RAM policies for EDAS

Single application

Manage an application (without create or delete permissions)

Allows viewing, configuring, and managing logs for a specific application, while explicitly denying creation and deletion.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:*Application"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    },
    {
      "Action": ["edas:DeleteApplication"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"],
      "Effect": "Deny"
    },
    {
      "Action": ["edas:CreateApplication"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/*"],
      "Effect": "Deny"
    }
  ]
}

Create an application

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:CreateApplication", "edas:ReadCluster"],
      "Effect": "Allow",
      "Resource": [
        "acs:edas:$regionid:*:namespace/$namespace/application/*",
        "acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"
      ]
    }
  ]
}

Delete an application

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:DeleteApplication", "edas:ReadApplication"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Manage application logs

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadApplication", "edas:ManageAppLog"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Configure an application

Covers the application port, Tomcat context, load balancing, health check, JVM parameters, and Intra-zone Provider First.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadApplication", "edas:ConfigApplication"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Multiple applications

Query applications across all namespaces in a region

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadApplication"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/*/application/*"]
    }
  ]
}

Manage all applications in a namespace

Grants full application permissions and cluster read access within a specific namespace.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:*Application", "edas:ReadCluster"],
      "Effect": "Allow",
      "Resource": [
        "acs:edas:$regionid:*:namespace/$namespace/application/*",
        "acs:edas:$regionid:*:namespace/$namespace/cluster/*"
      ]
    }
  ]
}

Create clusters

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:CreateCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/*"],
      "Effect": "Allow"
    }
  ]
}

View cluster details

Read-only access to a cluster, including its instances and applications.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"],
      "Effect": "Allow"
    }
  ]
}

Full cluster management

Allows creating, adding instances to, modifying, and deleting a cluster.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"],
      "Effect": "Allow"
    }
  ]
}

To restrict specific operations, add explicit Deny statements:

Allow management but deny creation:

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"],
      "Effect": "Allow"
    },
    {
      "Action": ["edas:CreateCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/*"],
      "Effect": "Deny"
    }
  ]
}

Allow management but deny both creation and deletion:

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"],
      "Effect": "Allow"
    },
    {
      "Action": ["edas:CreateCluster", "edas:DeleteCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/*"],
      "Effect": "Deny"
    }
  ]
}

Delete clusters

Requires both ReadCluster (to locate the cluster) and DeleteCluster.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadCluster", "edas:DeleteCluster"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/cluster/$clusterId"],
      "Effect": "Allow"
    }
  ]
}

Create microservices namespaces

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:CreateNamespace"],
      "Resource": ["acs:edas:$regionid:*:namespace/*"],
      "Effect": "Allow"
    }
  ]
}

View microservices namespaces

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadNamespace"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace"],
      "Effect": "Allow"
    }
  ]
}

Manage microservices namespaces

Allows modifying or renaming a microservices namespace.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageNamespace"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace"],
      "Effect": "Allow"
    }
  ]
}

Delete microservices namespaces

Requires both ReadNamespace (to locate the namespace) and DeleteNamespace.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadNamespace", "edas:DeleteNamespace"],
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace"],
      "Effect": "Allow"
    }
  ]
}

View microservices

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadService"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Test microservices

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:TestService"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Manage microservices

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageService"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace/application/$applicationId"]
    }
  ]
}

Remove outlier instances

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageService"],
      "Effect": "Allow",
      "Resource": ["acs:edas:$regionid:*:namespace/$namespace"]
    }
  ]
}

Purchase ECS instances

Applicable when purchasing ECS instances in a cluster, creating an application in an ECS cluster, or scaling out an application.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["edas:ECSPurchase"],
      "Resource": ["acs:edas:*:*:*"]
    }
  ]
}

Purchase SLB instances

Applicable when binding an SLB instance to an application.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["edas:SLBPurchase"],
      "Resource": ["acs:edas:*:*:*"]
    }
  ]
}

Purchase Simple Log Service resources

Applicable when provisioning Log Service resources for an application.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["edas:SLSPurchase"],
      "Resource": ["acs:edas:*:*:*"]
    }
  ]
}

Full system management

Grants permissions to manage RAM users, view resource usage, and view operation logs.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageSystem"],
      "Resource": ["acs:edas:*:*:*"],
      "Effect": "Allow"
    }
  ]
}

System O&M

Grants permissions to view operation logs, perform one or more O&M tasks at a time, and manage resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ManageOperation"],
      "Resource": ["acs:edas:*:*:*"],
      "Effect": "Allow"
    }
  ]
}

View operation logs

{
  "Version": "1",
  "Statement": [
    {
      "Action": ["edas:ReadOperationLog"],
      "Resource": ["acs:edas:*:*:*"],
      "Effect": "Allow"
    }
  ]
}