RAM authorization-Quick BI(Quick BI)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Quick BI for RAM permission policies. The RAM code (RamCode) for Quick BI is quickbi-public , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Quick BI. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
quickbi-public:ResultCallback	ResultCallback	update	All Resource ``	None	None
quickbi-public:ListByUserGroupId	ListByUserGroupId	list	All Resource ``	None	None
quickbi-public:QuerySharesToUserList	QuerySharesToUserList	list	All Resource ``	None	None
quickbi-public:ListPortalMenuAuthorization	ListPortalMenuAuthorization	list	All Resource ``	None	None
quickbi-public:ListApiDatasource	ListApiDatasource	list	All Resource ``	None	None
quickbi-public:QueryWorkspaceRoleConfig	QueryWorkspaceRoleConfig	get	All Resource ``	None	None
quickbi-public:CheckDatasetExisted	CheckDatasetExisted	none	All Resource ``	None	None
quickbi-public:QueryCubePerformance	QueryCubePerformance	get	All Resource ``	None	None
quickbi-public:UpdateWorkspaceUsersRole	UpdateWorkspaceUsersRole	update	All Resource ``	None	None
quickbi-public:CancelCollection	CancelCollection	delete	All Resource ``	None	None
quickbi-public:QueryUserGroupListByParentId	QueryUserGroupListByParentId	list	All Resource ``	None	None
quickbi-public:CreateTicket	CreateTicket	create	All Resource ``	None	None
quickbi-public:QueryDataServiceList	QueryDataServiceList	get	All Resource ``	None	None
quickbi-public:DeleteUserTagMeta	DeleteUserTagMeta	delete	All Resource ``	None	None
quickbi-public:GetMailTaskList	GetMailTaskList	get	All Resource ``	None	None
quickbi-public:AddUserToWorkspace	AddUserToWorkspace	create	All Resource ``	None	None
quickbi-public:SmartqQueryAbility	SmartqQueryAbility	get	All Resource ``	None	None
quickbi-public:QueryComponentPerformance	QueryComponentPerformance	list	All Resource ``	None	None
quickbi-public:CheckOrganizationMember	CheckOrganizationMember	get	All Resource ``	None	None
quickbi-public:ListWorkspaceRoles	ListWorkspaceRoles	list	All Resource ``	None	None
quickbi-public:CheckReadable	CheckReadable	get	All Resource ``	None	None
quickbi-public:ListSharedReports	ListSharedReports	list	All Resource ``	None	None
quickbi-public:ListWhitePortalMenu	ListWhitePortalMenu	get	All Resource ``	None	None
quickbi-public:DataSetBlood	DataSetBlood	get	All Resource ``	None	None
quickbi-public:ListOrganizationRoleUsers	ListOrganizationRoleUsers	list	All Resource ``	None	None
quickbi-public:QueryWorkspaceUserList	QueryWorkspaceUserList	list	All Resource ``	None	None
quickbi-public:ListCollections	ListCollections	list	All Resource ``	None	None
quickbi-public:ListWorkspaceUserRolesByUserId	ListWorkspaceUserRolesByUserId	get	All Resource ``	None	None
quickbi-public:TransferUsergroup	TransferUsergroup	update	All Resource ``	None	None
quickbi-public:SetDataLevelPermissionRuleConfig	SetDataLevelPermissionRuleConfig	create	All Resource ``	None	None
quickbi-public:WithdrawAllUserGroups	WithdrawAllUserGroups	delete	All Resource ``	None	None
quickbi-public:CreateUserGroup	CreateUserGroup	create	All Resource ``	None	None
quickbi-public:SetDataLevelPermissionWhiteList	SetDataLevelPermissionWhiteList	update	All Resource ``	None	None
quickbi-public:GetUserGroupInfo	GetUserGroupInfo	list	All Resource ``	None	None
quickbi-public:DeleteTicket	DeleteTicket	delete	All Resource ``	None	None
quickbi-public:CreateCubeBySql	CreateCubeBySql	create	All Resource ``	None	None
quickbi-public:ListWorkspaceRoleUsers	ListWorkspaceRoleUsers	list	All Resource ``	None	None
quickbi-public:QueryShareList	QueryShareList	list	All Resource ``	None	None
quickbi-public:AddShareReport	AddShareReport	create	All Resource ``	None	None
quickbi-public:QueryUserGroupMember	QueryUserGroupMember	list	All Resource ``	None	None
quickbi-public:SmartqAuthorize	SmartqAuthorize	update	All Resource ``	None	None
quickbi-public:QueryApprovalInfo	QueryApprovalInfo	get	All Resource ``	None	None
quickbi-public:IpWhiteListConfig	IpWhiteListConfig	update	All Resource ``	None	None
quickbi-public:QueryWorksByWorkspace	QueryWorksByWorkspace	list	All Resource ``	None	None
quickbi-public:ModifyApiDatasourceParameters	ModifyApiDatasourceParameters	update	All Resource ``	None	None
quickbi-public:QueryUserInfoByAccount	QueryUserInfoByAccount	get	All Resource ``	None	None
quickbi-public:QueryCubeOptimization	QueryCubeOptimization	get	All Resource ``	None	None
quickbi-public:AddUserGroupMembers	AddUserGroupMembers	create	All Resource ``	None	None
quickbi-public:QueryAccelerationLogByCubeId	QueryAccelerationLogByCubeId	get	All Resource ``	None	None
quickbi-public:QueryUserRoleInfoInWorkspace	QueryUserRoleInfoInWorkspace	get	All Resource ``	None	None
quickbi-public:SmartqAuthTransfer	SmartqAuthTransfer	create	All Resource ``	None	None
quickbi-public:SaveFavorites	SaveFavorites	create	All Resource ``	None	None
quickbi-public:UpdateEmbeddedStatus	UpdateEmbeddedStatus	update	All Resource ``	None	None
quickbi-public:QueryTicketInfo	QueryTicketInfo	get	All Resource ``	None	None
quickbi-public:QuerySmartqPermissionByCubeId	QuerySmartqPermissionByCubeId	get	All Resource ``	None	None
quickbi-public:QueryCopilotEmbedConfig	QueryCopilotEmbedConfig	list	All Resource ``	None	None
quickbi-public:UpdateTicketNum	UpdateTicketNum	update	All Resource ``	None	None
quickbi-public:UpdateDataLevelPermissionStatus	UpdateDataLevelPermissionStatus	update	All Resource ``	None	None
quickbi-public:SetDataLevelPermissionExtraConfig	SetDataLevelPermissionExtraConfig	create	All Resource ``	None	None
quickbi-public:CreateWorkspace	CreateWorkspace	create	All Resource ``	None	None
quickbi-public:QueryWorks	QueryWorks	get	All Resource ``	None	None
quickbi-public:QueryUserByMobileAccount	QueryUserByMobileAccount	get	All Resource ``	None	None
quickbi-public:QueryUserTagValueList	QueryUserTagValueList	list	All Resource ``	None	None
quickbi-public:QueryWorksBloodRelationship	QueryWorksBloodRelationship	get	All Resource ``	None	None
quickbi-public:QueryDatasetDetailInfo	QueryDatasetDetailInfo	get	All Resource ``	None	None
quickbi-public:ListDataLevelPermissionWhiteList	ListDataLevelPermissionWhiteList	list	All Resource ``	None	None
quickbi-public:ListPortalMenus	ListPortalMenus	list	All Resource ``	None	None
quickbi-public:CreateTicket4Copilot	CreateTicket4Copilot	create	All Resource ``	None	None
quickbi-public:UpdateUser	UpdateUser	update	All Resource ``	None	None
quickbi-public:QueryDataRange	QueryDataRange	get	All Resource ``	None	None
quickbi-public:DeleteUserGroupMembers	DeleteUserGroupMembers	delete	All Resource ``	None	None
quickbi-public:QueryEmbeddedInfo	QueryEmbeddedInfo	get	All Resource ``	None	None
quickbi-public:DeleteUser	DeleteUser	delete	All Resource ``	None	None
quickbi-public:ListFavoriteReports	ListFavoriteReports	list	All Resource ``	None	None
quickbi-public:QueryData	QueryData	get	All Resource ``	None	None
quickbi-public:QueryUserList	QueryUserList	list	All Resource ``	None	None
quickbi-public:UpdateWorkspaceUserRole	UpdateWorkspaceUserRole	update	All Resource ``	None	None
quickbi-public:QueryReadableResourcesListByUserIdV2	QueryReadableResourcesListByUserIdV2	get	All Resource ``	None	None
quickbi-public:UpdateUserTagMeta	UpdateUserTagMeta	update	All Resource ``	None	None
quickbi-public:DeleteUserFromWorkspace	DeleteUserFromWorkspace	delete	All Resource ``	None	None
quickbi-public:QueryUserTagMetaList	QueryUserTagMetaList	list	All Resource ``	None	None
quickbi-public:AuthorizeMenu	AuthorizeMenu	create	All Resource ``	None	None
quickbi-public:UpdateUserGroup	UpdateUserGroup	update	All Resource ``	None	None
quickbi-public:QueryUserInfoByUserId	QueryUserInfoByUserId	get	All Resource ``	None	None
quickbi-public:QueryReadableResourcesListByUserId	QueryReadableResourcesListByUserId	list	All Resource ``	None	None
quickbi-public:AddDataSource	AddDataSource	create	All Resource ``	None	None
quickbi-public:DeleteUserGroupMember	DeleteUserGroupMember	delete	All Resource ``	None	None
quickbi-public:UpdateCubeBySql	UpdateCubeBySql	update	All Resource ``	None	None
quickbi-public:DeleteDataLevelRuleConfig	DeleteDataLevelRuleConfig	delete	All Resource ``	None	None
quickbi-public:DeleteUserGroup	DeleteUserGroup	delete	All Resource ``	None	None
quickbi-public:DelayTicketExpireTime	DelayTicketExpireTime	update	All Resource ``	None	None
quickbi-public:ListCubeDataLevelPermissionConfig	ListCubeDataLevelPermissionConfig	list	All Resource ``	None	None
quickbi-public:CreateDataset	CreateDataset	create	All Resource ``	None	None
quickbi-public:DataSourceBlood	DataSourceBlood	get	All Resource ``	None	None
quickbi-public:UpdateDataSource	UpdateDataSource	update	All Resource ``	None	None
quickbi-public:UpdateUserTagValue	UpdateUserTagValue	update	All Resource ``	None	None
quickbi-public:QueryReportPerformance	QueryReportPerformance	list	All Resource ``	None	None
quickbi-public:GetWorksEmbedList	GetWorksEmbedList	list	All Resource ``	None	None
quickbi-public:QueryLlmCubeWithThemeListByUserId	QueryLlmCubeWithThemeListByUserId	get	All Resource ``	None	None
quickbi-public:QueryOrganizationRoleConfig	QueryOrganizationRoleConfig	get	All Resource ``	None	None
quickbi-public:AddDataLevelPermissionRuleUsers	AddDataLevelPermissionRuleUsers	create	All Resource ``	None	None
quickbi-public:AddWorksAuthorization	AddWorksAuthorization	create	All Resource ``	None	None
quickbi-public:QueryDashboardNl2sql	QueryDashboardNl2sql	none	All Resource ``	None	None
quickbi-public:DeleteDataLevelPermissionRuleUsers	DeleteDataLevelPermissionRuleUsers	delete	All Resource ``	None	None
quickbi-public:AddUserTagMeta	AddUserTagMeta	create	All Resource ``	None	None
quickbi-public:ListOrganizationRoles	ListOrganizationRoles	list	All Resource ``	None	None
quickbi-public:ListUserGroupsByUserId	ListUserGroupsByUserId	list	All Resource ``	None	None
quickbi-public:ManualRunMailTask	ManualRunMailTask	update	All Resource ``	None	None
quickbi-public:QueryDatasetSwitchInfo	QueryDatasetSwitchInfo	get	All Resource ``	None	None
quickbi-public:ListDynamicTag	ListDynamicTag	get	All Resource ``	None	None
quickbi-public:CancelReportShare	CancelReportShare	delete	All Resource ``	None	None
quickbi-public:ModifyDashboardNl2sqlStatus	ModifyDashboardNl2sqlStatus	update	All Resource ``	None	None
quickbi-public:ListAccelerationOfWorkspace	ListAccelerationOfWorkspace	get	All Resource ``	None	None
quickbi-public:QueryOrganizationWorkspaceList	QueryOrganizationWorkspaceList	list	All Resource ``	None	None
quickbi-public:QueryDatasetSmartqStatus	QueryDatasetSmartqStatus	get	All Resource ``	None	None
quickbi-public:CancelAuthorizationMenu	CancelAuthorizationMenu	delete	All Resource ``	None	None
quickbi-public:AddUser	AddUser	create	All Resource ``	None	None
quickbi-public:ModifyCopilotEmbedConfig	ModifyCopilotEmbedConfig	update	All Resource ``	None	None
quickbi-public:QueryWorksByOrganization	QueryWorksByOrganization	list	All Resource ``	None	None
quickbi-public:DeleteAuthorizationByUserId	DeleteAuthorizationByUserId	delete	All Resource ``	None	None
quickbi-public:QueryDataService	QueryDataService	get	All Resource ``	None	None
quickbi-public:QueryAuditLog	QueryAuditLog	get	All Resource ``	None	None
quickbi-public:QueryLastAccelerationEngineJob	QueryLastAccelerationEngineJob	get	All Resource ``	None	None
quickbi-public:QueryDatasetInfo	QueryDatasetInfo	get	All Resource ``	None	None
quickbi-public:BatchAddFeishuUsers	BatchAddFeishuUsers	create	All Resource ``	None	None
quickbi-public:GetDataSourceConnectionInfo	GetDataSourceConnectionInfo	get	All Resource ``	None	None
quickbi-public:AddWorkspaceUsers	AddWorkspaceUsers	create	All Resource ``	None	None
quickbi-public:AddUserGroupMember	AddUserGroupMember	create	All Resource ``	None	None
quickbi-public:QueryEmbeddedStatus	QueryEmbeddedStatus	get	All Resource ``	None	None
quickbi-public:AddDataLevelPermissionWhiteList	AddDataLevelPermissionWhiteList	create	All Resource ``	None	None
quickbi-public:GetMailTaskStatus	GetMailTaskStatus	get	All Resource ``	None	None
quickbi-public:QueryDatasetList	QueryDatasetList	list	All Resource ``	None	None
quickbi-public:ChangeVisibilityModel	ChangeVisibilityModel	update	All Resource ``	None	None
quickbi-public:ClearDynamicTagCache	ClearDynamicTagCache	none	All Resource ``	None	None
quickbi-public:ListDataSource	ListDataSource	list	All Resource ``	None	None
quickbi-public:ListRecentViewReports	ListRecentViewReports	list	All Resource ``	None	None
quickbi-public:AllotDatasetAccelerationTask	AllotDatasetAccelerationTask	update	All Resource ``	None	None

Resource

The following table lists the resources defined by Quick BI. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Quick BI does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: