Access policies and examples for Simple Message Queue (formerly MNS) in RAM-阿里云帮助中心

Simple Message Queue (formerly MNS) uses Resource Access Management (RAM) from Alibaba Cloud for permission management. RAM lets you avoid sharing your Alibaba Cloud account keys (AccessKeys) with other users. An AccessKey includes an AccessKey ID and an AccessKey secret. You can use RAM to grant users the least privilege required. This topic describes the access policies and examples for Simple Message Queue (formerly MNS) in RAM.

Background information

In RAM, an access policy is a collection of permissions described using policy syntax and structure. An access policy precisely defines the authorized resources, operations, and conditions. For more information, see Policy syntax and structure.

Simple Message Queue (formerly MNS) supports the following types of RAM access policies:

System policies
System policies are created by Alibaba Cloud. You can use system policies, but you cannot modify them. Alibaba Cloud maintains and updates these policies.
Custom policies
You can create, update, and delete custom policies. You are responsible for maintaining and updating these policies. You can edit access policies and grant permissions to users in the Resource Access Management (RAM) console.

System policies

Simple Message Queue (formerly MNS) provides the following default system policies.

Policy name	Description
AliyunMNSFullAccess	Grants full management permissions for Simple Message Queue (formerly MNS). This is equivalent to the permissions of an Alibaba Cloud account. A RAM user with this policy has permissions to send and receive all messages and perform all operations in the console.
AliyunMNSReadOnlyAccess	Grants read-only permissions for Simple Message Queue (formerly MNS). A RAM user with this policy can only read resource information using the console or by calling API operations.

Custom policies

You can use custom policies to implement fine-grained authorization. The following table lists the API operations, actions, and resources that you can use to create custom policies for Simple Message Queue (formerly MNS).

API	Action	Resource
OpenService	mns:OpenService	acs:mns:$region:$accountid:/commonbuy/openservice
ListQueue	mns:ListQueue	acs:mns:$region:$accountid:/queues
CreateQueue	mns:CreateQueue	acs:mns:$region:$accountid:/queues/$queueName
DeleteQueue	mns:DeleteQueue	acs:mns:$region:$accountid:/queues/$queueName
SetQueueAttributes	mns:SetQueueAttributes	acs:mns:$region:$accountid:/queues/$queueName
GetQueueAttributes	mns:GetQueueAttributes	acs:mns:$region:$accountid:/queues/$queueName
SendMessage or BatchSendMessage	mns:SendMessage	acs:mns:$region:$accountid:/queues/$queueName/messages
ReceiveMessage or BatchReceiveMessage	mns:ReceiveMessage	acs:mns:$region:$accountid:/queues/$queueName/messages
DeleteMessage	mns:DeleteMessage	acs:mns:$region:$accountid:/queues/$queueName/messages
PeekMessage or BatchPeekMessage	mns:PeekMessage	acs:mns:$region:$accountid:/queues/$queueName/messages
ChangeMessageVisibility	mns:ChangeMessageVisibility	acs:mns:$region:$accountid:/queues/$queueName/messages
ListTopic	mns:ListTopic	acs:mns:$region:$accountid:/topics
CreateTopic	mns:CreateTopic	acs:mns:$region:$accountid:/topics/$topicName
DeleteTopic	mns:DeleteTopic	acs:mns:$region:$accountid:/topics/$topicName
SetTopicAttributes	mns:SetTopicAttributes	acs:mns:$region:$accountid:/topics/$topicName
GetTopicAttributes	mns:GetTopicAttributes	acs:mns:$region:$accountid:/topics/$topicName
ListSubscriptionByTopic	mns:ListSubscriptionByTopic	acs:mns:$region:$accountid:/topics/$topicName/subscriptions
Subscribe	mns:Subscribe	acs:mns:$region:$accountid:/topics/$topicName/subscriptions/$subscriptionName
Unsubscribe	mns:Unsubscribe	acs:mns:$region:$accountid:/topics/$topicName/subscriptions/$subscriptionName
SetSubscriptionAttributes	mns:SetSubscriptionAttributes	acs:mns:$region:$accountid:/topics/$topicName/subscriptions/$subscriptionName
GetSubscriptionAttributes	mns:GetSubscriptionAttributes	acs:mns:$region:$accountid:/topics/$topicName/subscriptions/$subscriptionName
PublishMessage	mns:PublishMessage	acs:mns:$region:$accountid:/topics/$topicName/messages

Custom policy examples

Example 1: Add an IP address condition to an Allow statement

This policy allows access to Simple Message Queue (formerly MNS) from the 42.120.88.0/24 and 42.120.66.0/24 IP address ranges.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "mns:*",
            "Effect": "Allow",
            "Resource": "acs:mns:*:*:*",
            "Condition":{
                "IpAddress": {
                    "acs:SourceIp": ["42.120.88.0/24", "42.120.66.0/24"]
                }
            }
        }
    ]
}

Example 2: Add an IP address condition to a Deny statement
This policy denies all operations on Simple Message Queue (formerly MNS) if the source IP address is not in the 42.120.88.0/24 range.
```
{
    "Version":"1",
    "Statement":[
        {
            "Action":"mns:*",
            "Effect":"Deny",
            "Resource":"acs:mns:*:*:*",
            "Condition":{
                "NotIpAddress":{
                    "acs:SourceIp":[
                        "42.120.88.0/24"
                    ]
                }
            }
        }
    ]
}          
```
Important
The policy authentication rules prioritize Deny statements. If an access request matches a Deny rule, access is denied. Therefore, if a user tries to access the service from an IP address outside the 42.120.88.0/24 range, Simple Message Queue (formerly MNS) returns a permission denied error.

Example 3: Grant a RAM user read-only permissions for queues and topics

Use the following example policy to grant permissions to view queues, topics, queue properties, and topic properties.

{
    "Version":"1",
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "mns:ListQueue",
                "mns:ListTopic",
                "mns:GetQueueAttributes",
                "mns:GetTopicAttributes"
            ],
            "Resource":"acs:mns:*:*:*"
        }
    ]
}