RAM user authorization

Grant permissions to a RAM user

1. Log on to the Alibaba Cloud console with your Alibaba Cloud account. Go to Resource Access Management (RAM) > Identities > Users, select the RAM user you want to authorize, and click Add Permissions.

2. Select a policy.

   You can select from All Policy Types, system policy, or custom policy.

   Note

   Permission assignment principles:

   Principle of least privilege: Grant only the minimum set of permissions required to perform a task.

   Privilege separation principle: Create separate policies for RAM users with different job functions.

   System policy

   1. For Policy Type, select system policy. In the Filter by policy name, description search box, enter mt. The system automatically lists the system policies related to Machine Translation.

   2. In the list of policies, click the policy you want to attach.

      Select the target policy and click OK. The following table describes the system policies for Machine Translation:

      Parameter	Remarks	Description
      AliyunMTFullAccess	Grants permissions to manage Machine Translation (alimt).	Allows access to and operations on all Machine Translation APIs and the console. Note This policy grants permissions for high-risk operations, such as modifying or deleting resources.
      AliyunMTReadOnlyAccess	Grants read-only access to Machine Translation (alimt).	Allows read-only access to all Machine Translation APIs and the console.

   Custom policy

   1. Add a custom policy

      For Policy Type, select custom policy.

      In the list of policies, click the custom policy you want to attach. If the policy does not exist, you can create a custom policy.

   2. Create a custom policy

      In the left-side navigation pane, choose Permissions > Policies, and then click Create Policy. Select the Script Editor tab. Create the required policy.

      Note

      A custom policy allows you to grant permissions for specific APIs.

      For instructions on creating a custom policy, see Create a custom policy.

      The Script Editor displays a JSON policy template. The structure includes a Version key with a value of "1" and a Statement array. The array contains the Effect ("Allow" or "Deny"), Action (the API operations to authorize), Resource (the resource ARN), and Condition (the conditions for the policy to apply) fields.

   3. Custom policy example

      For example, the permission requirements are as follows:

      Permission requirement	Policy content
      The ID of the Alibaba Cloud account is 123456. Note Your Alibaba Cloud account ID and access keys are sensitive credentials. Do not store them in plaintext. Allow calls to the Machine Translation General Edition API.	{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "alimt:TranslateGeneral", "Resource": "acs:alimt:*:123456:*" } ] }

      Note

      For more information about policy configuration, see Policy Management.

Revoke permissions from a RAM user

Log on to the Alibaba Cloud console with your Alibaba Cloud account. Go to Resource Access Management (RAM) > Permissions > Authorization. In the list of principals, find the target RAM user and click Remove Permission in the Actions column.

FAQ

• Q: Why does a RAM user still get a "permission denied" error after being granted permissions?

  A: Ensure the policy has taken effect and verify any API allowlist restrictions.

• Q: How can I limit the number of translation requests for a RAM user?

  A: You can control usage by using the Condition element in a RAM policy.