RAM authorization-Tair (Redis® OSS-Compatible)(Tair)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Tair (Redis OSS-compatible) for RAM permission policies. The RAM code (RamCode) for Tair (Redis OSS-compatible) is kvstore , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Tair (Redis OSS-compatible). The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
kvstore:AddShardingNode	AddShardingNode	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:FlushInstanceForDB	FlushInstanceForDB	delete	All Resource ``	None	None
kvstore:ModifyAccountPassword	ModifyAccountPassword	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:LockDBInstanceWrite	LockDBInstanceWrite	update	All Resource ``	None	None
kvstore:ModifyGlobalSecurityIPGroup	ModifyGlobalSecurityIPGroup	update	All Resource ``	None	None
kvstore:SyncDtsStatus	SyncDtsStatus	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeLogicInstanceTopology	DescribeLogicInstanceTopology	get	All Resource ``	None	None
kvstore:ModifyTaskInfo	ModifyTaskInfo	update	All Resource ``	None	None
kvstore:SwitchInstanceProxy	SwitchInstanceProxy	update	All Resource ``	None	None
kvstore:DescribeGlobalSecurityIPGroup	DescribeGlobalSecurityIPGroup	get	All Resource ``	None	None
kvstore:DescribeAccounts	DescribeAccounts	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeDedicatedClusterInstanceList	DescribeDedicatedClusterInstanceList	get	All Resource ``	None	None
kvstore:CreateInstances	CreateInstances	create	DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/`	kvstore:InstanceClass kvstore:InstanceType kvstore:Appendonly	None
kvstore:ModifyBackupPolicy	ModifyBackupPolicy	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:EnableBackupLog	None
kvstore:CreateInstance	CreateInstance	create	DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/`	kvstore:InstanceClass kvstore:Appendonly kvstore:InstanceType	None
kvstore:CreateGlobalSecurityIPGroup	CreateGlobalSecurityIPGroup	create	All Resource ``	None	None
kvstore:ModifyInstanceTDE	ModifyInstanceTDE	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:TDEStatus	None
kvstore:DescribeDBNodeDirectVipInfo	DescribeDBNodeDirectVipInfo	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:MigrateToOtherZone	MigrateToOtherZone	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyDBInstanceMonitor	ModifyDBInstanceMonitor	update	All Resource ``	None	None
kvstore:DescribeAvailableResource	DescribeAvailableResource	get	All Resource ``	None	None
kvstore:DescribeInstances	DescribeInstances	list	DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/*` DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeParameterGroups	DescribeParameterGroups	list	All Resource ``	None	None
kvstore:ModifyActiveOperationTask	ModifyActiveOperationTask	update	All Resource ``	None	None
kvstore:ResetAccountPassword	ResetAccountPassword	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifySecurityGroupConfiguration	ModifySecurityGroupConfiguration	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:DescribeParameterGroup	DescribeParameterGroup	get	All Resource ``	None	None
kvstore:DescribeActiveOperationMaintenanceConfig	DescribeActiveOperationMaintenanceConfig	get	All Resource ``	None	None
kvstore:DescribeClusterMemberInfo	DescribeClusterMemberInfo	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyInstanceVpcAuthMode	ModifyInstanceVpcAuthMode	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:VpcAuthMode	None
kvstore:SwitchInstanceHA	SwitchInstanceHA	update	All Resource ``	None	None
kvstore:DescribeTags	DescribeTags	get	All Resource ``	None	None
kvstore:ModifyInstanceSSL	ModifyInstanceSSL	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:SSLEnabled	None
kvstore:DescribeRoleZoneInfo	DescribeRoleZoneInfo	get	All Resource ``	None	None
kvstore:DescribeInstanceAutoRenewalAttribute	DescribeInstanceAutoRenewalAttribute	get	All Resource ``	None	None
kvstore:FlushExpireKeys	FlushExpireKeys	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:DescribeAuditLogConfig	DescribeAuditLogConfig	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyDBInstanceConnectionString	ModifyDBInstanceConnectionString	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyGlobalSecurityIPGroupName	ModifyGlobalSecurityIPGroupName	update	All Resource ``	None	None
kvstore:GrantAccountPrivilege	GrantAccountPrivilege	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DeleteBackup	DeleteBackup	delete	All Resource ``	None	None
kvstore:DescribeParameters	DescribeParameters	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
kvstore:DescribeHistoryTasksStat	DescribeHistoryTasksStat	get	All Resource ``	None	None
kvstore:CheckCloudResourceAuthorized	CheckCloudResourceAuthorized	get	All Resource ``	None	None
kvstore:DescribeServiceLinkedRoleExists	DescribeServiceLinkedRoleExists	get	All Resource ``	None	None
kvstore:SwitchNetwork	SwitchNetwork	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifySecurityIps	ModifySecurityIps	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DeleteAccount	DeleteAccount	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyInstanceBandwidth	ModifyInstanceBandwidth	update	All Resource ``	None	None
kvstore:DescribeParameterTemplates	DescribeParameterTemplates	get	All Resource ``	None	None
kvstore:ModifyGlobalSecurityIPGroupRelation	ModifyGlobalSecurityIPGroupRelation	update	All Resource ``	None	None
kvstore:ReleaseInstancePublicConnection	ReleaseInstancePublicConnection	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeInstanceSSL	DescribeInstanceSSL	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DeleteShardingNode	DeleteShardingNode	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyDBInstanceAutoUpgrade	ModifyDBInstanceAutoUpgrade	update	All Resource ``	None	None
kvstore:CancelActiveOperationTasks	CancelActiveOperationTasks	update	All Resource ``	None	None
kvstore:AllocateInstancePublicConnection	AllocateInstancePublicConnection	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DeleteGlobalSecurityIPGroup	DeleteGlobalSecurityIPGroup	delete	All Resource ``	None	None
kvstore:TagResources	TagResources	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:TransformToPrePaid	TransformToPrePaid	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeEncryptionKeyList	DescribeEncryptionKeyList	get	All Resource ``	None	None
kvstore:ModifyInstanceMajorVersion	ModifyInstanceMajorVersion	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:CreateGlobalDistributeCache	CreateGlobalDistributeCache	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeParameterGroupSupportParam	DescribeParameterGroupSupportParam	get	All Resource ``	None	None
kvstore:DescribeHistoryEventsStat	DescribeHistoryEventsStat	get	All Resource ``	None	None
kvstore:UntagResources	UntagResources	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeSecurityIps	DescribeSecurityIps	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeActiveOperationTasks	DescribeActiveOperationTasks	get	All Resource ``	None	None
kvstore:RemoveSubInstance	RemoveSubInstance	update	All Resource ``	None	None
kvstore:ModifyBackupExpireTime	ModifyBackupExpireTime	update	All Resource ``	None	None
kvstore:DescribeActiveOperationTask	DescribeActiveOperationTask	get	All Resource ``	None	None
kvstore:DescribeParameterModificationHistory	DescribeParameterModificationHistory	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbinstanceId}`	None	None
kvstore:DescribeHistoryEvents	DescribeHistoryEvents	create	All Resource ``	None	None
kvstore:DescribeGlobalSecurityIPGroupRelation	DescribeGlobalSecurityIPGroupRelation	get	All Resource ``	None	None
kvstore:ModifyAccountDescription	ModifyAccountDescription	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeSecurityGroupConfiguration	DescribeSecurityGroupConfiguration	get	*dbinstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:CreateTairInstance	CreateTairInstance	create	DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/`	kvstore:InstanceClass kvstore:InstanceType	None
kvstore:DescribeParameterGroupTemplateList	DescribeParameterGroupTemplateList	list	All Resource ``	None	None
kvstore:DescribeInstanceTDEStatus	DescribeInstanceTDEStatus	get	All Resource ``	None	None
kvstore:DescribeClusterBackupList	DescribeClusterBackupList	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:InitializeKvstorePermission	InitializeKvstorePermission	create	All Resource ``	None	None
kvstore:ModifyInstanceAttribute	ModifyInstanceAttribute	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeHistoryMonitorValues	DescribeHistoryMonitorValues	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:ResourceTag kvstore:ResourceTag kvstore:ResourceTag kvstore:ResourceTag	None
kvstore:ModifyActiveOperationMaintainConfig	ModifyActiveOperationMaintainConfig	update	All Resource ``	None	None
kvstore:ModifyInstanceMaintainTime	ModifyInstanceMaintainTime	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeDbInstanceConnectivity	DescribeDbInstanceConnectivity	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:RenewAdditionalBandwidth	RenewAdditionalBandwidth	update	All Resource ``	None	None
kvstore:ModifyParameterGroup	ModifyParameterGroup	update	All Resource ``	None	None
kvstore:CreateCacheAnalysisTask	CreateCacheAnalysisTask	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyActiveOperationTasks	ModifyActiveOperationTasks	update	All Resource ``	None	None
kvstore:CreateAccount	CreateAccount	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:RebootProxy	RebootProxy	update	All Resource ``	None	None
kvstore:SwitchInstanceZoneFailOver	SwitchInstanceZoneFailOver	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribePrice	DescribePrice	get	All Resource ``	None	None
kvstore:DescribeHistoryTasks	DescribeHistoryTasks	get	All Resource ``	None	None
kvstore:ModifyInstanceConfig	ModifyInstanceConfig	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	kvstore:InstanceAofConfig kvstore:TLSVersion	None
kvstore:CreateBackup	CreateBackup	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:EnableAdditionalBandwidth	EnableAdditionalBandwidth	update	All Resource ``	None	None
kvstore:TransformInstanceChargeType	TransformInstanceChargeType	update	All Resource ``	None	None
kvstore:ListTagResources	ListTagResources	get	DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/`	None	None
kvstore:DescribeBackups	DescribeBackups	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeIntranetAttribute	DescribeIntranetAttribute	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:CreateParameterGroup	CreateParameterGroup	create	All Resource ``	None	None
kvstore:DescribeGlobalDistributeCache	DescribeGlobalDistributeCache	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeAuditRecords	DescribeAuditRecords	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DestroyInstance	DestroyInstance	delete	All Resource ``	None	None
kvstore:TransformToEcs	TransformToEcs	update	All Resource ``	None	None
kvstore:ReleaseDirectConnection	ReleaseDirectConnection	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeMonitorItems	DescribeMonitorItems	get	All Resource ``	None	None
kvstore:UpgradeProxy	UpgradeProxy	update	All Resource ``	None	None
kvstore:ModifyInstanceParameter	ModifyInstanceParameter	update	All Resource ``	None	None
kvstore:ModifyResourceGroup	ModifyResourceGroup	update	All Resource ``	None	None
kvstore:DescribeBackupPolicy	DescribeBackupPolicy	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeSlowLogRecords	DescribeSlowLogRecords	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:DescribeDBInstanceNetInfo	DescribeDBInstanceNetInfo	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeActiveOperationTaskCount	DescribeActiveOperationTaskCount	get	All Resource ``	None	None
kvstore:DeleteParameterGroup	DeleteParameterGroup	delete	All Resource ``	None	None
kvstore:UnlockDBInstanceWrite	UnlockDBInstanceWrite	update	All Resource ``	None	None
kvstore:ModifyEventInfo	ModifyEventInfo	update	All Resource ``	None	None
kvstore:CreateTairKVCacheVNode	CreateTairKVCacheVNode	create	All Resource ``	None	None
kvstore:DescribeInstanceAttribute	DescribeInstanceAttribute	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:FlushInstance	FlushInstance	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:RestoreInstance	RestoreInstance	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyInstanceSpec	ModifyInstanceSpec	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeEncryptionKey	DescribeEncryptionKey	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeCacheAnalysisReport	DescribeCacheAnalysisReport	get	*dbinstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:ModifyInstanceNetExpireTime	ModifyInstanceNetExpireTime	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DeleteInstance	DeleteInstance	delete	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeBackupTasks	DescribeBackupTasks	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:MasterNodeShutDownFailOver	MasterNodeShutDownFailOver	none	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeDBInstanceMonitor	DescribeDBInstanceMonitor	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyInstanceAutoRenewalAttribute	ModifyInstanceAutoRenewalAttribute	update	All Resource ``	None	None
kvstore:DescribeTairKVCacheInferInstances	DescribeTairKVCacheInferInstances	list	All Resource ``	None	None
kvstore:RenewInstance	RenewInstance	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:ModifyAuditLogConfig	ModifyAuditLogConfig	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#InstanceId}`	kvstore:DbAudit	None
kvstore:DescribeCacheAnalysisReportList	DescribeCacheAnalysisReportList	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:AllocateDirectConnection	AllocateDirectConnection	create	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeInstanceConfig	DescribeInstanceConfig	get	All Resource ``	None	None
kvstore:DescribeEngineVersion	DescribeEngineVersion	get	All Resource ``	None	None
kvstore:ModifyInstanceMinorVersion	ModifyInstanceMinorVersion	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:DescribeRunningLogRecords	DescribeRunningLogRecords	get	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
kvstore:RestartInstance	RestartInstance	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}`	None	None
kvstore:DescribeInstancesOverview	DescribeInstancesOverview	get	All Resource ``	None	None
kvstore:ModifyIntranetAttribute	ModifyIntranetAttribute	update	*DBInstance `acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None

Resource

The following table lists the resources defined by Tair (Redis OSS-compatible). Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
DBInstance	acs:kvstore:{#regionId}:{#accountId}:instance/{#instanceId} acs:kvstore:{#regionId}:{#accountId}:instance/* acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#DBInstanceId}
dbinstance	acs:kvstore:{#regionId}:{#accountId}:dbinstance/{#dbInstanceId}
TairInstance	acs:redis:{#regionId}:{#accountId}:tairinstance/{#TairInstanceId}

Condition

The following table lists the product-level condition keys defined by Tair (Redis OSS-compatible). You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
kvstore:EnableBackupLog	Enable data flashback feature, 1: Enable data flashback feature; 0: Disable data flashback feature	String
kvstore:DbAudit	Audit log enabled status	Boolean
kvstore:InstanceType	The instance type. When creating a Redis instance, the value is Redis or Memcache. When creating a Tair instance, the value is tair_rdb, tair_scm, or tair_essd.	String
kvstore:VpcAuthMode	In the authentication mode of a private network, Open: Passed password authentication; Close: Disable password authentication, that is, enable password-free access.	String
kvstore:InstanceAofConfig	Instance AOF parameter configuration	String
kvstore:Appendonly	For instance AOF configuration, yes to enable AOF persistence; no to disable AOF persistence	String
kvstore:TDEStatus	Enable Transparent Data Encryption (TDE) for the instance	String
kvstore:SSLEnabled	Whether to enable TLS (SSL) encryption	String
kvstore:ResourceTag	Redis tag information, it is used in combination with tag key, kvstore:ResourceTag/<tag-key>. Example: Assuming the tag is team:dev, the condition key and value are \\\"kvstore:ResourceTag/team\\\": \\\"dev\\\"	String
kvstore:InstanceClass	The instance type. Example: redis.master.small.default. Value Source: the value of the request parameter InstanceClass.	String
kvstore:TLSVersion	TLS protocol version used	String

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: