Use tags for access control

Why tag-based access control

Compared to listing individual resource IDs in policies (the traditional approach), tag-based access control offers three advantages:

Tag-based access control requires RAM policies. The built-in permission control system in EDAS does not support tag conditions. For more information about EDAS permission control, see Permission management.

Example scenario

Three applications are deployed in EDAS with the following tags:

Three RAM users need different levels of access:

The following steps walk through creating a custom policy for each user, attaching the policies, and verifying the results.

Step 1: Create a custom policy with tag conditions

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON tab.

5. Enter one of the following policies in the code editor based on the access requirement. Policy for User 1 -- manage applications in DEV and TEST This policy allows ManageApplication on any resource tagged with Environment=DEV or Environment=TEST: Policy for User 2 -- manage team1 applications in TEST only This policy combines two tag conditions. Both must be true (logical AND) for access to be granted: Policy for User 3 -- read all applications except PROD This policy uses two statements. The first grants read access to all resources. The second explicitly denies read access to resources tagged Environment=PROD. An explicit deny always overrides an allow, so User 3 cannot access production applications: The following table summarizes the policy patterns used in these examples:

   Pattern	Mechanism	When to use
   Single tag condition	StringEquals with one tag key and one or more values	Grant access by one attribute, such as environment
   Multiple tag conditions (AND)	StringEquals with multiple tag keys in one block	Grant access only when all attributes match
   Explicit deny	An Allow statement plus a Deny statement with a tag condition	Exclude specific resources from a broad allow

      {
        "Statement": [
          {
            "Action": "edas:ManageApplication",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
              "StringEquals": {
                "edas:tag/Environment": ["DEV", "TEST"]
              }
            }
          }
        ],
        "Version": "1"
      }

      {
        "Statement": [
          {
            "Action": "edas:ManageApplication",
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
              "StringEquals": {
                "edas:tag/Team": ["team1"],
                "edas:tag/Environment": ["TEST"]
              }
            }
          }
        ],
        "Version": "1"
      }

      {
        "Statement": [
          {
            "Action": "edas:ReadApplication",
            "Effect": "Allow",
            "Resource": "*"
          },
          {
            "Action": "edas:ReadApplication",
            "Effect": "Deny",
            "Resource": "*",
            "Condition": {
              "StringEquals": {
                "edas:tag/Environment": ["PROD"]
              }
            }
          }
        ],
        "Version": "1"
      }

6. Click Next to edit policy information.

7. Enter a Name and Description, review the content in the Policy document section, and click OK.

The custom policy now appears in the policy list.

Step 2: Attach the policy to a RAM user

1. Log on to the RAM console with an Alibaba Cloud account.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

4. In the Add Permissions panel, set Authorized Scope to Alibaba Cloud Account.

5. In the Select Policy section, click Custom Policy, search for the custom policy created in Step 1, select it, and click OK.

   

6. Confirm the authorization information and click Complete.

Repeat these steps for each RAM user or RAM user group that requires a tag-based policy.

Verify the result

After attaching the policies, log on to the EDAS console as each RAM user and confirm the following expected outcomes:

If a RAM user can access resources outside the expected scope, check the following:

• Verify that the correct tags are assigned to the applications.

• Review the conditions in the RAM policy for typos or incorrect tag values.

• Make sure no other policies attached to the user grant broader permissions.

Scale and extend tag-based policies

Tag-based access control becomes more valuable as your environment grows. The following table lists common ways to extend the approach:

For more information about RAM policies, see Permission management.