使用资源组进行精细化资源控制

资源组授权的工作原理

您可以使用资源组（Resource Group）对阿里云账号内的资源进行分组管理。例如，为不同的项目创建对应的资源组，并将资源转移到对应的组中，以便集中管理各项目的资源。更多信息，请参见什么是资源组。

在完成资源分组后，您可以为不同的RAM授权主体（RAM用户、RAM用户组或RAM角色）授予指定资源组范围的权限，从而限定这个授权主体只能管理该资源组内的资源。更多信息，请参见资源分组和授权。

这种授权方式的优点有：

• 权限精细化：确保每个身份能获得最准确的资源访问权限，避免账号下的多个项目的资源混合管理。

• 良好的扩展性：后续新增资源时，只需将其加入该资源组，RAM身份便会自动获得新资源的相应权限，无需再次授权。

为RAM用户授予资源组级别的权限

下面以RAM用户为例，介绍授予指定资源组内数据传输服务DTS资源权限的操作步骤。

支持资源组的资源类型

数据传输服务DTS支持资源组的资源类型如下表所示：

不支持资源组级别授权的操作

数据传输服务DTS中不支持资源组级别授权的操作（Action）如下：

对于不支持资源组授权的操作，授权时资源范围选择资源组级别将无效。如果仍需要RAM用户有上述操作权限，您需要创建自定义权限策略，授权时资源范围选择账号级别。

以下是两个自定义权限策略示例，您可以根据实际需要调整策略内容。

• 允许不支持资源组级别授权的全部只读操作：Action中列举不支持资源组级别授权的所有只读操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dts:CheckDefaultEventRule",
          "dts:CheckDefaultRole",
          "dts:CountJobByCondition",
          "dts:CreateServiceLinkedRoleForZeroETL",
          "dts:CreateZeroETLInstance",
          "dts:DescribeBasicConfigs",
          "dts:DescribeCheckJobs",
          "dts:DescribeClusterNodeInfo",
          "dts:DescribeConnectionStatus",
          "dts:DescribeDTSIP",
          "dts:DescribeDnsResolveResult",
          "dts:DescribeDocParserJobResult",
          "dts:DescribeDocParserJobStatus",
          "dts:DescribeDomainRegions",
          "dts:DescribeDtsJobsTransmission",
          "dts:DescribeEventMetaInfo",
          "dts:DescribeGadInstanceDetail",
          "dts:DescribeGadInstanceDtsMembers",
          "dts:DescribeGadInstances",
          "dts:DescribeHistoryEvents",
          "dts:DescribeHistoryEventsStat",
          "dts:DescribeInstanceInventory",
          "dts:DescribeMigrationJobs",
          "dts:DescribePreCheckCreateGadOrderResult",
          "dts:DescribeRAGFlowAvailableZones",
          "dts:DescribeRAGFlowInstancePrice",
          "dts:DescribeSubscriptionInstances",
          "dts:DescribeSynchronizationJobStatusList",
          "dts:DescribeSynchronizationObjectModifyStatus",
          "dts:DescribeTagKeys",
          "dts:DescribeTagValues",
          "dts:DescribeUserEventConfig",
          "dts:DescribeWorkflowJobResult",
          "dts:DescribeZeroETLInstanceLimitation",
          "dts:GenerateChatCompletion",
          "dts:LoginRAGFlowInstance",
          "dts:ModifyConsumerGroupPassword",
          "dts:Ping",
          "dts:PreviewData",
          "dts:PreviewSql",
          "dts:PromoteToMaster",
          "dts:ShieldPrecheck"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允许不支持资源组级别授权的全部操作：Action中列举不支持资源组级别授权的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dts:AddTags",
          "dts:AllocateRAGFlowInstancePublicConnection",
          "dts:CheckDefaultEventRule",
          "dts:CheckDefaultRole",
          "dts:ConfigureSynchronizationJobReplicatorCompare",
          "dts:ConfigureZeroETLJob",
          "dts:CountJobByCondition",
          "dts:CreateDocParserJob",
          "dts:CreateGadInstance",
          "dts:CreateRAGFlowInstance",
          "dts:CreateRAGKnowledgeBase",
          "dts:CreateServiceLinkedRoleForZeroETL",
          "dts:CreateZeroETLInstance",
          "dts:DeleteGadInstance",
          "dts:DeleteNetWorkPath",
          "dts:DeleteRAGFlowInstance",
          "dts:DescribeBasicConfigs",
          "dts:DescribeCheckJobDiffDetails",
          "dts:DescribeCheckJobStatus",
          "dts:DescribeCheckJobs",
          "dts:DescribeClusterNodeInfo",
          "dts:DescribeConnectionStatus",
          "dts:DescribeDTSIP",
          "dts:DescribeDnsResolveResult",
          "dts:DescribeDocParserJobResult",
          "dts:DescribeDocParserJobStatus",
          "dts:DescribeDomainRegions",
          "dts:DescribeDtsJob",
          "dts:DescribeDtsJobsTransmission",
          "dts:DescribeEventMetaInfo",
          "dts:DescribeGadInstanceDetail",
          "dts:DescribeGadInstanceDtsMembers",
          "dts:DescribeGadInstances",
          "dts:DescribeHistoryEvents",
          "dts:DescribeHistoryEventsStat",
          "dts:DescribeInstanceInventory",
          "dts:DescribeMigrationJobs",
          "dts:DescribeNetWorkNisAnalysis",
          "dts:DescribePreCheckCreateGadOrderResult",
          "dts:DescribeRAGDocumentParseResult",
          "dts:DescribeRAGFlowAvailableZones",
          "dts:DescribeRAGFlowInstanceAttribute",
          "dts:DescribeRAGFlowInstancePrice",
          "dts:DescribeRdsInfo",
          "dts:DescribeSubscriptionInstances",
          "dts:DescribeSynchronizationJobStatusList",
          "dts:DescribeSynchronizationObjectModifyStatus",
          "dts:DescribeTagKeys",
          "dts:DescribeTagValues",
          "dts:DescribeUserEventConfig",
          "dts:DescribeWorkflowJobResult",
          "dts:DescribeZeroETLInstanceLimitation",
          "dts:DetachGadInstanceDbMember",
          "dts:DisableRAGFlowInstanceSSO",
          "dts:EnableRAGFlowInstanceSSO",
          "dts:Feedback",
          "dts:GenerateChatCompletion",
          "dts:GetAnswer",
          "dts:GetLindormInstanceInner",
          "dts:GetSimilarQuestions",
          "dts:InitDtsRdsInstance",
          "dts:ListRAGDocument",
          "dts:ListRAGKnowledgeBase",
          "dts:LoginRAGFlowInstance",
          "dts:ModifyConsumerGroupPassword",
          "dts:ModifyDtsJobDedicatedCluster",
          "dts:ModifyEventScheduleTime",
          "dts:ModifyGadInstanceName",
          "dts:ModifyRAGFlowInstanceDescription",
          "dts:ModifyRAGFlowInstanceSSO",
          "dts:ModifyRAGFlowSecurityIps",
          "dts:Ping",
          "dts:PreCheckCreateGadOrder",
          "dts:PreviewData",
          "dts:PreviewSql",
          "dts:PromoteToMaster",
          "dts:RemoveTags",
          "dts:SaveEtlJob",
          "dts:ShieldPrecheck",
          "dts:StartReverseWriter",
          "dts:SubmitDocParserJob",
          "dts:SwitchPhysicalDtsJobToCloud",
          "dts:TagResources",
          "dts:UntagResources",
          "dts:UploadRAGDocument"
        ],
        "Resource": "*"
      }
    ]
  }
  

常见问题