使用资源组进行精细化资源控制

资源组授权的工作原理

您可以使用资源组（Resource Group）对阿里云账号内的资源进行分组管理。例如，为不同的项目创建对应的资源组，并将资源转移到对应的组中，以便集中管理各项目的资源。更多信息，请参见什么是资源组。

在完成资源分组后，您可以为不同的RAM授权主体（RAM用户、RAM用户组或RAM角色）授予指定资源组范围的权限，从而限定这个授权主体只能管理该资源组内的资源。更多信息，请参见资源分组和授权。

这种授权方式的优点有：

• 权限精细化：确保每个身份能获得最准确的资源访问权限，避免账号下的多个项目的资源混合管理。

• 良好的扩展性：后续新增资源时，只需将其加入该资源组，RAM身份便会自动获得新资源的相应权限，无需再次授权。

为RAM用户授予资源组级别的权限

下面以RAM用户为例，介绍授予指定资源组内文件存储NAS资源权限的操作步骤。

支持资源组的资源类型

文件存储NAS支持资源组的资源类型如下表所示：

不支持资源组级别授权的操作

文件存储NAS中不支持资源组级别授权的操作（Action）如下：

对于不支持资源组授权的操作，授权时资源范围选择资源组级别将无效。如果仍需要RAM用户有上述操作权限，您需要创建自定义权限策略，授权时资源范围选择账号级别。

以下是两个自定义权限策略示例，您可以根据实际需要调整策略内容。

• 允许不支持资源组级别授权的全部只读操作：Action中列举不支持资源组级别授权的所有只读操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "nas:DescribeAccessGroups",
          "nas:DescribeAccessRules",
          "nas:DescribeAutoSnapshotPolicies",
          "nas:DescribeAutoSnapshotTasks",
          "nas:DescribeBlackListClients",
          "nas:DescribeFileSystemBriefInfos",
          "nas:DescribeFileSystemStatistics",
          "nas:DescribeFilesystemsAssociatedHpnZones",
          "nas:DescribeFilesystemsVscAttachInfo",
          "nas:DescribeLogAnalysis",
          "nas:DescribeMountedClients",
          "nas:DescribeProtocolMountTarget",
          "nas:DescribeProtocolService",
          "nas:DescribeRegions",
          "nas:DescribeResourceStatistics",
          "nas:DescribeSnapshots",
          "nas:DescribeStoragePackages",
          "nas:DescribeVscMountPointAttachInfo",
          "nas:DescribeVscMountPoints",
          "nas:DescribeZones",
          "nas:GetLifecycleRuleTimeRange",
          "nas:GetViperGrayConfig"
        ],
        "Resource": "*"
      }
    ]
  }
  

• 允许不支持资源组级别授权的全部操作：Action中列举不支持资源组级别授权的全部操作。

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "nas:AddClientToBlackList",
          "nas:AddTags",
          "nas:ApplyAutoSnapshotPolicy",
          "nas:AttachVscMountPoint",
          "nas:AttachVscToFilesystems",
          "nas:BindStoragePackage",
          "nas:CancelAutoSnapshotPolicy",
          "nas:CancelLifecycleRetrieveJob",
          "nas:CancelRecycleBinJob",
          "nas:ClientMount",
          "nas:ClientRootAccess",
          "nas:ClientWrite",
          "nas:CreateAccessGroup",
          "nas:CreateAccessRule",
          "nas:CreateAutoSnapshotPolicy",
          "nas:CreateFile",
          "nas:CreateLDAPConfig",
          "nas:CreateLogAnalysis",
          "nas:CreateMountTargetInternal",
          "nas:CreateProtocolMountTarget",
          "nas:CreateProtocolService",
          "nas:CreateServicePolicy",
          "nas:CreateSnapshot",
          "nas:CreateVscMountPoint",
          "nas:DeleteAccessGroup",
          "nas:DeleteAccessRule",
          "nas:DeleteAutoSnapshotPolicy",
          "nas:DeleteLDAPConfig",
          "nas:DeleteLogAnalysis",
          "nas:DeleteMountTargetSpecial",
          "nas:DeleteProtocolMountTarget",
          "nas:DeleteProtocolService",
          "nas:DeleteSnapshot",
          "nas:DeleteVscMountPoint",
          "nas:DemoCloneTest",
          "nas:DescribeAccessGroups",
          "nas:DescribeAccessRules",
          "nas:DescribeAutoSnapshotPolicies",
          "nas:DescribeAutoSnapshotTasks",
          "nas:DescribeBlackListClients",
          "nas:DescribeFileSystemBriefInfos",
          "nas:DescribeFileSystemFlowControlSetting",
          "nas:DescribeFileSystemStatistics",
          "nas:DescribeFilesystemsAssociatedHpnZones",
          "nas:DescribeFilesystemsVscAttachInfo",
          "nas:DescribeLogAnalysis",
          "nas:DescribeMountedClients",
          "nas:DescribeProtocolMountTarget",
          "nas:DescribeProtocolMountTarget007",
          "nas:DescribeProtocolService",
          "nas:DescribeRegions",
          "nas:DescribeResourceStatistics",
          "nas:DescribeSnapshots",
          "nas:DescribeStoragePackages",
          "nas:DescribeVscMountPointAttachInfo",
          "nas:DescribeVscMountPoints",
          "nas:DescribeZones",
          "nas:DetachVscFromFilesystems",
          "nas:DetachVscMountPoint",
          "nas:GetLifecycleRuleTimeRange",
          "nas:GetViperGrayConfig",
          "nas:ModifyAccessGroup",
          "nas:ModifyAccessRule",
          "nas:ModifyAutoSnapshotPolicy",
          "nas:ModifyDataFlowTasks",
          "nas:ModifyLDAPConfig",
          "nas:ModifyProtocolMountTarget",
          "nas:ModifyProtocolService",
          "nas:OpenNasService",
          "nas:RemoveClientFromBlackList",
          "nas:ResetFileSystem",
          "nas:RetryLifecycleRetrieveJob",
          "nas:SetFileSystemFlowControl",
          "nas:TagResources",
          "nas:TestDemoDescribeProtocolMountTarget",
          "nas:TestDemoDescribeProtocolMountTarget03",
          "nas:TestDescribeProtocolMountTarget",
          "nas:TestDescribeProtocolMountTarget02",
          "nas:UnTagResources",
          "nas:UntagResources"
        ],
        "Resource": "*"
      }
    ]
  }
  

常见问题