Fine-grained access control with tags

Use case example

The following scenario demonstrates tag-based access control.

Step 1: Create and grant a custom policy

Create a custom policy in the RAM console or call the CreatePolicy API operation. Policy details are in the Policy configuration section.

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click the JSON tab.

5. Configure the policy.

   A policy consists of a version number and statements. Each statement includes an Effect, Action, Resource, and optional Condition, as described in Policy elements and Policy structure and syntax.

   1. After you modify the policy document as needed, click OK.

      In the Condition block, add tag-based conditions to restrict permissions. The following table describes the supported condition keys.

      Condition key	Description
      acs:RequestTag	Requires the request to include a specific tag. If an API operation does not support tags in requests, you cannot use this condition key. Otherwise, authentication will fail.
      acs:ResourceTag	Requires the accessed resource to have a specific tag. If an API operation does not require a resource ID in the request, you cannot use this condition key. Otherwise, authentication will fail.

      Note

      Choose acs:RequestTag or acs:ResourceTag based on the API operation — whether it requires a resource ID or supports tags in the request. Tag-based authentication for API operations.

      {
          "Statement": [
              {
                  "Action": "smc:CreateReplicationJob",
                  "Condition": {
                      "StringEquals": {
                          "acs:RequestTag/smc": "test"
                      }
                  },
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "smc:*",
                  "Condition": {
                      "StringEquals": {
                          "acs:ResourceTag/smc": "test"
                      }
                  },
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                "Action": [
                      "*:TagResources",
                      "*:UntagResources"  
                   ],
                  "Effect": "Deny",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "*:List*",
                      "*:Describe*"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ],
          "Version": "1"
      }

      The preceding policy implements the following permission controls.

      Scenario	Policy
      Scenario 1: Allows a migration job to be created only if the smc:test tag is added during creation.	{ "Statement": [ { "Action": "smc:CreateReplicationJob", "Condition": { "StringEquals": { "acs:RequestTag/smc": "test" } }, "Effect": "Allow", "Resource": "*" }, { "Action": [ "*:List*", "*:Describe*" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }
      Scenario 2: Allows operations (such as modifying properties and deleting resources) only on SMC resources that have the smc:test tag. Operations on other SMC resources are denied.	{ "Statement": [ { "Action": "smc:*", "Condition": { "StringEquals": { "acs:ResourceTag/smc": "test" } }, "Effect": "Allow", "Resource": "*" }, { "Action": [ "*:TagResources", "*:UntagResources" ], "Effect": "Deny", "Resource": "*" }, { "Action": [ "*:List*", "*:Describe*" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }

   2. In the Create Policy dialog box, enter a name and description for the policy, and then click OK.

6. Attach the custom policy to the RAM user.

   1. In the left-side navigation pane, choose Identities > Users.

   2. Attach the newly created custom policy to the RAM user.

      Manage RAM user permissions.

Step 2: Verify the policy

1. Log on to the SMC console or OpenAPI Explorer as a RAM user.

   This example uses the SMC console for verification.

2. Verify that the policy works correctly.

   Test the following permissions:

   • Create a migration job:

     • For a migration source with the smc:test tag, you can create a migration job.

     • For a migration source without the smc:test tag or with other tags, you cannot create a migration job. The error message You are not authorized to perform this operation. Contact your Alibaba Cloud account to grant the required permissions and then try again. appears. Click Go to RAM for Authorization to grant permissions.

   • Delete a migration source:

     • You can delete a migration source that has the smc:test tag.

     • If you try to delete a migration source without the smc:test tag, the operation fails. An Error dialog box appears with the message "You are not authorized to perform this operation. Contact your Alibaba Cloud account to grant the required permissions and then try again." Click OK to close the dialog box.

Tag-based authentication for API operations