthorizeResourceGroup	AuthorizeResourceGroup	none	All Resource ``	None	None
edas:ManageApplication	RollbackApplication	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	GetK8sApplication	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	UnbindK8sSlb	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	UpdateContainer	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageTraffic	UpdateSwimmingLaneGroup	update	All Resource ``	None	None
edas:GetPackageStorageCredential	GetPackageStorageCredential	get	All Resource ``	None	None
edas:ManageApplication	CreateK8sService	create	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NamespaceId}/application/{#AppId}`	None	None
edas:ManageCluster	InstallAgent	none	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadCluster	ListK8sIngressRules	get	All Resource ``	None	None
edas:ManageAppLog	AddLogPath	create	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadCluster	ListConvertableEcu	get	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	EnableApplicationScalingRule	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:DeleteApplication	DeleteApplication	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListRole	ListRole	get	All Resource ``	None	None
edas:ManageApplication	CreateApplicationScalingRule	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:TagResources	TagResources	update	All Resource ``	None	None
edas:ReadService	GetServiceMethodPage	get	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:DeleteServiceGroup	DeleteServiceGroup	delete	All Resource ``	None	None
edas:ReadApplication	ListDeployGroup	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ModifyScalingRule	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:QueryMigrateEcuList	QueryMigrateEcuList	list	All Resource ``	None	None
edas:ManageCluster	CreateK8sSecret	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadCluster	GetCluster	get	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:CreateConfigTemplate	CreateConfigTemplate	create	All Resource ``	None	None
edas:ReadService	GetServiceDetail	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageTraffic	UpdateSwimmingLane	update	All Resource ``	None	None
edas:ListEcsNotInCluster	ListEcsNotInCluster	get	All Resource ``	None	None
edas:ConfigApplication	UpdateK8sApplicationBaseInfo	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:UpdateConfigTemplate	UpdateConfigTemplate	update	All Resource ``	None	None
edas:SLBPurchase	BindK8sSlb	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:DeleteRole	DeleteRole	delete	All Resource ``	None	None
edas:UntagResources	UntagResources	update	All Resource ``	None	None
edas:ManageApplication	AbortAndRollbackChangeOrder	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ContinuePipeline	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	ListHistoryDeployVersion	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:InsertRole	InsertRole	create	All Resource ``	None	None
edas:ListSwimmingLaneGroup	ListSwimmingLaneGroup	get	All Resource ``	None	None
edas:UpdateRole	UpdateRole	update	All Resource ``	None	None
edas:DeleteApplication	DeleteK8sApplication	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:CreateApplication	InsertK8sApplication	create	All Resource ``	None	None
edas:ManageApplication	DeleteDeployGroup	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	DisableApplicationScalingRule	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ChangeDeployGroup	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	UpdateK8sIngressRule	update	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:CreateNamespace	InsertOrUpdateRegion	update	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ManageApplication	UpdateK8sService	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	ListRecentChangeOrder	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadCluster	GetK8sCluster	get	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadApplication	GetChangeOrderInfo	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadService	ListConsumedServices	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NamespaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ScaleOutApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	InsertDeployGroup	create	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:AuthorizeApplication	AuthorizeApplication	none	All Resource ``	None	None
edas:ReadApplication	DescribeAppInstanceList	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadCluster	ListK8sSecrets	get	All Resource ``	None	None
edas:ReadCluster	StartK8sAppPrecheck	none	All Resource ``	None	None
edas:ReadService	GetServiceProvidersPage	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:CreateCluster	ImportK8sCluster	none	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ManageApplication	DeleteApplicationScalingRule	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	ListApplication		All Resource ``	None	None
edas:ManageApplication	StartK8sApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	UpdateK8sSecret	update	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	RestartApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ECSPurchase	ScaleoutApplicationWithNewInstances	update	All Resource ``	None	None
edas:ManageApplication	StartApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ConfigApplication	BindEcsSlb	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	StopK8sApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListServiceGroups	ListServiceGroups	get	All Resource ``	None	None
edas:ReadCluster	ListK8sNamespaces		All Resource ``	None	None
edas:ReadApplication	DescribeLocalitySetting	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NamespaceId}/application/{#AppId}`	None	None
edas:ManageApplication	ScaleK8sApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:DeleteCluster	DeleteCluster	delete	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageCluster	UpdateK8sConfigMap	update	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadApplication	GetJavaStartUpConfig	get	All Resource ``	None	None
edas:ManageApplication	ScaleInApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	GetScalingRules	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListSubAccount	ListSubAccount	get	All Resource ``	None	None
edas:ReadService	GetServiceListPage	get	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ReadApplication	GetJvmConfiguration	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:CreateApplication	InsertApplication	create	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ReadApplication	QueryEccInfo	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NamespaceId}/application/{#AppId}`	None	None
edas:ReadCluster	ListK8sConfigMaps	get	All Resource ``	None	None
edas:ManageApplication	SwitchAdvancedMonitoring	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListUserDefineRegion	ListUserDefineRegion	list	All Resource ``	None	None
edas:ConfigApplication	UpdateK8sApplicationConfig		*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	GetAppDeployment	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	GetApplication	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:DeleteEcu	DeleteEcu	delete	All Resource ``	None	None
edas:MigrateEcu	MigrateEcu	update	All Resource ``	None	None
edas:ReadNamespace	GetSecureToken	get	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ReadCluster	ListClusterMembers	get	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	UpdateLocalitySetting	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NamespaceId}/application/{#AppId}`	None	None
edas:ManageApplication	StopApplication	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	GetContainerConfiguration	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	CreateK8sConfigMap	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	UpdateK8sSlb	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ReadApplication	QuerySlsLogStoreList	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageApplication	DeployK8sApplication	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ConfigApplication	UpdateApplicationBaseInfo	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	DeleteK8sSecret	delete	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ListSlb	ListSlb	list	All Resource ``	None	None
edas:InsertServiceGroup	InsertServiceGroup	create	All Resource ``	None	None
edas:ListAuthority	ListAuthority	list	All Resource ``	None	None
edas:ManageCluster	DeleteK8sConfigMap	delete	All Resource ``	None	None
edas:ManageApplication	UpdateHealthCheckUrl	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListResourceGroup	ListResourceGroup	list	All Resource ``	None	None
edas:ManageCluster	DeleteK8sIngressRule	delete	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:CreateCluster	InsertCluster	create	*NameSpace `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}`	None	None
edas:ManageApplication	UpdateApplicationScalingRule	update	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ListTagResources	ListTagResources	list	All Resource ``	None	None
edas:ManageApplication	RetryChangeOrderTask	none	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	CreateIDCImportCommand	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageApplication	DeleteK8sService	delete	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:QueryMigrateRegionList	QueryMigrateRegionList	none	All Resource ``	None	None
edas:ReadApplication	GetWebContainerConfig	get	All Resource ``	None	None
edas:ReadApplication	DescribeApplicationScalingRules	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None
edas:ManageCluster	InsertClusterMember	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageCluster	DeleteClusterMember	delete	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ManageCluster	CreateK8sIngressRule	create	*Cluster `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId}`	None	None
edas:ReadApplication	GetK8sServices	get	*Application `acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId}`	None	None

Resource

The following table lists the resources defined by Enterprise Distributed Application Service. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Application	acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/application/{#AppId} acs:edas:{#regionId}:{#accountId}:application/{#AppId}
Cluster	acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}/cluster/{#ClusterId} acs:edas:{#regionId}:{#accountId}:cluster/{#ClusterId} acs:edas:{#regionId}:{#accountId}:cluster/*
NameSpace	acs:edas:{#regionId}:{#accountId}:namespace/{#NameSpaceId}

Condition

The following table lists the product-level condition keys defined by Enterprise Distributed Application Service. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
edas:tag		String

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: