Authentication process
If a Resource Access Management (RAM) identity initiates a resource access request to Tablestore, policy evaluation is performed to determine whether the request passes authentication. A request is allowed only when the request passes authentication. The RAM identity is a RAM user or RAM role. The request can be initiated by using the Alibaba Cloud Management Console, an API operation, or a CLI. This topic describes the policy evaluation process of Tablestore.
Authentication
When Tablestore receives a request, Tablestore determines whether to allow or deny the request based on authentication. The authentication is performed based on control policies, identity verification, role-based session policies, RAM policies, instance policies, and network access control lists (ACLs).
The following items describe the possible results of policy evaluation:
Allow: allows the request if the request hits an Allow statement instead of a Deny statement in the policy.
Explicit Deny: explicitly denies the request if the request hits a Deny statement in the policy.
Implicit Deny: implicitly denies the request if the request does not hit an Allow or Deny statement or no policy exists.
If the request simultaneously hits both an Allow statement and a Deny statement in the policy, then the Deny statement takes precedence. In this case, the result of policy evaluation is Explicit Deny.
By default, all requests initiated by a RAM identity are implicitly denied.
Authentication process
Tablestore performs the following steps for authentication:
Check whether the account that owns the requested resource is a member account in a resource directory for which a control policy is enabled.
If the account that owns the requested resource is not a member account of a resource directory, or if the account is a member account of a resource directory for which no control policy is enabled, proceed to the next step.
If the account that owns the requested resource is a member account in a resource directory for which a control policy is enabled, perform control policy evaluation.
If the result of the control policy evaluation is Explicit Deny or Implicit Deny, Tablestore denies the request.
If the result of the control policy evaluation is Allow, proceed to the next step.
Check whether identity verification is passed.
Tablestore compares the signature included in the request with the signature calculated by the server.
If the signatures are different, Tablestore denies the request.
If the signatures are the same, proceed to the next step.
Check whether the request remains to be checked based on role-based session policies.
If the request remains to be checked based on role-based session policies, Tablestore performs session policy evaluation.
If the result of the session policy evaluation is Explicit Deny or Implicit Deny, Tablestore denies the request.
If the result of the session policy evaluation is Allow, proceed to the next step.
If the request does not need to be checked based on role-based session policies, proceed to the next step.
Check the operation category of the request.
Tablestore management API operations, such as CreateInstance, are called to perform operations on instances. Tablestore data API operations, such as CreateTable, are called to perform basic data operations and operations on data tables and time series tables. For more information, see Management API operation overview and Data API operation overview.
If the operation category of the request is management API operation, perform RAM policy evaluation.
If the operation category of the request is data API operation, check the network ACLs.
Tablestore checks the network ACLs based on whether the user who initiates the request is the owner of the instance to which the requested resource belongs.
If the result of the network ACL check is Not Denied, proceed to the next step.
If the result of the network ACL check is Denied, Tablestore denies the request.
Perform RAM policy and instance policy evaluation.
RAM policies are identity-based access control policies. You can configure RAM policies to manage access to your resources in Tablestore. When Tablestore authenticates a request based on RAM policies, Tablestore determines whether to allow or deny the request based on the account used to send the request.
If the request is sent by using the AccessKey pair of a RAM user or Security Token Service (STS) credentials to access an instance that does not belong to the Alibaba Cloud account to which the RAM user belongs or the owner of the RAM role, the result of the RAM policy evaluation is Implicit Deny.
If Tablestore calls the authentication operation provided by RAM to authenticate a request, Tablestore allows RAM to perform authentication based on the account used to send the request and the resource group to which the instance belongs. The result of the RAM policy evaluation is Allow, Explicit Deny, or Implicit Deny.
Instance policies are resource-based authorization policies. The owner of an instance can configure instance policies to authorize RAM users to perform specific operations on the instance or specific resources in the instance.
If no instance policy is configured for the instance, the result of the instance policy evaluation is Implicit Deny.
If instance policies are configured for the instance, Tablestore performs instance policy evaluation. The result of the instance policy evaluation is Allow, Explicit Deny, or Implicit Deny.
Check whether the results of the preceding evaluation include an Explicit Deny statement.
If they do, Tablestore denies the request.
Otherwise, proceed to the next step.
Check whether the results of the preceding evaluation include an Allow statement.
If they do, Tablestore allows the request.
Otherwise, Tablestore denies the request.
References
For more information about evaluation for control policies and role-based session policies, see Policy evaluation process.
For more information about resource directories and control policies, see What is Resource Directory and Overview.
For more information about the access control methods of Tablestore, see Access control overview, RAM Policy, Control Policy, Network ACL, and Instance Policy.