RAM authorization-Service Catalog(ServiceCatalog)-阿里云帮助中心

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Cloud Governance Center for RAM permission policies. The RAM code (RamCode) for Cloud Governance Center is servicecatalog , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Cloud Governance Center. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
servicecatalog:UpdateProvisionedProductPlan	UpdateProvisionedProductPlan	update	All Resource ``	servicecatalog:UserLevel	None
servicecatalog:UpdateConstraint	UpdateConstraint	update	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}` Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:GetAccountInfo	GetAccountInfo	get	All Resource ``	None	None
servicecatalog:GetProductAsEndUser	GetProductAsEndUser	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:GetProvisionedProductPlan	GetProvisionedProductPlan	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:ImportTagOptions	ImportTagOptions		All Resource ``	None	None
servicecatalog:BatchAssociateProductWithPortfolio	BatchAssociateProductWithPortfolio	create	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#portfolioId}` Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#productId}`	None	None
servicecatalog:UpdateTagOption	UpdateTagOption		All Resource ``	None	None
servicecatalog:CreateProvisionedProductPlan	CreateProvisionedProductPlan	create	All Resource ``	servicecatalog:UserLevel	None
servicecatalog:DeleteProductVersion	DeleteProductVersion	delete	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:UpdateProvisionedProduct	UpdateProvisionedProduct		*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel	None
servicecatalog:ListProductsAsAdmin	ListProductsAsAdmin	get	Product `acs:servicecatalog:{#regionId}:{#accountId}:product/`	None	None
servicecatalog:TerminateProvisionedProduct	TerminateProvisionedProduct	delete	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel	None
servicecatalog:CancelProvisionedProductPlan	CancelProvisionedProductPlan	delete	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel	None
servicecatalog:InitializeServiceCatalog	InitializeServiceCatalog		All Resource ``	None	ram:CreateServiceLinkedRole
servicecatalog:CreateProduct	CreateProduct	create	Product `acs:servicecatalog:{#regionId}:{#accountId}:product/`	None	None
servicecatalog:GetTagOption	GetTagOption	get	All Resource ``	None	None
servicecatalog:DeleteProvisionedProductPlan	DeleteProvisionedProductPlan	delete	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel	None
servicecatalog:GetConstraint	GetConstraint	get	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:ListConstraints	ListConstraints	list	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:CreatePortfolio	CreatePortfolio	create	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/`	None	None
servicecatalog:LaunchProduct	LaunchProduct		ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/`	None	None
servicecatalog:GetProvisionedProductParameters	GetProvisionedProductParameters	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:UpdatePortfolio	UpdatePortfolio	update	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:GetEnhancedTemplate	GetEnhancedTemplate	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#productId}`	None	None
servicecatalog:CreateConstraint	CreateConstraint	create	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}` Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	ram:PassRole
servicecatalog:ListProductsAsEndUser	ListProductsAsEndUser	get	All Resource ``	None	None
servicecatalog:ListProductVersions	ListProductVersions	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:AssociateTagOptionWithResource	AssociateTagOptionWithResource	get	All Resource ``	None	None
servicecatalog:GetGeneratedTemplate	GetGeneratedTemplate	get	All Resource ``	None	None
servicecatalog:GetTemplate	GetTemplate	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:GetPrincipalPortfolioAssociationForResourceSpec	GetPrincipalPortfolioAssociationForResourceSpec	get	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:DisassociateProductFromPortfolio	DisassociateProductFromPortfolio	delete	Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}` Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:DisAssociateTagOptionFromResource	DisAssociateTagOptionFromResource	get	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#portfolioId}` Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#productId}`	None	None
servicecatalog:DeletePortfolio	DeletePortfolio	delete	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:DeleteTagOption	DeleteTagOption		All Resource ``	None	None
servicecatalog:GetTemplateDefinition	GetTemplateDefinition	get	All Resource ``	None	None
servicecatalog:ListPortfolios	ListPortfolios	get	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/`	None	None
servicecatalog:ListPrincipals	ListPrincipals	get	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:CopyProduct	CopyProduct	create	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#productId}`	None	None
servicecatalog:GetProvisionedProductForResourceSpec	GetProvisionedProductForResourceSpec	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:CreateTemplate	CreateTemplate	create	All Resource ``	None	None
servicecatalog:GetProductPortfolioAssociationForResourceSpec	GetProductPortfolioAssociationForResourceSpec	get	Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}` Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:ListLaunchOptions	ListLaunchOptions	list	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:DeleteProduct	DeleteProduct	delete	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:BatchDisassociateProductFromPortfolio	BatchDisassociateProductFromPortfolio	delete	Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#portfolioId}` Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:GetTask	GetTask	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:ExecuteProvisionedProductPlan	ExecuteProvisionedProductPlan		All Resource ``	servicecatalog:UserLevel	None
servicecatalog:ListTasks	ListTasks	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:DeleteConstraint	DeleteConstraint	delete	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:GetProvisionedProduct	GetProvisionedProduct	get	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:ListResourcesForTagOption	ListResourcesForTagOption	get	All Resource ``	None	None
servicecatalog:CreateTagOption	CreateTagOption		All Resource ``	None	None
servicecatalog:ListUserTypes	ListUserTypes	list	All Resource ``	None	None
servicecatalog:AssociatePrincipalWithPortfolio	AssociatePrincipalWithPortfolio	create	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:ListProvisionedProductPlans	ListProvisionedProductPlans	list	All Resource ``	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:ListProvisionedProducts	ListProvisionedProducts	get	ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/`	servicecatalog:UserLevel	None
servicecatalog:ListProvisionedProductPlanApprovers	ListProvisionedProductPlanApprovers	get	All Resource ``	servicecatalog:UserLevel servicecatalog:ApprovalActor	None
servicecatalog:CreateProductVersion	CreateProductVersion	create	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:UpdateProduct	UpdateProduct	update	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:DisassociatePrincipalFromPortfolio	DisassociatePrincipalFromPortfolio	delete	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:AssociateProductWithPortfolio	AssociateProductWithPortfolio	create	Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}` Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None
servicecatalog:GetProvisioningParameters	GetProvisioningParameters	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:ApproveProvisionedProductPlan	ApproveProvisionedProductPlan	update	*ProvisionedProduct `acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId}`	servicecatalog:ApprovalActor	None
servicecatalog:GetProductAsAdmin	GetProductAsAdmin	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:UpdateProductVersion	UpdateProductVersion	update	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:ListTagOptions	ListTagOptions	get	All Resource ``	None	None
servicecatalog:GetProductVersion	GetProductVersion	get	*Product `acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId}`	None	None
servicecatalog:GetPortfolio	GetPortfolio	get	*Portfolio `acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId}`	None	None

Resource

The following table lists the resources defined by Cloud Governance Center. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
ProvisionedProduct	acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/{#ProvisionedProductId} acs:servicecatalog:{#regionId}:{#accountId}:provisionedproduct/*
Product	acs:servicecatalog:{#regionId}:{#accountId}:product/{#ProductId} acs:servicecatalog:{#regionId}:{#accountId}:product/*
Portfolio	acs:servicecatalog:{#regionId}:{#accountId}:portfolio/{#PortfolioId} acs:servicecatalog:{#regionId}:{#accountId}:portfolio/*

Condition

The following table lists the product-level condition keys defined by Cloud Governance Center. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
servicecatalog:UserLevel	Authorize access only to the current user's own resources	String
servicecatalog:ApprovalActor	Authorize access only to resources that require the current user's own approval	String

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: