RAM authorization-Secure Access Service Edge(SASE)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Secure Access Service Edge for RAM permission policies. The RAM code (RamCode) for Secure Access Service Edge is csas , and the supported authorization granularity is OPERATION .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Secure Access Service Edge. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
csas:GetUserGroup	GetUserGroup	get	All Resource ``	None	None
csas:ListPolicesForPrivateAccessApplication	ListPolicesForPrivateAccessApplication	get	All Resource ``	None	None
csas:CreatePrivateAccessTag	CreatePrivateAccessTag	create	All Resource ``	None	None
csas:ListPrivateAccessTagsForDynamicRoute	ListPrivateAccessTagsForDynamicRoute	list	All Resource ``	None	None
csas:DeletePrivateAccessApplication	DeletePrivateAccessApplication	delete	All Resource ``	None	None
csas:ListPrivateAccessApplicationsForDynamicRoute	ListPrivateAccessApplicationsForDynamicRoute	get	All Resource ``	None	None
csas:GetApprovalProcess	GetApprovalProcess	get	All Resource ``	None	None
csas:DeleteApprovalProcesses	DeleteApprovalProcesses	delete	All Resource ``	None	None
csas:GetActiveIdpConfig	GetActiveIdpConfig	get	All Resource ``	None	None
csas:ListUserGroupsForRegistrationPolicy	ListUserGroupsForRegistrationPolicy	get	All Resource ``	None	None
csas:GetPrivateAccessApplication	GetPrivateAccessApplication	get	All Resource ``	None	None
csas:GetClientUser	GetClientUser	get	All Resource ``	None	None
csas:ExportUserDevices	ExportUserDevices	list	All Resource ``	None	None
csas:ListSoftwareForUserDevice	ListSoftwareForUserDevice	list	All Resource ``	None	None
csas:LookupWmInfoMapping	LookupWmInfoMapping	get	All Resource ``	None	None
csas:ListApprovalSchemas	ListApprovalSchemas	list	All Resource ``	None	None
csas:ListExcessiveDeviceRegistrationApplications	ListExcessiveDeviceRegistrationApplications	list	All Resource ``	None	None
csas:ListDynamicRouteRegions	ListDynamicRouteRegions	get	All Resource ``	None	None
csas:UpdateClientUserPassword	UpdateClientUserPassword	update	All Resource ``	None	None
csas:GetPrivateAccessPolicy	GetPrivateAccessPolicy	get	All Resource ``	None	None
csas:ListClientUsers	ListClientUsers	get	All Resource ``	None	None
csas:UpdateDynamicRoute	UpdateDynamicRoute	update	All Resource ``	None	None
csas:ListRegistrationPoliciesForUserGroup	ListRegistrationPoliciesForUserGroup	list	All Resource ``	None	None
csas:ListRegistrationPolicies	ListRegistrationPolicies	list	All Resource ``	None	None
csas:GetApprovalSchema	GetApprovalSchema	get	All Resource ``	None	None
csas:GetWmExtractTask	GetWmExtractTask	get	All Resource ``	None	None
csas:CreateUserGroup	CreateUserGroup	create	All Resource ``	None	None
csas:ListEnterpriseAccelerateTargets	ListEnterpriseAccelerateTargets	get	All Resource ``	None	None
csas:ListEnterpriseAcceleratePolicies	ListEnterpriseAcceleratePolicies	get	All Resource ``	None	None
csas:GetRegistrationPolicy	GetRegistrationPolicy	get	All Resource ``	None	None
csas:AttachPolicy2ApprovalProcess	AttachPolicy2ApprovalProcess	create	All Resource ``	None	None
csas:ListApprovalProcessesForApprovalSchemas	ListApprovalProcessesForApprovalSchemas	list	All Resource ``	None	None
csas:UpdateUninstallApplicationsStatus	UpdateUninstallApplicationsStatus	update	All Resource ``	None	None
csas:CreateIdpDepartment	CreateIdpDepartment	create	All Resource ``	None	None
csas:DeleteDynamicRoute	DeleteDynamicRoute	delete	All Resource ``	None	None
csas:ListUserDevices	ListUserDevices	list	All Resource ``	None	None
csas:DetachPolicy2ApprovalProcess	DetachPolicy2ApprovalProcess	delete	All Resource ``	None	None
csas:UpdateExcessiveDeviceRegistrationApplicationsStatus	UpdateExcessiveDeviceRegistrationApplicationsStatus	update	All Resource ``	None	None
csas:UpdateNacUserCertStatus	UpdateNacUserCertStatus	none	All Resource ``	None	None
csas:DeleteIdpDepartment	DeleteIdpDepartment	delete	All Resource ``	None	None
csas:GetUserDevice	GetUserDevice	get	All Resource ``	None	None
csas:ListIdpDepartments	ListIdpDepartments	get	All Resource ``	None	None
csas:ListPolicesForUserGroup	ListPolicesForUserGroup	get	All Resource ``	None	None
csas:DisableEnterpriseAcceleratePolicy	DisableEnterpriseAcceleratePolicy	update	All Resource ``	None	None
csas:CreateWmExtractTask	CreateWmExtractTask	create	All Resource ``	None	None
csas:CreateWmEmbedTask	CreateWmEmbedTask	create	All Resource ``	None	None
csas:AttachApplication2Connector	AttachApplication2Connector	update	All Resource ``	None	None
csas:DeletePrivateAccessTag	DeletePrivateAccessTag	delete	All Resource ``	None	None
csas:ImportEnterpriseAccelerateTargets	ImportEnterpriseAccelerateTargets	create	All Resource ``	None	None
csas:ListUserApplications	ListUserApplications	list	All Resource ``	None	None
csas:ModifyEnterpriseAcceleratePolicy	ModifyEnterpriseAcceleratePolicy	update	All Resource ``	None	None
csas:ListApprovalSchemasForApprovalProcesses	ListApprovalSchemasForApprovalProcesses	list	All Resource ``	None	None
csas:ListApprovalProcesses	ListApprovalProcesses	list	All Resource ``	None	None
csas:ListUserPrivateAccessPolicies	ListUserPrivateAccessPolicies	list	All Resource ``	None	None
csas:ListEnterpriseAccelerateLogs	ListEnterpriseAccelerateLogs	get	All Resource ``	None	None
csas:ListNacUserCert	ListNacUserCert	none	All Resource ``	None	None
csas:CreateEnterpriseAcceleratePolicy	CreateEnterpriseAcceleratePolicy	create	All Resource ``	None	None
csas:CreateEnterpriseAccelerateTarget	CreateEnterpriseAccelerateTarget	create	All Resource ``	None	None
csas:DeleteUserGroup	DeleteUserGroup	delete	All Resource ``	None	None
csas:ListPopTrafficStatistics	ListPopTrafficStatistics	get	All Resource ``	None	None
csas:CreateApprovalProcess	CreateApprovalProcess	create	All Resource ``	None	None
csas:GetDynamicRoute	GetDynamicRoute	get	All Resource ``	None	None
csas:UpdateIdpDepartment	UpdateIdpDepartment	update	All Resource ``	None	None
csas:RevokeUserDeviceSession	RevokeUserDeviceSession	update	All Resource ``	None	None
csas:ListApplicationsForPrivateAccessTag	ListApplicationsForPrivateAccessTag	get	All Resource ``	None	None
csas:CreateRegistrationPolicy	CreateRegistrationPolicy	create	All Resource ``	None	None
csas:ListForwardStrategies	ListForwardStrategies	list	All Resource ``	None	None
csas:CreateWmBaseImage	CreateWmBaseImage	create	All Resource ``	None	None
csas:UpdatePrivateAccessApplication	UpdatePrivateAccessApplication	update	All Resource ``	None	None
csas:DeleteOtpConfig	DeleteOtpConfig	delete	All Resource ``	None	None
csas:RevokeUserSession	RevokeUserSession	none	All Resource ``	None	None
csas:CreateWmInfoMapping	CreateWmInfoMapping	create	All Resource ``	None	None
csas:UpdateClientUserStatus	UpdateClientUserStatus	update	All Resource ``	None	None
csas:DeleteClientUser	DeleteClientUser	delete	All Resource ``	None	None
csas:CreatePrivateAccessPolicy	CreatePrivateAccessPolicy	create	All Resource ``	None	None
csas:DeletePrivateAccessPolicy	DeletePrivateAccessPolicy	delete	All Resource ``	None	None
csas:ListApprovals	ListApprovals	list	All Resource ``	None	None
csas:ListUninstallApplications	ListUninstallApplications	list	All Resource ``	None	None
csas:GetBootAndAntiUninstallPolicy	GetBootAndAntiUninstallPolicy	get	All Resource ``	None	None
csas:ListPolicesForPrivateAccessTag	ListPolicesForPrivateAccessTag	get	All Resource ``	None	None
csas:ListDynamicRoutes	ListDynamicRoutes	get	All Resource ``	None	None
csas:UpdateUserDevicesStatus	UpdateUserDevicesStatus	update	All Resource ``	None	None
csas:UpdateUserDevicesSharingStatus	UpdateUserDevicesSharingStatus	update	All Resource ``	None	None
csas:ListDynamicDisposalProcesses	ListDynamicDisposalProcesses	list	All Resource ``	None	None
csas:CreatePADiagnosisTask	CreatePADiagnosisTask	create	All Resource ``	None	None
csas:UpdateUserGroup	UpdateUserGroup	update	All Resource ``	None	None
csas:GetApproval	GetApproval	get	All Resource ``	None	None
csas:GetPADiagnosisTask	GetPADiagnosisTask	get	All Resource ``	None	None
csas:CreatePrivateAccessApplication	CreatePrivateAccessApplication	create	All Resource ``	None	None
csas:UpdateBootAndAntiUninstallPolicy	UpdateBootAndAntiUninstallPolicy	update	All Resource ``	None	None
csas:DeleteEnterpriseAcceleratePolicy	DeleteEnterpriseAcceleratePolicy	delete	All Resource ``	None	None
csas:CreateDynamicRoute	CreateDynamicRoute	create	All Resource ``	None	None
csas:GetWmEmbedTask	GetWmEmbedTask	get	All Resource ``	None	None
csas:UpdateRegistrationPolicy	UpdateRegistrationPolicy	update	All Resource ``	None	None
csas:UpdatePrivateAccessPolicy	UpdatePrivateAccessPolicy	update	All Resource ``	None	None
csas:ListConnectors	ListConnectors	get	All Resource ``	None	None
csas:UpdateUsersStatus	UpdateUsersStatus	update	All Resource ``	None	None
csas:ListUsers	ListUsers	list	All Resource ``	None	None
csas:ListUserGroups	ListUserGroups	get	All Resource ``	None	None
csas:UpdateClientUser	UpdateClientUser	update	All Resource ``	None	None
csas:CreateClientUser	CreateClientUser	create	All Resource ``	None	None
csas:DetachApplication2Connector	DetachApplication2Connector	update	All Resource ``	None	None
csas:ListIdpConfigs	ListIdpConfigs	get	All Resource ``	None	None
csas:ListPrivateAccessTags	ListPrivateAccessTags	get	All Resource ``	None	None
csas:ListApplicationsForPrivateAccessPolicy	ListApplicationsForPrivateAccessPolicy	get	All Resource ``	None	None
csas:UpdateApprovalStatus	UpdateApprovalStatus	update	All Resource ``	None	None
csas:ListForwardStrategyBindingItems	ListForwardStrategyBindingItems	list	All Resource ``	None	None
csas:DeleteEnterpriseAccelerateTarget	DeleteEnterpriseAccelerateTarget	delete	All Resource ``	None	None
csas:ListTagsForPrivateAccessApplication	ListTagsForPrivateAccessApplication	get	All Resource ``	None	None
csas:ListPrivateAccessApplications	ListPrivateAccessApplications	get	All Resource ``	None	None
csas:ListUserGroupsForPrivateAccessPolicy	ListUserGroupsForPrivateAccessPolicy	list	All Resource ``	None	None
csas:GetIdpConfig	GetIdpConfig	get	All Resource ``	None	None
csas:DeleteUserDevices	DeleteUserDevices	delete	All Resource ``	None	None
csas:DeleteRegistrationPolicies	DeleteRegistrationPolicies	delete	All Resource ``	None	None
csas:UpdateApprovalProcess	UpdateApprovalProcess	update	All Resource ``	None	None
csas:ListTagsForPrivateAccessPolicy	ListTagsForPrivateAccessPolicy	get	All Resource ``	None	None
csas:EnableEnterpriseAcceleratePolicy	EnableEnterpriseAcceleratePolicy	update	All Resource ``	None	None
csas:ListPrivateAccessPolices	ListPrivateAccessPolices	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Secure Access Service Edge. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type

ARN

Condition

Secure Access Service Edge does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: