Authorization for API calls

Grant permissions to a RAM user

BSS OpenAPI supports three managed access policies. Start with the managed policy that best fits the scope required, then refine with a custom policy if needed.

To attach a managed policy to a RAM user, see Grant permissions to a RAM user.

Create a custom policy

For more granular control, create a custom policy using BSS OpenAPI permission points. The permission format is bssapi:<APIName>, for example, bssapi:QueryInstanceBill.

The following policy allows a RAM user to query instance bills:

{
    "Version": 1,
    "Statement": [
        {
            "Action": [
                "bssapi:QueryInstanceBill"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

The resource for all BSS OpenAPI permissions is *.

For the policy syntax reference, see Policy structure and syntax.

Set product-specific permissions

To restrict a RAM user or user group to managing only the instances or bills of a specific cloud product, add a Condition block to the policy. When the user calls an API, the request must satisfy the ProductCode and ProductType conditions in the policy.

The following policy allows querying orders only where ProductCode is rds and ProductType is rords or bards:

{
    "Version": 1,
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "bssapi:QueryOrders"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringEquals": {
                    "bssapi:ProductCode": "rds",
                    "bssapi:ProductType": [
                        "rords",
                        "bards"
                    ]
                }
            }
        }
    ]
}

Replace rds, rords, and bards with the ProductCode and ProductType values for the cloud product you want to restrict access to.