Access policies and examples

In RAM, an access policy is a collection of permissions that is described using a specific syntax and structure. It precisely defines the authorized resource set, action set, and conditions. Function Compute supports the following types of access policies:

• System policies: These policies are created and maintained by Alibaba Cloud. You can use these policies, but you cannot modify them.

• Custom policies: You can create, update, and delete these policies. You are responsible for maintaining all updates to these policies.

System policies include the following types:

• System policies provided by Function Compute.

  Policy Name	Description
  AliyunFCReadOnlyAccess	Grants read-only permissions on all Function Compute resources.
  AliyunFCInvocationAccess	Grants permissions to invoke all functions.
  AliyunFCFullAccess	Grants full permissions on all Function Compute resources.

  Note

  The AliyunFCFullAccess policy, which grants administrative permissions for Function Compute, includes the permissions from both the AliyunFCInvocationAccess (invoke functions) and AliyunFCReadOnlyAccess (read-only access) policies. After you attach the AliyunFCFullAccess policy, you do not need to attach the other two policies.

• System policies provided by other Alibaba Cloud services.

  Cloud Product Name	System Policy
  Simple Log Service (SLS)	AliyunLogReadOnlyAccess: Grants read-only permissions on Simple Log Service. AliyunLogFullAccess: Grants administrative permissions for Simple Log Service. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunLogReadOnlyAccess policy to access Simple Log Service.
  Object Storage Service (OSS)	AliyunOSSReadOnlyAccess: Grants read-only permissions on Object Storage Service (OSS). AliyunOSSFullAccess: Grants administrative permissions for OSS.
  Cloud Monitor	AliyunCloudMonitorReadOnlyAccess: Grants read-only permissions on Cloud Monitor.
  Certificate Service	AliyunYundunCertReadOnlyAccess: Grants read-only permissions on Certificate Service.
  Virtual Private Cloud (VPC)	AliyunVPCReadOnlyAccess: Grants read-only permissions on VPC.
  Elastic Compute Service (ECS)	AliyunECSReadOnlyAccess: Grants read-only permissions on ECS.
  Resource Access Management (RAM)	AliyunRAMReadOnlyAccess: Grants read-only permissions on RAM. This includes permissions to view users, groups, and authorization information. AliyunRAMFullAccess: Grants administrative permissions for RAM. This includes permissions to manage users and authorizations. Note The AliyunRAMReadOnlyAccess policy only applies to getting the list of roles in the console. If a RAM user needs to perform other operations, you must grant the RAM user administrative permissions for RAM using the AliyunRAMFullAccess policy.
  Application Real-Time Monitoring Service (ARMS)	AliyunARMSReadOnlyAccess: Grants read-only permissions on ARMS. AliyunARMSFullAccess: Grants administrative permissions for ARMS. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunARMSReadOnlyAccess policy to access ARMS.
  Simple Message Queue (formerly MNS)	AliyunMNSReadOnlyAccess: Grants read-only permissions on Simple Message Queue (formerly MNS). AliyunMNSFullAccess: Grants administrative permissions for Simple Message Queue (formerly MNS). Note Based on the principle of least privilege, you only need to grant the RAM user the read-only access permission to Simple Message Queue (formerly MNS), which is AliyunMNSReadOnlyAccess, to allow access to Simple Message Queue (formerly MNS).
  EventBridge	AliyunEventBridgeReadOnlyAccess: Grants read-only permissions on EventBridge. AliyunEventBridgeFullAccess: Grants administrative permissions for EventBridge. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunEventBridgeReadOnlyAccess policy to access EventBridge.
  Message Queue for Apache RocketMQ	AliyunMQReadOnlyAccess: Grants read-only permissions on Message Queue. AliyunMQFullAccess: Grants administrative permissions for Message Queue. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunMQReadOnlyAccess policy to access Message Queue for Apache RocketMQ.
  Container Registry (ACR)	AliyunContainerRegistryReadOnlyAccess: Grants read-only permissions on Container Registry. AliyunContainerRegistryFullAccess: Grants administrative permissions for Container Registry. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunContainerRegistryReadOnlyAccess policy to access Container Registry.
  File Storage NAS	AliyunNASReadOnlyAccess: Grants permissions to view File Storage NAS. AliyunNASFullAccess: Grants administrative permissions for File Storage NAS. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunNASReadOnlyAccess policy to access File Storage NAS.
  ApsaraDB RDS	AliyunRDSReadOnlyAccess: Grants read-only permissions on ApsaraDB RDS. AliyunRDSFullAccess: Grants administrative permissions for ApsaraDB RDS. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunRDSReadOnlyAccess policy to access ApsaraDB RDS.
  Apsara Devops	AliyunRDCReadOnlyAccess: Grants read-only permissions on Apsara Devops RDC. AliyunRDCFullAccess: Grants administrative permissions for Apsara Devops RDC. Note Based on the principle of least privilege, you only need to grant the RAM user the AliyunRDCReadOnlyAccess policy to access Apsara Devops RDC.

 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }

For example, to grant permissions to invoke the demo function in the test service in the China (Hangzhou) region, you can use a custom policy. The following code shows an example policy:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:services/test/functions/demo",
            "Effect": "Allow"
        }
    ]
}