DocsICP FilingConsole
Documentation

Custom permissions

Updated at:
Copy as MD
Product
My Favorites

A permission allows or denies an operation on a resource under specific conditions.

Permissions are defined within authorization policies. You can create custom permissions by creating a custom authorization policy. In the Resource Access Management (RAM) console, on the Policy Management page, click Create Policy. When you create the policy, select Blank Template.

An authorization policy is a string in JSON format that must include the following parameters.

ParameterDescription
ActionThe operation to grant permission for. Operations for Alibaba Cloud Link WAN start with the linkwan: prefix. For definitions and examples, see the Action and Resource definitions section in this document.
EffectThe type of authorization. Valid values: Allow and Deny.
ResourceThe resource on which the operation is performed. Resources for Alibaba Cloud Link WAN start with the acs:linkwan:*:*: prefix. For definitions and examples, see the Action and Resource definitions section in this document.
ConditionThe authentication conditions. For more information, see the Condition definition section in this document.

Action is the name of the API method. When you create an authorization policy for Alibaba Cloud Link WAN, each Action must have the linkwan: prefix. Use commas to separate multiple Actions. You can also use the asterisk (*) wildcard character.

Resource is the name of the resource that the API method operates on. Each Resource must have the acs:linkwan:*:*: prefix. Use commas to separate multiple Resources. You can also use the asterisk (*) wildcard character.

For more information about Alibaba Cloud Link WAN API method names and their corresponding resource names, see Alibaba Cloud Link WAN API authorization mapping table.

Here are some examples of typical policy configurations.

  • Full permissions
    {
    "Statement": [
        {
            "Action": "linkwan:*",
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "1"
}
  • Read-only permissions
    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        }
    ],
    "Version": "1"
}
  • Gateway management permissions
    {
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "linkwan:CreateGateway",
                "linkwan:DeleteGateway",
                "linkwan:UpdateGateway",
                "linkwan:UpdateGatewayEnablingState",
                "linkwan:GetGateway",
                "linkwan:ListGateways",
                "linkwan:CountGateways",
                "linkwan:ListGatewaysGisInfo"
            ],
            "Resource": [
                "acs:linkwan:*:*:gateway/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "linkwan:ListGatewayTransferPackets",
                "linkwan:GetGatewayTransferPacketsDownloadUrl",
                "linkwan:ListGatewayTransferFlowStats",
                "linkwan:ListGatewayOnlineRecords",
                "linkwan:GetGatewayStatusStat",
                "linkwan:GetGatewayPacketStat",
                "linkwan:ListActiveGateways"
            ],
            "Resource": [
                "acs:linkwan:*:*:gateway/*",
                "acs:linkwan:*:*:diagram/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "linkwan:GetFreqBandPlanGroup",
                "linkwan:ListFreqBandPlanGroups"
            ],
            "Resource": [
                "acs:linkwan:*:*:freq-band-plan/*"
            ]
        }
    ],
    "Version": "1"
}

Condition definition

RAM authorization policies support multiple authentication conditions, such as IP address restrictions, HTTPS access, multi-factor authentication (MFA), and time-based restrictions. The Alibaba Cloud Link WAN API also supports these conditions.

Here are some examples of typical Condition policy configurations.

  • Restrict access to a single IP address and a CIDR block. For example, allow requests only from the IP address 10.101.168.111 or the 10.101.169.111/24 CIDR block.

    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.101.168.111", 
                        "10.101.169.111/24"
                    ]
                }
            }
        }
    ], 
    "Version": "1"
}

  • Restrict access to multiple IP addresses. For example, allow requests only from the IP addresses 10.101.168.111 and 10.101.169.111.

    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.101.168.111", 
                        "10.101.169.111"
                    ]
                }
            }
        }
    ], 
    "Version": "1"
}

  • Require access through HTTPS requests.

    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ], 
    "Version": "1"
}

  • Require access through MFA.

    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "Bool": {
                    "acs:MFAPresent ": "true"
                }
            }
        }
    ], 
    "Version": "1"
}

  • Allow users to access the service before 00:00 on January 20, 2019 (UTC+8), and deny access after that time.

    {
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2019-01-20T00:00:00+08:00"
                }
            }
        }
    ], 
    "Version": "1"
}

Typical Scenarios

You can use Action, Resource, and Condition to flexibly configure authorization policies. The following examples describe two specific scenarios.

  • Scenario 1

    Allow users to perform read-only operations on Alibaba Cloud Link WAN through HTTPS from the 10.101.169.111/24 CIDR block before January 20, 2019.

    The policy is configured as follows:
    ```json
{
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ],
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2019-01-20T00:00:00+08:00"
                },
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.101.169.111/24"
                    ]
                },
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ],
    "Version": "1"
}
```
  • Scenario 2

    Prevent users from the IP address 10.101.168.111 from performing read operations on Alibaba Cloud Link WAN.

    The policy is configured as follows:

    ```json
{
    "Statement": [
        {
            "Action": [
                "linkwan:Get*",
                "linkwan:Count*",
                "linkwan:List*",
                "linkwan:Describe*",
                "linkwan:Check*"
            ],
            "Effect": "Deny",
            "Resource": [
                "*"
            ],
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "10.101.168.111"
                    ]
                }
            }
        }
    ],
    "Version": "1"
}
```

After you create the authorization policy, go to the Users page in the RAM console to grant the permission to a RAM user. The authorized RAM user can then perform the operations defined in the policy. For more information about how to create RAM users and grant permissions, see RAM user access.