Create a custom policy for Managed Service for OpenTelemetry

How policies work

A custom policy is a JSON document with one or more statements. Each statement combines three elements:

acs:xtrace:<region-id>:*:xtrace/<app-name>

Step 1: Create the policy

1. Sign in to the RAM console as a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

   

4. On the Create Policy page, click the JSON tab and enter your policy in the editor.

   Example 1: Read-only access to all applications in a single region

   This policy grants read access to all applications in the China (Hangzhou) region.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": "xtrace:ReadXtraceApp",
               "Resource": "acs:xtrace:cn-hangzhou:*:xtrace/*",
               "Effect": "Allow"
           },
           {
               "Action": "xtrace:Describe*",
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

   • xtrace:ReadXtraceApp scoped to all applications (xtrace/*) in cn-hangzhou

   • xtrace:Describe* on all resources -- required for console access

   Example 2: Read-only access to applications with a name prefix

   This policy restricts read access to applications whose names start with "demo" in the China (Hangzhou) region.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": "xtrace:ReadXtraceApp",
               "Resource": "acs:xtrace:cn-hangzhou:*:xtrace/demo*",
               "Effect": "Allow"
           },
           {
               "Action": "xtrace:Describe*",
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

   The only difference from Example 1 is the resource path: xtrace/demo* limits access to applications with the demo prefix.

   Example 3: Read and write access to a specific application

   This policy grants read and configuration access to a single application named prod-payment in the China (Hangzhou) region, while denying delete access.

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "xtrace:ReadXtraceApp",
                   "xtrace:SaveXtraceAppConfig"
               ],
               "Resource": "acs:xtrace:cn-hangzhou:*:xtrace/prod-payment",
               "Effect": "Allow"
           },
           {
               "Action": "xtrace:Describe*",
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": "xtrace:DeleteXtraceApp",
               "Resource": "*",
               "Effect": "Deny"
           }
       ]
   }

   • ReadXtraceApp and SaveXtraceAppConfig scoped to a single application

   • An explicit Deny statement prevents accidental deletion of any application

5. Click Optional advanced optimize, then click Perform to optimize the policy. The optimization:

   • Splits resources or conditions that are incompatible with the specified actions

   • Narrows down resource scopes

   • Deduplicates and merges statements

6. Click OK.

7. In the Create Policy dialog box, enter a Name and Description for the policy, then click OK.

Step 2: Attach the policy to a RAM user

1. Sign in to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column. > Tip: To grant permissions to multiple RAM users at once, select the users and click Add Permissions at the bottom of the page.

   

4. In the Grant Permission panel, configure the following settings:

   1. Resource Scope -- Choose the authorization scope: > Important: If you select ResourceGroup, the target cloud service must support resource groups. For details, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

      • Account: The policy applies to all resources under the current Alibaba Cloud account.

      • ResourceGroup: The policy applies only to resources in a specific resource group.

   2. Principal -- Verify that the correct RAM user is selected. The current user is pre-selected by default.

   3. Policy -- A policy contains a set of permissions. Policies can be classified into system policies and custom policies. You can select multiple policies at a time. > Note: The system flags high-risk system policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching these policies unless strictly necessary.

      • System policies: Policies created by Alibaba Cloud. You can use but cannot modify these policies. Version updates are maintained by Alibaba Cloud. For more information, see Services that work with RAM.

      • Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.

What's next

• Policy elements -- Learn more about policy syntax and advanced features such as conditions.

• Create a custom policy -- Explore additional policy authoring methods.

• Services that work with RAM -- View the full list of Alibaba Cloud services that support RAM access control.