授权信息-检索分析服务 Elasticsearch版(ES)-阿里云帮助中心

访问控制（RAM）是阿里云提供的管理用户身份与资源访问权限的服务。使用 RAM 可以让您避免与其他用户共享阿里云账号密钥，并可按需为用户授予最小权限。RAM 中使用权限策略描述授权的具体内容。

本文为您介绍 检索分析服务 Elasticsearch版 为 RAM 权限策略定义的操作（Action）、资源（Resource）和条件（Condition）。 检索分析服务 Elasticsearch版 的 RAM 代码（RamCode）为 elasticsearch ，支持的授权粒度为 资源级 。

权限策略通用结构

权限策略支持 JSON 格式，其通用结构如下：

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

各字段含义如下：

Effect：权限策略效果。取值：Allow（允许）、Deny（拒绝）。
Action：授予允许或拒绝权限的具体操作。具体信息，请参见操作（Action）。
Resource：受操作影响的具体对象，您可以使用资源 ARN 来描述指定资源。具体信息，请参见资源（Resource）。
Condition：指授权生效的条件。可选字段。具体信息，请参见条件（Condition）。
- Condition_operator：条件运算符，不同类型的条件对应不同的条件运算符。具体信息，请参见权限策略基本元素。
- Condition_key：条件关键字。
- Condition_value：条件关键字对应的值。

操作（Action）

下表是检索分析服务 Elasticsearch版定义的操作，这些操作可以在 RAM 权限策略语句的Action元素中使用，用来授予执行该操作的权限。下面对表中的具体项提供说明：

操作：是指具体的权限点。
API：是指操作对应的 API 接口。
访问级别：是指每个操作的访问级别，取值为写入（Write）、读取（Read）或列出（List）。
资源类型：是指操作中支持授权的资源类型。具体说明如下：
- 对于必选的资源类型，用前面加 * 表示。
- 对于不支持资源级授权的操作，用全部资源表示。
条件关键字：是指云产品自身定义的条件关键字。该列不体现适用于任何操作的通用条件关键字。
关联操作：是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限，操作才能成功。

操作	API	访问级别	资源类型	条件关键字	关联操作
elasticsearch:DeleteSnapshotRepo	DeleteSnapshotRepo	delete	全部资源 ``	无	无
elasticsearch:UninstallPlugin	UninstallLogstashPlugin	none	全部资源 ``	无	无
elasticsearch:CancelDeletion	CancelDeletion	none	全部资源 ``	无	无
elasticsearch:ListTags	ListTags	get	全部资源 ``	无	无
elasticsearch:DescribeElasticsearchHealth	DescribeElasticsearchHealth	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CancelTask	CancelTask	none	全部资源 ``	无	无
elasticsearch:DescribeDiagnoseReport	DescribeDiagnoseReport	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListInstance	ListInstance	get	Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/`	无	无
elasticsearch:CreateInstance	createInstance	create	Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/`	elasticsearch:DataNodeDiskEncryption elasticsearch:WarmNodeDiskEncryption	无
elasticsearch:ListStatsEventRecords	ListStatsEventRecords	none	全部资源 ``	无	无
elasticsearch:ListSnapshotReposByInstanceId	ListSnapshotReposByInstanceId	get	全部资源 ``	无	无
elasticsearch:InstallKibanaSystemPlugin	InstallKibanaSystemPlugin	none	全部资源 ``	无	无
elasticsearch:DescribeConnectableClusters	DescribeConnectableClusters	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:EstimatedLogstashRestartTime	EstimatedLogstashRestartTime	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:CreateLogstash	CreateLogstash	create	Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/`	无	无
elasticsearch:DiagnoseInstance	DiagnoseInstance	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateInstance	TransferNode	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribeComponentIndex	DescribeComponentIndex	get	全部资源 ``	无	无
elasticsearch:TriggerNetwork	TriggerNetwork	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	elasticsearch:TriggerNetworkNodeType elasticsearch:TriggerNetworkAction elasticsearch:TriggerNetworkType	无
elasticsearch:UpdateAdminPassword	UpdateAdminPassword	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:InstallAckOperator	InstallAckOperator	none	全部资源 ``	无	无
elasticsearch:DeleteIndexTemplate	DeleteIndexTemplate	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdatePipelines	UpdatePipelines		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:GetElastictask	GetElastictask	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:GetEmonGrafanaAlerts	GetEmonGrafanaAlerts	none	全部资源 ``	无	无
elasticsearch:InterruptLogstashTask	InterruptLogstashTask	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ListShardRecoveries	ListShardRecoveries	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DeleteDataTask	DeleteDataTask	delete	全部资源 ``	无	无
elasticsearch:ListComponentIndices	ListComponentIndices	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:ListTagResource	ListTagResources	none	全部资源 ``	无	无
elasticsearch:DeleteVpcEndpoint	DeleteVpcEndpoint	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:DescribeSnapshotSetting	DescribeSnapshotSetting	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateKibanaSso	UpdateKibanaSso	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:MoveResourceGroup	MoveResourceGroup	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateDict	ListDictInformation	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateCollectorName	UpdateCollectorName	update	全部资源 ``	无	无
elasticsearch:ListAlternativeSnapshotRepos	ListAlternativeSnapshotRepos	get	全部资源 ``	无	无
elasticsearch:UpdatePublicNetwork	UpdatePublicNetwork	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	elasticsearch:InstancePublicNetworkSwitch	无
elasticsearch:PostEmonTryAlarmRule	PostEmonTryAlarmRule	none	全部资源 ``	无	无
elasticsearch:ListDataStreams	ListDataStreams	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:ListPlugin	ListPlugins	get	全部资源 ``	无	无
elasticsearch:DeletePipelines	DeletePipelines		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:RestartLogstash	RestartLogstash	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:UpdateInstance	ValidateShrinkNodes	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListLogstash	ListLogstash	list	全部资源 ``	无	无
elasticsearch:ModifyScheduleExecuteTime	ModifyScheduleExecuteTime	none	全部资源 ``	无	无
elasticsearch:UpdateInstance	ValidateTransferableNodes	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:TurnOffZone	TurnOffZone	none	全部资源 ``	无	无
elasticsearch:RenewInstance	RenewInstance	none	全部资源 ``	无	无
elasticsearch:RecommendTemplates	RecommendTemplates	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:RunPipelines	RunPipelines	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:DeleteConnectedCluster	DeleteConnectedCluster	delete	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:InstallSystemPlugin	InstallSystemPlugin	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ValidateSlrPermission	ValidateSlrPermission	none	全部资源 ``	无	无
elasticsearch:CreateVpcEndpoint	CreateVpcEndpoint	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:UpgradeEngineVersion	UpgradeEngineVersion	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:AddSnapshotRepo	AddSnapshotRepo	create	全部资源 ``	无	无
elasticsearch:OpenDiagnosis	OpenDiagnosis	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribeDeprecatedTemplate	DescribeDeprecatedTemplate	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:MigrateToOtherZone	MigrateToOtherZone	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DeleteDataStream	DeleteDataStream	none	全部资源 ``	无	无
elasticsearch:ListLogstashLog	ListLogstashLog	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ListNodes	ListNodes	none	*collectors `acs:elasticsearch:{#regionId}:{#accountId}:collectors/{#collectorsId}`	无	无
elasticsearch:RolloverDataStream	RolloverDataStream	none	全部资源 ``	无	无
elasticsearch:ListPipelineIds	ListPipelineIds	get	全部资源 ``	无	无
elasticsearch:UpdateDict	UpdateSynonymsDicts	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateExtendConfig	UpdateExtendConfig	update	全部资源 ``	无	无
elasticsearch:DescribeIndexTemplate	DescribeIndexTemplate	get	全部资源 ``	无	无
elasticsearch:UpdateWhiteIps	UpdatePrivateNetworkWhiteIps	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DeleteCollector	DeleteCollector	delete	全部资源 ``	无	无
elasticsearch:CloseManagedIndex	CloseManagedIndex	none	全部资源 ``	无	无
elasticsearch:ListDiagnoseReport	ListDiagnoseReport	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateInstanceSettings	UpdateInstanceSettings	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListAckClusters	ListAckClusters	list	全部资源 ``	无	无
elasticsearch:DescribeDynamicSettings	DescribeDynamicSettings	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateBlackIps	UpdateBlackIps	update	全部资源 ``	无	无
elasticsearch:ListInstanceIndices	ListInstanceIndices	get	*instances `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribeXpackMonitorConfig	DescribeXpackMonitorConfig	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ListDiagnoseReportIds	ListDiagnoseReportIds	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribeTemplates	DescribeTemplates	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:GetKeystores	GetKeystores	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DeleteDeprecatedTemplate	DeleteDeprecatedTemplate	none	全部资源 ``	无	无
elasticsearch:TriggerNetwork	DisableKibanaPvlNetwork	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListILMPolicies	ListILMPolicies	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:AddConnectableCluster	AddConnectableCluster	create	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CreateILMPolicy	CreateILMPolicy	none	全部资源 ``	无	无
elasticsearch:ModifyDeployMachine	ModifyDeployMachine	update	全部资源 ``	无	无
elasticsearch:DeleteILMPolicy	DeleteILMPolicy	none	全部资源 ``	无	无
elasticsearch:ReinstallCollector	ReinstallCollector	none	全部资源 ``	无	无
elasticsearch:ListKibanaPlugins	ListKibanaPlugins	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UninstallPlugin	UninstallPlugin	none	全部资源 ``	无	无
elasticsearch:UpdateComponentIndex	UpdateComponentIndex	none	全部资源 ``	无	无
elasticsearch:DescribeInstance	UpgradeInfo	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DeleteComponentIndex	DeleteComponentIndex	none	全部资源 ``	无	无
elasticsearch:UpdateTemplate	UpdateTemplate	update	全部资源 ``	无	无
elasticsearch:UpdatePipelineManagementConfig	UpdatePipelineManagementConfig	none	全部资源 ``	无	无
elasticsearch:UpdateLogstashSettings	UpdateLogstashSettings		全部资源 ``	无	无
elasticsearch:DescribeLogstash	DescribeLogstash	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ListDataTasks	ListDataTasks	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CreateTags	TagResources	none	*tags `acs:elasticsearch:{#regionId}:{#accountId}:tags/{#tagsId}`	无	无
elasticsearch:ListInstanceHistoryEvents	ListInstanceHistoryEvents	get	全部资源 ``	无	无
elasticsearch:ListCollectors	ListCollectors	get	全部资源 ``	无	无
elasticsearch:InstallSystemPlugin	InstallLogstashSystemPlugin	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#InstanceId}`	无	无
elasticsearch:ListConnectedClusters	ListConnectedClusters	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateXpackMonitorConfig	UpdateXpackMonitorConfig		全部资源 ``	无	无
elasticsearch:RestartInstance	GrayPublish	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:CancelLogstashDeletion	CancelLogstashDeletion	none	全部资源 ``	无	无
elasticsearch:ListExtendfiles	ListExtendfiles	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ModifyInstanceMaintainTime	ModifyInstanceMaintainTime	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListEventRecords	ListEventRecords	get	全部资源 ``	无	无
elasticsearch:CreateCollector	CreateCollector	create	全部资源 ``	无	无
elasticsearch:DescribeAckOperator	DescribeAckOperator	get	全部资源 ``	无	无
elasticsearch:CloseHttps	CloseHttps	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ValidateConnection	ValidateConnection	get	全部资源 ``	无	无
elasticsearch:UpdateILMPolicy	UpdateILMPolicy	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateDiagnosisSettings	UpdateDiagnosisSettings	update	全部资源 ``	无	无
elasticsearch:UpdateFalconSeek	UpdateFalconSeek	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:RestartInstance	RestartInstance	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CreateComponentIndex	CreateComponentIndex	none	全部资源 ``	无	无
elasticsearch:RenewLogstash	RenewLogstash	none	全部资源 ``	无	无
elasticsearch:StopCollector	StopCollector	update	全部资源 ``	无	无
elasticsearch:ListSearchLogs	ListSearchLog	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListDeprecatedTemplates	ListDeprecatedTemplates	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:StartCollector	StartCollector	update	全部资源 ``	无	无
elasticsearch:InitializeOperationRole	InitializeOperationRole	none	全部资源 ``	无	无
elasticsearch:UninstallKibanaPlugin	UninstallKibanaPlugin	none	全部资源 ``	无	无
elasticsearch:ListAvailableEsInstanceIds	ListAvailableEsInstanceIds	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:TurnOnZone	TurnOnZone	none	全部资源 ``	无	无
elasticsearch:UpdateDict	UpdateAliwsDict	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListVpcEndpoints	ListVpcEndpoints	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:UninstallPlugin	RemovePlugin	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DeleteLogstash	DeleteLogstash		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:DescribeILMPolicy	DescribeILMPolicy	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListAckNamespaces	ListAckNamespaces	get	全部资源 ``	无	无
elasticsearch:ActivateZones	ActivateZones	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CloseDiagnosis	CloseDiagnosis	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateSnapshotSetting	UpdateSnapshotSetting	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateLogstashChargeType	UpdateLogstashChargeType		全部资源 ``	无	无
elasticsearch:InvokeEsAgent	InvokeEsAgent	none	全部资源 ``	无	无
elasticsearch:DescribeDiagnosisSettings	DescribeDiagnosisSettings	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DeactivateZones	DeactivateZones	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateDescription	UpdateDescription	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:RestartCollector	RestartCollector	none	全部资源 ``	无	无
elasticsearch:DescribeInstance	GetTransferableNodes	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateInstance	ShrinkNode	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:GetClusterDataInformation	GetClusterDataInformation	get	全部资源 ``	无	无
elasticsearch:InstallUserPlugins	InstallUserPlugins	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateKibanaSettings	UpdateKibanaSettings	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:CreateDataStream	CreateDataStream	none	全部资源 ``	无	无
elasticsearch:ResumeElasticsearchTask	ResumeElasticsearchTask	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListCollectors	ListEcsInstances	get	全部资源 ``	无	无
elasticsearch:StopPipelines	StopPipelines		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:GetEmonGrafanaDashboards	GetEmonGrafanaDashboards	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:emonProjects/{#ProjectId}`	无	无
elasticsearch:UpdateWhiteIps	UpdateWhiteIps	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateDict	UpdateDict	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:TriggerNetwork	UpdateKibanaPvlNetwork	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateAdvancedSetting	UpdateAdvancedSetting	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:InterruptElasticsearchTask	InterruptElasticsearchTask	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:TriggerNetwork	EnableKibanaPvlNetwork	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:OpenHttps	OpenHttps	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListActionRecords	ListActionRecords	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:CreatePipelines	CreatePipelines		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:QueryEmonMetrics	GetEmonMonitorData	get	*emonProjects `acs:elasticsearch:{#regionId}:{#accountId}:emonProjects/{#emonProjectsId}`	无	无
elasticsearch:RemoveTags	UntagResources	none	全部资源 ``	无	无
elasticsearch:DescribeInstance	GetSuggestShrinkableNodes	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateDynamicSettings	UpdateDynamicSettings	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdateKeystores	UpdateKeystores	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:EstimatedRestartTime	EstimatedRestartTime	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListPlugin	ListLogstashPlugins	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#InstanceId}`	无	无
elasticsearch:UpdateExtendfiles	UpdateExtendfiles	update	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:UpdateLogstashDescription	UpdateLogstashDescription		*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:DescribeInstance	ListKibanaPvlNetwork	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListIndexTemplates	ListIndexTemplates	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:ModifyWhiteIps	ModifyWhiteIps	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:InitModel	InitModel	none	全部资源 ``	无	无
elasticsearch:UpdateLogstash	UpdateLogstash	update	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:CreateIndexTemplate	CreateIndexTemplate	none	全部资源 ``	无	无
elasticsearch:UpdateIndexTemplate	UpdateIndexTemplate	none	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListDefaultCollectorConfigurations	ListDefaultCollectorConfigurations	get	全部资源 ``	无	无
elasticsearch:GetOpenstoreUsage	GetOpenStoreUsage	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DescribeInstance	ListAllNode	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:ListDicts	ListDicts	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instanceId}`	无	无
elasticsearch:ModifyElastictask	ModifyElastictask	update	全部资源 ``	无	无
elasticsearch:UpdateInstanceChargeType	UpdateInstanceChargeType	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListPipeline	ListPipeline	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:DeleteInstance	DeleteInstance	delete	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribePipeline	DescribePipeline	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:DescribeCollector	DescribeCollector	get	*collectors `acs:elasticsearch:{#regionId}:{#accountId}:collectors/{#collectorsId}`	无	无
elasticsearch:UpdateInstance	UpdateInstance	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:DescribePipelineManagementConfig	DescribePipelineManagementConfig	get	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:ResumeLogstashTask	ResumeLogstashTask	none	*Logstash `acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId}`	无	无
elasticsearch:UpdateKibanaWhiteIps	UpdateKibanaWhiteIps	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:ListDiagnoseIndices	ListDiagnoseIndices	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:CreateSnapshot	CreateSnapshot	create	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateCollector	UpdateCollector	update	全部资源 ``	无	无
elasticsearch:UploadPlugin	PluginAnalysis	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:ListPlugin	ListUserPlugin	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:UpdatePublicWhiteIps	UpdatePublicWhiteIps	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateDict	UpdateHotIkDicts	update	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId}`	无	无
elasticsearch:DescribeKibanaSettings	DescribeKibanaSettings	get	*Instance `acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}`	无	无
elasticsearch:UpdateReadWritePolicy	UpdateReadWritePolicy	update	全部资源 ``	无	无
elasticsearch:DescribeInstance	DescribeInstance	get	全部资源 ``	无	无

资源（Resource）

下表是检索分析服务 Elasticsearch版定义的资源，这些资源可以在 RAM 权限策略语句的Resource元素中使用，用来授予对该资源执行具体操作的权限。其中，资源 ARN 是资源在阿里云上的唯一标识。具体说明如下：

{#}为变量标识，需要您替换为实际值。例如：{#ramcode}需要您替换为实际的云服务RAM代码。
*表示全部。例如：
- {#resourceType}为*时：表示全部资源。
- {#regionId}为*时：表示全部地域。
- {#accountId}为*时：表示全部阿里云账号。

资源类型	资源 ARN
Instance	acs:elasticsearch:{#regionId}:{#accountId}:instances/* acs:elasticsearch:{#regionId}:{#accountId}:instances/{#InstanceId} acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId} acs:elasticsearch:{#regionId}:{#accountId}:* acs:elasticsearch:{#regionId}:{#accountId}:instances/{instanceId} acs:elasticsearch:{#regionId}:{#accountId}:emonProjects/{#ProjectId}
Logstash	acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#InstanceId} acs:elasticsearch:{#regionId}:{#accountId}:logstashes/{#logstashesId} acs:elasticsearch:{#regionId}:{#accountId}:logstashes/*
tags	acs:elasticsearch:{#regionId}:{#accountId}:tags/* acs:elasticsearch:{#regionId}:{#accountId}:tags/{#tagsId}
ackClusters	acs:elasticsearch:{#regionId}:{#accountId}:ackClusters/{#ackClustersId} acs:elasticsearch:{#regionId}:{#accountId}:ackClusters/*
snapshotrepository	acs:elasticsearch:{#regionId}:{#accountId}:snapshotrepository/*
logstashes	acs:elasticsearch:{#regionId}:{#accountId}:logstashes/*
collectors	acs:elasticsearch:{#regionId}:{#accountId}:collectors/{#collectorsId} acs:elasticsearch:{#regionId}:{#accountId}:collectors/*
instances	acs:elasticsearch:{#regionId}:{#accountId}:instances/{#instancesId}
emonProjects	acs:elasticsearch:{#regionId}:{#accountId}:emonProjects/{#emonProjectsId}

条件（Condition）

下表是检索分析服务 Elasticsearch版 定义的产品级条件关键字，这些条件关键字可以在 RAM 权限策略语句的Condition元素中使用，用来描述授予权限的条件。以下仅列举产品级的条件关键字，阿里云定义的通用条件关键字也同样适用检索分析服务 Elasticsearch版。

其中，数据类型决定了您可以使用哪些条件运算符将请求中的值与权限策略语句中的值进行比较。您必须使用与数据类型匹配的条件运算符，否则无法匹配策略语句，授权行为无效。数据类型与条件运算符的对应关系，请参见条件操作类型。

条件关键字	描述	类型
elasticsearch:TriggerNetworkNodeType	集群节点的实例类型	String
elasticsearch:InstancePublicNetworkSwitch	是否开启Elasticsearch实例的公网地址	Boolean
elasticsearch:DataNodeDiskEncryption	是否开启数据节点磁盘加密	Boolean
elasticsearch:WarmNodeDiskEncryption	是否开启冷数据节点磁盘加密	Boolean
elasticsearch:TriggerNetworkAction	开启或关闭集群的公网或私网访问的动作类型	String
elasticsearch:TriggerNetworkType	集群的网络类型	String

权限策略通用结构

操作（Action）

资源（Resource）

条件（Condition）

相关操作