user permission control-Tablestore(Tablestore)-阿里云帮助中心

Access control methods

Tablestore supports the following access control methods: Resource Access Management (RAM) policies, Control Policies, Network ACLs, and Instance Policies. You can combine these methods as needed.

A RAM policy is a user-based authorization policy in RAM. It lets you centrally manage users, such as employees, systems, or applications, and control their access to resources.
A Control Policy is a resource-directory-based access control policy in Resource Management. It lets you manage permission boundaries at all levels of a resource directory, such as folders and members.
A Network ACL in Tablestore is a resource-based network access control feature. It lets you configure network access rules for a single instance.
An Instance Policy in Tablestore is a resource-based authorization policy. It lets you configure access permissions for a single instance.

Authorization details

The following table compares the scenarios and capabilities of each access control method.

Access control method	Scenarios	Owning service	Applicable to	Authorization details
RAM Policy	Permission management for multiple RAM users and Security Token Service (STS) access under a single Alibaba Cloud account.	Resource Access Management	When you first use Tablestore, grant permissions to RAM users or use temporary access credentials to access Tablestore using a RAM policy. For more information, see Grant permissions to RAM users using a RAM policy.	Grant the same permissions to different RAM users under the same account. Configure the same permissions for all Tablestore resources or for multiple instances. Restrict access to Tablestore resources based on conditions such as the client IP address, HTTPS protocol, access time, and Transport Layer Security (TLS) version. Access Tablestore resources using temporary access credentials.
Control Policy	Unified security policy control for different Alibaba Cloud accounts across departments in an enterprise organization. Control Policies can only deny access, not grant it.	Resource Management	When using an enterprise account, use a Control Policy from a resource directory to uniformly manage permissions for enterprise members. For more information, see Grant permissions using a Control Policy.	Restrict the TLS version used to access Tablestore. Restrict the creation of Tablestore instances to only those without public network access.
Network ACL	Unified network access control for a single instance within the Tablestore service under a single Alibaba Cloud account.	Tablestore	When using Tablestore resources, use a Network ACL to control the network access type or access source for an instance. For more information, see Configure a Network ACL for an instance.	Restrict whether resources in a Tablestore instance can be accessed from the console. Restrict the network types that can be used to access a Tablestore instance.
Instance Policy	Fine-grained API permission management for a single instance within the Tablestore service under a single Alibaba Cloud account.	Tablestore	When using Tablestore resources, use an Instance Policy to control the access source for an instance. For more information, see Configure an Instance Policy.	Restrict access to a Tablestore instance based on conditions such as the client IP address, the Virtual Private Cloud (VPC) to which the client belongs, and the TLS version used by the client.

How permissions take effect

When multiple access control methods apply to a RAM user simultaneously, the following conditions determine whether the user has permission for an operation. For more information, see Detailed authentication flow.

The Control Policy must not contain a rule that denies permission for the operation.
At least one rule in either the Instance Policy or the RAM policy must grant permission for the operation.

If an Instance Policy or a RAM policy contains conflicting permissions for the same operation, the deny rule takes precedence. This means the user does not have permission for the operation.