云消息队列 RabbitMQ 版自定义权限策略参考

什么是自定义权限策略

在基于RAM的访问控制体系中，自定义权限策略是指在系统权限策略之外，您可以自主创建、更新和删除的权限策略。自定义权限策略的版本更新需由您来维护。

• 创建自定义权限策略后，需为RAM用户、用户组或RAM角色绑定权限策略，这些RAM身份才能获得权限策略中指定的访问权限。

• 已创建的权限策略支持删除，但删除前需确保该策略未被引用。如果该权限策略已被引用，您需要在该权限策略的引用记录中移除授权。

• 自定义权限策略支持版本控制，您可以按照RAM规定的版本管理机制来管理您创建的自定义权限策略版本。

操作文档

• 创建自定义权限策略

• 修改自定义权限策略内容和备注

• 删除自定义权限策略

• 管理权限策略引用记录

• 管理自定义权限策略版本

自定义授权策略

云消息队列 RabbitMQ 版支持以下自定义权限策略。

客户端接口权限说明

控制台OpenAPI及功能权限说明

自定义权限策略示例

• 示例一：自定义某个Vhost消息收发权限

  {
      "Version":"1",
      "Statement":[
          {
              "Action":[
                  "amqp:GetInstance",
                  "amqp:ListVhost",
                  "amqp:GetVhost"
              ],
              "Resource":[
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
              ],
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet",
                  "amqp:GetExchange"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
              "Effect":"Allow"
          }
      ]
  }

• 示例二：自定义发布消息授权策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicPublish",
                  "amqp:BasicAck",
                  "amqp:BasicNack"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 示例三：自定义订阅消息授权策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 示例四：自定义发布和订阅消息授权策略

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• 示例五：自定义用户名密码权限

  {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*"
          },
          {
              "Effect": "Allow",
              "Action": "amqp:GetInstance",
              "Resource": "acs:amqp:*:*:/instances/$instanceId"
          }
      ],
      "Version": "1"
  }

• 示例六：自定义授予某个RAM用户创建实例的权限

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "amqp:CreateInstance",
              "Resource": "acs:amqp:*:$accountid:/instances/*",
          }
      ]
  }

• 示例七：自定义授予某个RAM用户，仅能创建铂金版实例且不支持开启公网的权限

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "amqp:CreateInstance",
              "Resource": "acs:amqp:*:$accountid:/instances/*",
              "Condition": {
                  "StringEquals": {
                      "amqp:InstanceType": [
                          "vip"
                      ],
                      "amqp:SupportEIP": [
                          "false"
                      ]
                  }
              }
          }
      ]
  }

• 示例八：自定义某个RAM用户对单个实例的所有操作权限

  {
      "Version": "1",
      "Statement": [
          {
              "Action": "amqp:ListInstance",
              "Resource": "acs:amqp:*:*:/instances/*",
              "Effect": "Allow"
          },
          {
              "Action": "amqp:*",
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
              "Effect": "Allow"
          }
      ]
  }