Custom permissions
You can create custom policies to manage permissions in a fine-grained manner.
Background information
A permission allows or denies an operation on a specific resource under certain conditions. Authorization policies contain permissions. You can define custom permissions when you create a custom policy.
For more information about how to create a custom policy, see Create a custom policy. This topic describes how to create a custom policy in the script editor.
Procedure
Log on to the RAM console as a RAM user who has administrative rights.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON tab.
Enter the following policy content in the code editor and click Next to edit policy information.
For more information about the syntax and structure of RAM policies, see Policy structure and syntax.
An access policy contains the following parameters:
Action: The operation that you want to grant permissions for. All IoT operations start with the
iot:prefix. For definitions and examples, see the Action definition section in this topic.Effect : The authorization type. Valid values: Allow and Deny.
Resource : The resource that you want to grant permissions for.
To grant a RAM user permissions to access all your IoT Platform resources, set the value to
*.Condition : The authentication condition. IoT Platform does not support the Condition element.
For more information about the elements of an access policy, see Basic elements of an access policy.
Specify the Name and Description fields.
In the Create Policy dialog box, enter a Policy Name and a Note, and then click OK.
Action definition
Action specifies the name of the API operation. When you create an authorization policy for IoT Platform, each action must have the iot: prefix. Separate multiple actions with commas (,). You can use the asterisk (*) wildcard character. For more information about IoT API operation names, see IoT authorization mapping table.
The following examples show typical Action definitions.
Defines a single API operation.
"Action": "iot:CreateProduct"Defines multiple API operations.
"Action": [ "iot:UpdateProduct", "iot:QueryProduct" ]Defines all read-only API operations, including permissions for data forwarding destinations in the rules engine.
{ "Version": "1", "Statement": [ { "Action": [ "iot:Query*", "iot:List*", "iot:Get*", "iot:BatchGet*", "iot:Check*" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "rds:DescribeDBInstances", "rds:DescribeDatabases", "rds:DescribeAccounts", "rds:DescribeDBInstanceNetInfo" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:ListRoles", "Resource": "*", "Effect": "Allow" }, { "Action": [ "mns:ListTopic", "mns:GetTopicRef" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "dhs:ListProject", "dhs:GetProject", "dhs:ListTopic", "dhs:GetTopic" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ots:ListInstance", "ots:GetInstance", "ots:ListTable", "ots:DescribeTable" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ons:OnsRegionList", "ons:OnsInstanceInServiceList", "ons:OnsTopicList", "ons:OnsTopicGet" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "hitsdb:DescribeRegions", "hitsdb:DescribeHiTSDBInstanceList", "hitsdb:DescribeHiTSDBInstance" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "fc:ListServices", "fc:GetService", "fc:GetFunction", "fc:ListFunctions" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "log:ListShards", "log:ListLogStores", "log:ListProject" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "cms:QueryMetricList" ], "Resource": "*", "Effect": "Allow" } ] }Defines all read and write API operations, including permissions for data forwarding destinations in the rules engine.
{ "Version": "1", "Statement": [ { "Action": "iot:*", "Resource": "*", "Effect": "Allow" }, { "Action": [ "rds:DescribeDBInstances", "rds:DescribeDatabases", "rds:DescribeAccounts", "rds:DescribeDBInstanceNetInfo", "rds:ModifySecurityIps" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:ListRoles", "Resource": "*", "Effect": "Allow" }, { "Action": [ "mns:ListTopic", "mns:GetTopicRef" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "dhs:ListProject", "dhs:ListTopic", "dhs:GetProject", "dhs:GetTopic" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ots:ListInstance", "ots:ListTable", "ots:DescribeTable", "ots:GetInstance" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ons:OnsRegionList", "ons:OnsInstanceInServiceList", "ons:OnsTopicList", "ons:OnsTopicGet" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "hitsdb:DescribeRegions", "hitsdb:DescribeHiTSDBInstanceList", "hitsdb:DescribeHiTSDBInstance", "hitsdb:ModifyHiTSDBInstanceSecurityIpList" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "fc:ListServices", "fc:GetService", "fc:GetFunction", "fc:ListFunctions" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "log:ListShards", "log:ListLogStores", "log:ListProject" ], "Resource": "*", "Effect": "Allow" }, { "Action": "ram:PassRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "acs:Service": "iot.aliyuncs.com" } } }, { "Action": [ "cms:QueryMetricList" ], "Resource": "*", "Effect": "Allow" } ] }
After the authorization policy is created, grant the permissions to a RAM user. The RAM user can then perform the operations defined in the policy. For more information about how to create a RAM user and grant permissions, see RAM user access.