Grant resource group-level permissions to a RAM identity-Resource Management(ResourceManagement)-阿里云帮助中心

Designate an administrator for each resource group to grant permissions within the group to other users.

Prerequisites

You have an Alibaba Cloud account or a RAM identity (RAM user or RAM role) that has the permissions to manage resource group authorization.

Background information

How resource group authorization relates to Resource Access Management (RAM):

RAM provides the permission management service for resource group authorization.
Resource group authorization uses all RAM policies, including system policies and custom policies.
Resource group authorization grants permissions to RAM users, RAM user groups, or RAM roles.
When the resource scope is account-level, permissions take effect within the current Alibaba Cloud account. When the resource scope is resource, permissions take effect only within the corresponding resource group.

Procedure

You can grant permissions in the Resource Management console or the RAM console. This topic uses the Resource Management console as an example.

Log on to the Resource Management console. The Resource Group page appears.
On the Resource Group page, click Permissions in the Actions column for the resource group you want.
On the Permissions tab, click Grant Permission.
In the Grant Permission panel, set the Principal and Policy, and then click OK.
- Resource Scope: Defaults to the current resource group. The permissions apply only within this resource group.
- Principal: Select the RAM user, RAM role, or RAM user group to authorize.
  
  Note
  Resource group-level authorization does not take effect for a RAM role whose trusted entity is an Alibaba Cloud service (a service role). API calls made by assuming such a role through STS return Forbidden.RAM. RAM users, RAM user groups, and RAM roles whose trusted entity is an Alibaba Cloud account are not affected. To grant equivalent permissions to a service role, see Alternative for service roles below.
- Policy Name: Select the system policy or custom policy to apply.

Result

The principal now has the specified permissions on the resources in the resource group.

Alternative for service roles

A RAM role whose trusted entity is an Alibaba Cloud service (a service role) cannot obtain permissions through resource group-level authorization. Instead, attach a custom policy that contains a Condition element to the RAM role and grant account-level permissions in place of resource group-level permissions. Use condition keys to narrow the scope and achieve equivalent resource isolation:

Use ecs:RequestTag to require a specific tag in the request so that only resources with that tag can be operated on.
Use VPC-related condition keys to limit the policy to a specific VPC.
Use instance type-related condition keys to limit which instance types can be created.

After this configuration, API calls made by assuming the RAM role through STS pass authorization. Operations that are not covered by the policy still return Forbidden.RAM.

References

To grant permissions in the RAM console, see Manage RAM user permissions, Grant permissions to a RAM user group, and Manage permissions for a RAM role.