RAM authorization-Operations Incident Center(Operations Incident Center)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Operations Incident Center for RAM permission policies. The RAM code (RamCode) for Operations Incident Center is gemp , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Operations Incident Center. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
gemp:ListSubscriptionServiceGroups	ListSubscriptionServiceGroups	get	All Resource ``	None	None
gemp:DisableSubscription	DisableSubscription	update	All Resource ``	None	None
gemp:GetTenantStatus	GetTenantStatus	get	All Resource ``	None	None
gemp:GetSimilarIncidentStatistics	GetSimilarIncidentStatistics	get	All Resource ``	None	None
gemp:GetEscalationPlan	GetEscalationPlan	get	All Resource ``	None	None
gemp:GetHomePageGuidance	GetHomePageGuidance	get	All Resource ``	None	None
gemp:FinishProblem	FinishProblem	update	All Resource ``	None	None
gemp:ListUsers	ListUsers	get	All Resource ``	None	None
gemp:GetIncidentSubtotalCount	GetIncidentSubtotalCount	get	All Resource ``	None	None
gemp:DisableEscalationPlan	DisableEscalationPlan	update	All Resource ``	None	None
gemp:CreateIntegrationConfig	CreateIntegrationConfig	create	All Resource ``	None	None
gemp:EnableServiceGroupWebhook	EnableServiceGroupWebhook	update	All Resource ``	None	None
gemp:RecoverProblem	RecoverProblem	update	All Resource ``	None	None
gemp:ListDataReportForServiceGroup	ListDataReportForServiceGroup	get	All Resource ``	None	None
gemp:UpdateProblemNotice	UpdateProblemNotice	update	All Resource ``	None	None
gemp:ListProblemSubtotals	ListProblemSubtotals	get	All Resource ``	None	None
gemp:GetService	GetService	get	All Resource ``	None	None
gemp:BillingStatistics	BillingStatistics	none	All Resource ``	None	None
gemp:DeliverIncident	DeliverIncident	update	All Resource ``	None	None
gemp:GetIntegrationConfig	GetIntegrationConfig	get	All Resource ``	None	None
gemp:ListUserSerivceGroups	ListUserSerivceGroups	get	All Resource ``	None	None
gemp:ListServiceGroupsByUserId	ListServiceGroupsByUserId	get	All Resource ``	None	None
gemp:ListIncidentTimelines	ListIncidentTimelines	get	All Resource ``	None	None
gemp:ListServices	ListServices	get	All Resource ``	None	None
gemp:FinishIncident	FinishIncident	update	All Resource ``	None	None
gemp:ListServiceGroups	ListServiceGroups	get	All Resource ``	None	None
gemp:GetServiceGroup	GetServiceGroup	get	All Resource ``	None	None
gemp:ListConfigs	ListConfigs	get	All Resource ``	None	None
gemp:ListSourceEvents	ListSourceEvents	get	All Resource ``	None	None
gemp:CreateTenantApplication	CreateTenantApplication	create	All Resource ``	None	None
gemp:EnableSubscription	EnableSubscription	update	All Resource ``	None	None
gemp:CreateService	CreateService	create	All Resource ``	None	None
gemp:ListDataReportForUser	ListDataReportForUser	get	All Resource ``	None	None
gemp:ListProblemOperations	ListProblemOperations	get	All Resource ``	None	None
gemp:UpdateProblem	UpdateProblem	update	All Resource ``	None	None
gemp:ListMonitorSources	ListMonitorSources	get	All Resource ``	None	None
gemp:DisableServiceGroupWebhook	DisableServiceGroupWebhook	update	All Resource ``	None	None
gemp:CreateEscalationPlan	CreateEscalationPlan	create	All Resource ``	None	None
gemp:GetResourceStatistics	GetResourceStatistics	get	All Resource ``	None	None
gemp:CreateProblemMeasure	CreateProblemMeasure	create	All Resource ``	None	None
gemp:CreateRichText	CreateRichText	create	All Resource ``	None	None
gemp:DisableIntegrationConfig	DisableIntegrationConfig	update	All Resource ``	None	None
gemp:DeleteSubscription	DeleteSubscription	delete	All Resource ``	None	None
gemp:GetTenantApplication	GetTenantApplication	get	All Resource ``	None	None
gemp:CreateProblemSubtotal	CreateProblemSubtotal	create	All Resource ``	None	None
gemp:GetProblemImprovement	GetProblemImprovement	get	All Resource ``	None	None
gemp:GetEvent	GetEvent	get	All Resource ``	None	None
gemp:ListChartDataForUser	ListChartDataForUser	get	All Resource ``	None	None
gemp:ListEscalationPlans	ListEscalationPlans	get	All Resource ``	None	None
gemp:CreateServiceGroup	CreateServiceGroup	create	All Resource ``	None	None
gemp:ListRouteRules	ListRouteRules	get	All Resource ``	None	None
gemp:CreateProblemTimeline	CreateProblemTimeline	create	All Resource ``	None	None
gemp:GetSubscription	GetSubscription	get	All Resource ``	None	None
gemp:ReplayProblem	ReplayProblem	update	All Resource ``	None	None
gemp:UpdateEscalationPlan	UpdateEscalationPlan	update	All Resource ``	None	None
gemp:GetRichText	GetRichText	get	All Resource ``	None	None
gemp:GetServiceGroupPersonScheduling	GetServiceGroupPersonScheduling	get	All Resource ``	None	None
gemp:UnbindUser	UnbindUser	update	All Resource ``	None	None
gemp:ListDictionaries	ListDictionaries	get	All Resource ``	None	None
gemp:GetProblemPreview	GetProblemPreview	get	All Resource ``	None	None
gemp:UpdateSubscription	UpdateSubscription	update	All Resource ``	None	None
gemp:CreateIncident	CreateIncident	create	All Resource ``	None	None
gemp:ListIntegrationConfigs	ListIntegrationConfigs	get	All Resource ``	None	None
gemp:ListChartDataForServiceGroup	ListChartDataForServiceGroup	get	All Resource ``	None	None
gemp:DeleteProblem	DeleteProblem	delete	All Resource ``	None	None
gemp:GetUser	GetUser	get	All Resource ``	None	None
gemp:GetIncidentListByIdList	GetIncidentListByIdList	get	All Resource ``	None	None
gemp:EnableRouteRule	EnableRouteRule	update	All Resource ``	None	None
gemp:DeleteUser	DeleteUser	delete	All Resource ``	None	None
gemp:DeleteIntegrationConfig	DeleteIntegrationConfig	delete	All Resource ``	None	None
gemp:GetProblem	GetProblem	get	All Resource ``	None	None
gemp:GetServiceGroupSchedulingPreview	GetServiceGroupSchedulingPreview	get	All Resource ``	None	None
gemp:VerifyRouteRule	VerifyRouteRule	none	All Resource ``	None	None
gemp:DeleteServiceGroupScheduling	DeleteServiceGroupScheduling	delete	All Resource ``	None	None
gemp:GetServiceGroupScheduling	GetServiceGroupScheduling	get	All Resource ``	None	None
gemp:CreateIncidentSubtotal	CreateIncidentSubtotal	create	All Resource ``	None	None
gemp:UpdateIntegrationConfig	UpdateIntegrationConfig	update	All Resource ``	None	None
gemp:ListProblems	ListProblems	get	All Resource ``	None	None
gemp:GetIncident	GetIncident	get	All Resource ``	None	None
gemp:ListIncidents	ListIncidents	get	All Resource ``	None	None
gemp:UpdateIncident	UpdateIncident	update	All Resource ``	None	None
gemp:DeleteIncident	DeleteIncident	delete	All Resource ``	None	None
gemp:UpdateRouteRule	UpdateRouteRule	update	All Resource ``	None	None
gemp:UpdateProblemEffectionService	UpdateProblemEffectionService	update	All Resource ``	None	None
gemp:DeleteEscalationPlan	DeleteEscalationPlan	delete	All Resource ``	None	None
gemp:ListRouteRulesByAssignWhoId	ListRouteRulesByAssignWhoId	get	All Resource ``	None	None
gemp:CancelProblem	CancelProblem	update	All Resource ``	None	None
gemp:GetRouteRule	GetRouteRule	get	All Resource ``	None	None
gemp:CheckWebhook	CheckWebhook	none	All Resource ``	None	None
gemp:DeleteServiceGroupUser	DeleteServiceGroupUser	delete	All Resource ``	None	None
gemp:UpdateProblemImprovement	UpdateProblemImprovement	update	All Resource ``	None	None
gemp:ListRouteRulesByService	ListRouteRulesByService	get	All Resource ``	None	None
gemp:CreateUser	CreateUser	create	All Resource ``	None	None
gemp:GetProblemEffectionService	GetProblemEffectionService	get	All Resource ``	None	None
gemp:CreateProblemEffectionService	CreateProblemEffectionService	create	All Resource ``	None	None
gemp:ListIncidentDetailEscalationPlans	ListIncidentDetailEscalationPlans	get	All Resource ``	None	None
gemp:UpdateService	UpdateService	update	All Resource ``	None	None
gemp:UpdateProblemTimeline	UpdateProblemTimeline	update	All Resource ``	None	None
gemp:AddProblemServiceGroup	AddProblemServiceGroup	create	All Resource ``	None	None
gemp:CreateSubscription	CreateSubscription	create	All Resource ``	None	None
gemp:ListEscalationPlanServices	ListEscalationPlanServices	get	All Resource ``	None	None
gemp:ListIncidentDetailTimelines	ListIncidentDetailTimelines	get	All Resource ``	None	None
gemp:DeleteService	DeleteService	delete	All Resource ``	None	None
gemp:GetUserGuideStatus	GetUserGuideStatus	get	All Resource ``	None	None
gemp:ListTrendForSourceEvent	ListTrendForSourceEvent	get	All Resource ``	None	None
gemp:CreateProblemTimelines	CreateProblemTimelines	create	All Resource ``	None	None
gemp:RemoveIntegrationConfig	RemoveIntegrationConfig	update	All Resource ``	None	None
gemp:ConfirmIntegrationConfig	ConfirmIntegrationConfig	none	All Resource ``	None	None
gemp:RemoveProblemServiceGroup	RemoveProblemServiceGroup	update	All Resource ``	None	None
gemp:GeneratePictureUploadSign	GeneratePictureUploadSign	none	All Resource ``	None	None
gemp:ListEscalationPlansByNoticeObject	ListEscalationPlansByNoticeObject	get	All Resource ``	None	None
gemp:CreateRouteRule	CreateRouteRule	create	All Resource ``	None	None
gemp:CreateServiceGroupScheduling	CreateServiceGroupScheduling	create	All Resource ``	None	None
gemp:ListSubscriptions	ListSubscriptions	get	All Resource ``	None	None
gemp:GetServiceGroupSpecialPersonScheduling	GetServiceGroupSpecialPersonScheduling	get	All Resource ``	None	None
gemp:GeneratePictureLink	GeneratePictureLink	get	All Resource ``	None	None
gemp:ListProblemTimeLines	ListProblemTimeLines	get	All Resource ``	None	None
gemp:ListByMonitorSourceId	ListByMonitorSourceId	get	All Resource ``	None	None
gemp:CreateProblem	CreateProblem	create	All Resource ``	None	None
gemp:DeleteProblemEffectionService	DeleteProblemEffectionService	delete	All Resource ``	None	None
gemp:DeleteProblemMeasure	DeleteProblemMeasure	delete	All Resource ``	None	None
gemp:RespondIncident	RespondIncident	update	All Resource ``	None	None
gemp:UpdateRichText	UpdateRichText	update	All Resource ``	None	None
gemp:DeleteRouteRule	DeleteRouteRule	delete	All Resource ``	None	None
gemp:UpdateProblemMeasure	UpdateProblemMeasure	update	All Resource ``	None	None
gemp:DisableRouteRule	DisableRouteRule	update	All Resource ``	None	None
gemp:RevokeProblemRecovery	RevokeProblemRecovery	update	All Resource ``	None	None
gemp:ListSourceEventsForMonitorSource	ListSourceEventsForMonitorSource	get	All Resource ``	None	None
gemp:ListIntegrationConfigTimelines	ListIntegrationConfigTimelines	get	All Resource ``	None	None
gemp:GenerateProblemPictureUploadSign	GenerateProblemPictureUploadSign	get	All Resource ``	None	None
gemp:UpdateUserGuideStatus	UpdateUserGuideStatus	update	All Resource ``	None	None
gemp:GetIncidentStatistics	GetIncidentStatistics	get	All Resource ``	None	None
gemp:UpdateServiceGroup	UpdateServiceGroup	update	All Resource ``	None	None
gemp:EnableEscalationPlan	EnableEscalationPlan	update	All Resource ``	None	None
gemp:UpdateServiceGroupSpecialDayScheduling	UpdateServiceGroupSpecialDayScheduling	update	All Resource ``	None	None
gemp:RefreshIntegrationConfigKey	RefreshIntegrationConfigKey	none	All Resource ``	None	None
gemp:DeleteServiceGroup	DeleteServiceGroup	delete	All Resource ``	None	None
gemp:GenerateProblemPictureLink	GenerateProblemPictureLink	get	All Resource ``	None	None
gemp:ListProblemDetailOperations	ListProblemDetailOperations	get	All Resource ``	None	None
gemp:UpdateServiceGroupScheduling	UpdateServiceGroupScheduling	update	All Resource ``	None	None
gemp:DeleteProblemTimeline	DeleteProblemTimeline	delete	All Resource ``	None	None
gemp:ListAlerts	ListAlerts	get	All Resource ``	None	None
gemp:EnableIntegrationConfig	EnableIntegrationConfig	update	All Resource ``	None	None
gemp:UpdateUser	UpdateUser	update	All Resource ``	None	None
gemp:ListIncidentSubtotals	ListIncidentSubtotals	get	All Resource ``	None	None
gemp:ListServiceGroupMonitorSourceTemplates	ListServiceGroupMonitorSourceTemplates	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Operations Incident Center. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Operations Incident Center does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: