RAM authorization-Serverless App Engine(SAE)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Serverless App Engine for RAM permission policies. The RAM code (RamCode) for Serverless App Engine is sae , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Serverless App Engine. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
sae:StartApplication	StartApplication	update	All Resource ``	None	None
sae:UpdateApplicationDescription	UpdateApplicationDescription		All Resource ``	None	None
sae:StopWebApplication	StopWebApplication	update	All Resource ``	None	None
sae:ListApplicationsForSwimmingLane	ListApplicationsForSwimmingLane	list	All Resource ``	None	None
sae:CreateConfigMap	CreateConfigMap	create	All Resource ``	None	None
sae:UpdateNamespace	UpdateNamespace	update	All Resource ``	None	None
sae:ListSwimmingLaneGatewayRoutes	ListSwimmingLaneGatewayRoutes	list	All Resource ``	None	None
sae:UpdateWebApplicationTrafficConfig	UpdateWebApplicationTrafficConfig	update	All Resource ``	None	None
sae:CreateApplicationScalingRule	CreateApplicationScalingRule	create	All Resource ``	None	None
sae:UpdateWebCustomDomain	UpdateWebCustomDomain	update	*Namespace `acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId}`	None	None
sae:UpgradeApplicationApmService	UpgradeApplicationApmService		All Resource ``	None	None
sae:DescribeApplicationConfig	DescribeApplicationConfig	get	All Resource ``	None	None
sae:DescribeWebApplication	DescribeWebApplication	get	All Resource ``	None	None
sae:CreateOrUpdateSwimmingLaneGroup	CreateOrUpdateSwimmingLaneGroup	create	All Resource ``	None	None
sae:ListWebApplications	ListWebApplications	list	All Resource ``	None	None
sae:UnbindNlb	UnbindNlb	none	All Resource ``	None	None
sae:ListAppServices	ListAppServices	list	All Resource ``	None	None
sae:DescribeNamespaces	DescribeNamespaces	get	All Resource ``	None	None
sae:DescribeSwimmingLane	DescribeSwimmingLane	get	All Resource ``	None	None
sae:BindSlb	BindSlb	create	All Resource ``	None	None
sae:DescribeWebApplicationTrafficConfig	DescribeWebApplicationTrafficConfig	get	All Resource ``	None	None
sae:ListAppEvents	ListAppEvents	get	All Resource ``	None	None
sae:DisableArms	DisableArms	update	All Resource ``	None	None
sae:ResumeTraffic	ResumeTraffic	none	All Resource ``	None	None
sae:DeleteWebCustomDomain	DeleteWebCustomDomain	delete	*Namespace `acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId}`	None	None
sae:TagResources	TagResources		All Resource ``	None	None
sae:CreateSecret	CreateSecret		All Resource ``	None	None
sae:ListApplications	ListApplications	get	All Resource ``	None	None
sae:ListAllSwimmingLaneGroups	ListAllSwimmingLaneGroups	list	All Resource ``	None	None
sae:GetWebshellToken	GetWebshellToken	get	All Resource ``	None	None
sae:UpdateNamespaceVpc	UpdateNamespaceVpc	update	All Resource ``	None	None
sae:RescaleApplication	RescaleApplication	update	All Resource ``	None	None
sae:DescribeJobHistory	DescribeJobHistory		All Resource ``	None	None
sae:ListApplicationCenterServiceInstances	ListApplicationCenterServiceInstances	get	All Resource ``	None	None
sae:BindNlb	BindNlb	create	All Resource ``	None	None
sae:DisableApplicationScalingRule	DisableApplicationScalingRule	update	All Resource ``	None	None
sae:GetWarningEventMetric	GetWarningEventMetric	none	All Resource ``	None	None
sae:DowngradeApplicationApmService	DowngradeApplicationApmService		All Resource ``	None	None
sae:BatchRestartApplications	BatchRestartApplications	none	All Resource ``	None	None
sae:DescribeApplicationNlbs	DescribeApplicationNlbs	get	All Resource ``	None	None
sae:DeleteWebApplicationRevision	DeleteWebApplicationRevision	delete	All Resource ``	None	None
sae:DescribeApplicationStatus	DescribeApplicationStatus	get	All Resource ``	None	None
sae:AbortChangeOrder	AbortChangeOrder	update	All Resource ``	None	None
sae:EnableApplicationScalingRule	EnableApplicationScalingRule	update	All Resource ``	None	None
sae:DescribeApplicationScalingRules	DescribeApplicationScalingRules	get	All Resource ``	None	None
sae:DescribeApplicationGroups	DescribeApplicationGroups	get	All Resource ``	None	None
sae:RestartInstances	RestartInstances	none	All Resource ``	None	None
sae:SuspendJob	SuspendJob		All Resource ``	None	None
sae:ListIngresses	ListIngresses	get	All Resource ``	None	None
sae:GetAvailabilityMetric	GetAvailabilityMetric	none	All Resource ``	None	None
sae:DeleteSwimmingLaneGroup	DeleteSwimmingLaneGroup	delete	All Resource ``	None	None
sae:UntagResources	UntagResources		All Resource ``	None	None
sae:StopApplication	StopApplication	update	*Application `acs:sae:{#regionId}:{#accountId}:application/{#namespaceid}/{#appid}`	None	None
sae:DescribeApplicationSlbs	DescribeApplicationSlbs	get	All Resource ``	None	None
sae:ReduceApplicationCapacityByInstanceIds	ReduceApplicationCapacityByInstanceIds		All Resource ``	None	None
sae:DescribeSecret	DescribeSecret		All Resource ``	None	None
sae:ListChangeOrders	ListChangeOrders	get	All Resource ``	None	None
sae:RollbackApplication	RollbackApplication	update	All Resource ``	None	None
sae:DescribeApplicationImage	DescribeApplicationImage	get	All Resource ``	None	None
sae:ListNamespaceChangeOrders	ListNamespaceChangeOrders	get	All Resource ``	None	None
sae:DeployApplication	DeployApplication	update	All Resource ``	None	None
sae:UpdateJob	UpdateJob	update	All Resource ``	None	None
sae:CreateApplication	CreateApplication	create	All Resource ``	None	None
sae:RestartApplication	RestartApplication	none	All Resource ``	None	None
sae:DescribeJob	DescribeJob	get	All Resource ``	None	None
sae:UpdateAppMode	UpdateAppMode	update	All Resource ``	None	None
sae:CreateJob	CreateJob	create	All Resource ``	None	None
sae:UpdateApplicationVswitches	UpdateApplicationVswitches	update	All Resource ``	None	None
sae:ListSwimmingLaneGroupTags	ListSwimmingLaneGroupTags	list	All Resource ``	None	None
sae:SuspendTraffic	SuspendTraffic	none	All Resource ``	None	None
sae:UpdateNamespaceSlsConfigs	UpdateNamespaceSlsConfigs	update	All Resource ``	None	None
sae:ExecJob	ExecJob		All Resource ``	None	None
sae:ListLogConfigs	ListLogConfigs	get	All Resource ``	None	None
sae:DeleteGreyTagRoute	DeleteGreyTagRoute	delete	All Resource ``	None	None
sae:DescribeConfigMap	DescribeConfigMap	get	All Resource ``	None	None
sae:DescribeApplicationScalingRule	DescribeApplicationScalingRule	get	All Resource ``	None	None
sae:DescribeWebCustomDomain	DescribeWebCustomDomain	get	*Namespace `acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId}`	None	None
sae:DeleteApplication	DeleteApplication	delete	All Resource ``	None	None
sae:DescribeNamespaceResources	DescribeNamespaceResources	get	All Resource ``	None	None
sae:DescribeNamespace	DescribeNamespace	get	All Resource ``	None	None
sae:RescaleApplicationVertically	RescaleApplicationVertically	none	All Resource ``	None	None
sae:DescribePipeline	DescribePipeline	get	All Resource ``	None	None
sae:UnbindSlb	UnbindSlb		All Resource ``	None	None
sae:DeleteConfigMap	DeleteConfigMap	delete	All Resource ``	None	None
sae:UpdateWebApplication	UpdateWebApplication	update	All Resource ``	None	None
sae:ListAllSwimmingLanes	ListAllSwimmingLanes	list	All Resource ``	None	None
sae:GetChangeOrderMetric	GetChangeOrderMetric	none	All Resource ``	None	None
sae:UpdateAppSecurityGroup	UpdateAppSecurityGroup	update	All Resource ``	None	None
sae:DescribeIngress	DescribeIngress	get	All Resource ``	None	None
sae:UpdateSwimmingLaneEnableAttribute	UpdateSwimmingLaneEnableAttribute	update	All Resource ``	None	None
sae:ListTagResources	ListTagResources	get	All Resource ``	None	None
sae:UpdateSecret	UpdateSecret		All Resource ``	None	None
sae:DescribeInstanceLog	DescribeInstanceLog	get	All Resource ``	None	None
sae:DescribeWebApplicationResourceStatics	DescribeWebApplicationResourceStatics	get	All Resource ``	None	None
sae:DeleteHistoryJob	DeleteHistoryJob		All Resource ``	None	None
sae:QueryArmsEnable	QueryArmsEnable		*Application `acs:sae:{#regionId}:{#accountId}:application/{#namespaceid}/{#appid}`	None	None
sae:OpenSaeService	OpenSaeService	none	All Resource ``	None	None
sae:DescribeNamespaceList	DescribeNamespaceList	get	All Resource ``	None	None
sae:DeleteSecret	DeleteSecret		All Resource ``	None	None
sae:DescribeGreyTagRoute	DescribeGreyTagRoute	get	All Resource ``	None	None
sae:DescribeInstanceSpecifications	DescribeInstanceSpecifications	get	All Resource ``	None	None
sae:UpdateWebApplicationScalingConfig	UpdateWebApplicationScalingConfig	update	All Resource ``	None	None
sae:DescribeWebApplicationRevision	DescribeWebApplicationRevision	get	All Resource ``	None	None
sae:CreateGreyTagRoute	CreateGreyTagRoute	create	All Resource ``	None	None
sae:DescribeApplicationInstances	DescribeApplicationInstances	get	All Resource ``	None	None
sae:CreateOrUpdateSwimmingLane	CreateOrUpdateSwimmingLane	create	All Resource ``	None	None
sae:BatchStartApplications	BatchStartApplications	none	All Resource ``	None	None
sae:DescribeChangeOrder	DescribeChangeOrder	get	All Resource ``	None	None
sae:ListGreyTagRoute	ListGreyTagRoute	get	All Resource ``	None	None
sae:QueryResourceStatics	QueryResourceStatics	get	All Resource ``	None	None
sae:DeleteNamespace	DeleteNamespace	delete	All Resource ``	None	None
sae:DescribeWebApplicationScalingConfig	DescribeWebApplicationScalingConfig	get	All Resource ``	None	None
sae:AbortAndRollbackChangeOrder	AbortAndRollbackChangeOrder		All Resource ``	None	None
sae:CreateNamespace	CreateNamespace	create	All Resource ``	None	None
sae:DescribeAppServiceDetail	DescribeAppServiceDetail	list	All Resource ``	None	None
sae:GetArmsTopNMetric	GetArmsTopNMetric	none	All Resource ``	None	None
sae:DeleteInstances	DeleteInstances		All Resource ``	None	None
sae:DescribeJobStatus	DescribeJobStatus		All Resource ``	None	None
sae:UpdateIngress	UpdateIngress	update	All Resource ``	None	None
sae:DeleteJob	DeleteJob		All Resource ``	None	None
sae:GetApplication	GetApplication	get	All Resource ``	None	None
sae:UpdateApplicationScalingRule	UpdateApplicationScalingRule	update	*Application `acs:sae:{#regionId}:{#accountId}:application/{#namespaceid}/{#appid}`	None	None
sae:ListPublishedServices	ListPublishedServices	get	All Resource ``	None	None
sae:CreateWebCustomDomain	CreateWebCustomDomain	create	*Namespace `acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId}`	None	None
sae:DeleteIngress	DeleteIngress	delete	All Resource ``	None	None
sae:ListSecrets	ListSecrets		All Resource ``	None	None
sae:ListJobs	ListJobs	list	All Resource ``	None	None
sae:StartWebApplication	StartWebApplication	update	All Resource ``	None	None
sae:ListNamespacedConfigMaps	ListNamespacedConfigMaps	get	All Resource ``	None	None
sae:CreateIngress	CreateIngress	create	All Resource ``	None	None
sae:DescribeWebInstanceLogs	DescribeWebInstanceLogs	get	All Resource ``	None	None
sae:ConfirmPipelineBatch	ConfirmPipelineBatch	none	All Resource ``	None	None
sae:UpdateConfigMap	UpdateConfigMap	update	All Resource ``	None	None
sae:ListWebApplicationRevisions	ListWebApplicationRevisions	list	All Resource ``	None	None
sae:UpdateGreyTagRoute	UpdateGreyTagRoute	update	All Resource ``	None	None
sae:ListWebCustomDomains	ListWebCustomDomains	list	*Namespace `acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId}`	None	None
sae:DescribeApplicationMseService	DescribeApplicationMseService		All Resource ``	None	None
sae:CreateWebApplication	CreateWebApplication	create	All Resource ``	None	None
sae:GetScaleAppMetric	GetScaleAppMetric	none	All Resource ``	None	None
sae:DescribeConfigurationPrice	DescribeConfigurationPrice	none	All Resource ``	None	None
sae:BatchStopApplications	BatchStopApplications	none	All Resource ``	None	None
sae:DescribeEdasContainers	DescribeEdasContainers	get	All Resource ``	None	None
sae:DeleteWebApplication	DeleteWebApplication	delete	All Resource ``	None	None
sae:DeleteApplicationScalingRule	DeleteApplicationScalingRule	delete	All Resource ``	None	None
sae:ListAppServicesPage	ListAppServicesPage		All Resource ``	None	None
sae:ListAppVersions	ListAppVersions	get	All Resource ``	None	None
sae:PublishWebApplicationRevision	PublishWebApplicationRevision	create	All Resource ``	None	None
sae:ListConsumedServices	ListConsumedServices	get	All Resource ``	None	None
sae:ListWebApplicationInstances	ListWebApplicationInstances	list	All Resource ``	None	None

Resource

The following table lists the resources defined by Serverless App Engine. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Application	acs:sae:{#regionId}:{#accountId}:application/{#ApplicationId} acs:sae:{#regionId}:{#accountId}:application/{#namespaceid}/{#appid}
Namespace	acs:sae:{#regionId}:{#accountId}:namespace/{#NamespaceId} acs:sae:{#regionId}:{#accountId}:*

Condition

Serverless App Engine does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: