在使用RAM账号调用私网连接API前，需要主账号通过创建授权策略对RAM账号进行授权。在授权策略中，使用资源描述符（Alibaba Cloud Resource Name, ARN）指定授权资源。

可授权的私网连接资源类型

下表列举了PrivateLink中可授权的资源及其描述方式，其中$regionid:$accountid:vpcendpoint/$endpointid 为具体的资源ID，*代表对应的所有资源。

资源类型 授权策略中的资源描述方法
终端节点服务（VpcEndpointService） acs:privatelink:$regionid:$accountid:vpcendpointservice/$serviceid
acs:privatelink:$regionid:$accountid:vpcendpointservice/*
acs:privatelink:*:$accountid:vpcendpointservice/*
终端节点（VpcEndpoint） acs:privatelink:$regionid:$accountid:vpcendpoint/$endpointid
acs:privatelink:$regionid:$accountid:vpcendpoint/*
acs:privatelink:*:$accountid:vpcendpoint/*

可授权的私网连接接口

下表列举了PrivateLink中可授权的API及其描述方式，其中$regionid:$accountid:vpcendpoint/$endpointid为具体的资源ID，*代表对应的所有资源。
API 资源描述
AddUserToVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
AttachResourceToVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
可选：acs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId}
AddZoneToVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
AttachSecurityGroupToVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
acs:ecs:{#regionId}:{#accountId}:securitygroup/{#SecurityGroupId}
CreateVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/*
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
acs:vpc:{#regionId}:{#accountId}:securitygroup/{#SecurityGroupId}
可选：acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
CreateVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/*
可选：acs:slb:{#regionId}:{#accountId}:loadbalancer/{#LoadBalancerId}
DeleteVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
DeleteVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
DetachResourceFromVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
DetachSecurityGroupFromVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
DisableVpcEndpointConnection acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
EnableVpcEndpointConnection acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
GetVpcEndpointAttribute acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
GetVpcEndpointServiceAttribute acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
ListVpcEndpointConnections acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/*
ListVpcEndpoints acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/*
ListVpcEndpointSecurityGroups acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
ListVpcEndpointServiceResources acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
ListVpcEndpointServices acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/*
ListVpcEndpointServiceUsers acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
ListVpcEndpointZones acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
RemoveUserFromVpcEndpointService acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
RemoveZoneFromVpcEndpoint acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
UpdateVpcEndpointAttribute acs:privatelink:{#regionId}:{#accountId}:vpcendpoint/{#EndpointId}
UpdateVpcEndpointConnectionAttribute acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
UpdateVpcEndpointServiceAttribute acs:privatelink:{#regionId}:{#accountId}:vpcendpointservice/{#ServiceId}
ListVpcEndpointServicesByEndUser Condition： privatelink:VpcEndpointServiceIdacs:privatelink:*:*:*
DescribeRegions 无需鉴权
DescribeZones 无需鉴权