Grant permissions to RAM users-EventBridge(EventBridge)-阿里云帮助中心

EventBridge allows an Alibaba Cloud account to grant resource-level permissions to RAM users, reducing the security risks of sharing the account's AccessKey pair. Only authorized RAM users can manage resources in the EventBridge console or publish events by using an SDK or API.

Use cases

Enterprise A subscribes to EventBridge. Employees need to manage resources such as event rules and event buses, and different job responsibilities require different permissions.

This scenario includes the following requirements:

For security reasons, Enterprise A creates a separate RAM user for each employee instead of sharing the Alibaba Cloud account's AccessKey pair.
RAM users are not billed individually. All costs are charged to Enterprise A's Alibaba Cloud account.
Enterprise A can revoke the permissions of a RAM user or delete the RAM user at any time.

The Alibaba Cloud account can grant fine-grained permissions to employees, ensuring they access only the resources required for their jobs.

Grant permissions to a RAM user

Console

The RAM console offers two entry points, both supporting single and batch authorization:

Users page: The principal is auto-selected based on the users you choose. Best for user-centric workflows.
Grants page: You manually select principals and can view all authorization records across your account. Best for permission-centric workflows.

Note

Tip: For large-scale management, add RAM users with identical responsibilities to a user group, then grant permissions to the group. Navigate to Identities > User Groups to manage groups.

From the Users page

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.

In the Grant Permission panel, configure the following settings:

Resource scope:
- Account level: Permissions apply to all resources in your Alibaba Cloud account.
- Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
  Note
  1. The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
  2. For resource group authorization examples, see Control RAM user access to specific ECS instances.
Principal:

The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.

Permission policy:

System policy: Search and select. Filter by product name (e.g., ECS, OSS), access level (e.g., ReadOnly, FullAccess), or full policy name.

The following table lists system policy names for commonly requested Alibaba Cloud products to help you quickly find the right policy.

Product	System policy name	Access level
CloudMonitor	`AliyunCloudMonitorReadOnlyAccess`	Read-only
China Gateway (Website Builder)	`AliyunWebsiteBuildFullAccess`	Full access
Apsara DevOps	`AliyunYunxiaoFullAccess`	Full access
Model Studio (Bailian)	`AliyunBailianFullAccess`	Full access
Alibaba Cloud DNS	`AliyunDNSFullAccess`	Full access
SSL Certificates Service	`AliyunYundunCertFullAccess`	Full access
Elastic Desktop Service	`AliyunECDFullAccess`	Full access
Support Center	`AliyunSupportFullAccess`	Full access
Resource Center	`AliyunResourceCenterFullAccess`	Full access
AgentBay	`AliyunAgentBayFullAccess`	Full access
Security Center	`AliyunYundunSASFullAccess`	Full access

If you cannot find the policy for your target product, see the System policy reference for the complete list, or create a custom policy for fine-grained access control.

Custom policy: You must Create a custom policy before you can grant it.

(Optional) Description: Enter the authorization reason or scenario for audit purposes.
Click Confirm.

Review the authorization result and click Close.

From the Grants page

Log on to the RAM console.
In the left-side navigation pane, choose Permissions > Grants.
On the Grants page, click Grant Permission.
In the Grant Permission panel, select the principal and configure the same settings as described above.
Review the authorization result and click Close.

OpenAPI

Grant a custom policy

Call CreatePolicy to create a custom policy. For policy syntax, see Permission policy elements and Overview of sample policies.
Call AttachPolicyToUser to grant the policy at the account level (set PolicyType to Custom).

Alternatively, call AttachPolicy to grant the policy at the resource group level.

Grant a system policy

Call AttachPolicyToUser to attach the system policy to the RAM user (set PolicyType to System). For available PolicyName values, see System policy reference System policy reference.
Alternatively, call AttachPolicy to grant the policy at the resource group level.

More information

What is RAM?

Next steps

After you create a RAM user, you can distribute the logon name and password, or the AccessKey pair, to the intended user. They can then use these credentials to log on to the console or call API operations.

Log on to the console.
1. Open the RAM user logon portal in a web browser.
2. On the RAM User Logon page, enter the RAM user logon name and click Next. Then, enter the password and click Login.
  
  Note
  The logon name for a RAM user is in the format <$username>@<$AccountAlias> or <$username>@<$AccountAlias>.onaliyun.com. <$AccountAlias> is the account alias. If no account alias is set, the ID of your Alibaba Cloud account is used by default.
3. On the Alibaba Cloud console, click a service that you have permission to access.
Use the RAM user's AccessKey pair to call API operations.

Include the RAM user's AccessKey ID and AccessKey secret in your code.