Use Alibaba Cloud CLI to call RAM OpenAPI operations-Resource Access Management(RAM)-阿里云帮助中心

Before you begin

Familiarize yourself with Alibaba Cloud CLI before you start. For more information, see What is Alibaba Cloud CLI?.

Step 1: Install Alibaba Cloud CLI

Install Alibaba Cloud CLI before you begin. The CLI supports Windows, Linux, and macOS. Select the installer for your operating system.

You can also use Cloud Shell to debug CLI commands. For more information, see What is Cloud Shell?.

Step 2: Configure Alibaba Cloud CLI

Important

An Alibaba Cloud account has full management and access permissions for all product OpenAPI operations, which poses a high security risk. We strongly recommend that you create a RAM user, grant permissions based on the principle of least privilege, and use the RAM user for API access.

Configure your identity credentials, region ID, and other required information before use. Alibaba Cloud CLI supports multiple credential types. For more information, see Configure and manage identity credentials. This topic uses AccessKey-based credentials as an example. Perform the following steps:

Create a RAM user and an AccessKey for the RAM user. You will use this AccessKey to configure your identity credentials. For more information, see Create a RAM user and Create an AccessKey.
Grant permissions to the RAM user. For this example, you must grant the AliyunRAMFullAccess permission to the RAM user. This permission allows full management of RAM. For more information, see Manage RAM user permissions.
Obtain an available region ID. The Alibaba Cloud CLI uses the specified region to call OpenAPI operations. For a list of available regions and their endpoints, see Endpoints.

Note
When you use the Alibaba Cloud CLI, you can add the --region option to a command to specify a region for the call. This option overrides the region configured in your default identity credentials and environment variables. For more information, see Global command options.
Use the AccessKey of the RAM user to configure AccessKey-based credentials and name the profile AkProfile. For more information, see Configure and manage identity credentials.

Step 3: Generate a sample CLI command

In OpenAPI Explorer, go to the debug page for CreatePolicy.
On the Parameters tab, enter the request parameters. Then, click the CLI Example tab to view the generated CLI example.
Run the command in Cloud Shell, or copy the CLI example.
- Click the Run button to open Cloud Shell and quickly debug the command.
- Click the Repeat button to copy the CLI example to the clipboard. You can paste it into your local shell and run it.
  Note
  - If you copy the CLI example to a local shell for debugging, make sure that the parameter format is valid. For more information about the parameter formats for Alibaba Cloud CLI commands, see Understand command-line parameters.
  - OpenAPI Explorer adds the --region option to the example by default. When you run the command locally, the Alibaba Cloud CLI ignores the region configured in your default identity credentials and environment variables, and uses the region specified by this option. You can keep or remove this option as needed.

Step 4: Call RAM OpenAPI operations

Example 1: List supported RAM OpenAPI operations

Use the --help option to list the OpenAPI operations for RAM that Alibaba Cloud CLI supports. You can also view them in the API Overview.

Run the command.
```
aliyun ram --help
```

Sample output:

Usage:
    aliyun ram <ApiName> --parameter1 value1 --parameter2 value2 ...
Product: Ram (RAM)
Version: 2015-05-01
Available Api List:
    AddUserToGroup            Adds a RAM user to a specified user group.
    AttachPolicyToGroup       Attaches a policy to a specified user group.
    AttachPolicyToRole        Attaches a policy to a specified role.
    AttachPolicyToUser        Attaches a policy to a specified user.
    BindMFADevice             Binds a multi-factor authentication (MFA) device.
    ChangePassword            Allows a RAM user to change their own console logon password.
    ClearAccountAlias         Clears the alias of an Alibaba Cloud account.
    CreateAccessKey           Creates an AccessKey for a RAM user.
    CreateGroup               Creates a user group.
    CreateLoginProfile        Enables console logon for a RAM user.
    CreatePolicy              Creates a custom policy.
    CreatePolicyVersion       Creates a new version for a policy.

Example 2: Create a custom policy

Use the aliyun ram CreatePolicy command to create a custom policy that grants read-only permissions on ECS instances in the China (Qingdao) region.

Run the command.

aliyun ram CreatePolicy \
  --PolicyName 'View-ECS-instances-in-a-specific-region' \
  --Description 'View ECS instances in a specific region' \
  --PolicyDocument '{"Statement": [{"Effect": "Allow","Action": "ecs:Describe*","Resource": "acs:ecs:cn-qingdao:*:instance/*"}],"Version": "1"}'

Sample response.

{
  "Policy": {
    "DefaultVersion": "v1",
    "Description": "View ECS instances in a specific region",
    "PolicyName": "View-ECS-instances-in-a-specific-region",
    "CreateDate": "2021-10-13T02:46:57Z",
    "PolicyType": "Custom"
  },
  "RequestId": "BA34C54A-C2B1-5A65-B6B0-B5842C1DB4DA"
}

Note

If an error occurs when you call a Resource Access Management (RAM) OpenAPI operation, use the error code to check your request parameters and values.

You can also record the request ID or SDK error message and use OpenAPI Troubleshoot for self-service diagnostics.