ALIYUN::CS::GrantPermissions_资源编排(ROS)-阿里云帮助中心

ALIYUN::CS::GrantPermissions类型用于指定RAM用户或RAM角色的RBAC权限。

语法

{
  "Type": "ALIYUN::CS::GrantPermissions",
  "Properties": {
    "Permissions": List,
    "UserId": String
  }
}

属性

属性名称	类型	必须	允许更新	描述	约束
Permissions	List	是	是	授予RAM用户的权限列表。	更多信息，请参见Permissions属性。
UserId	String	是	是	RAM角色的 ID。	无

Permissions语法

"Permissions": [
  {
    "RoleName": String,
    "ClusterId": String,
    "RoleType": String,
    "IsCustom": Boolean,
    "IsRamRole": Boolean,
    "Namespace": String
  }
]

Permissions属性

属性名称	类型	必须	允许更新	描述	约束
ClusterId	String	是	是	授权目标集群ID。	当`RoleType`参数的值是`all-clusters`时，此参数的值传空字符串。
RoleName	String	是	是	预置的角色名称。	取值： `admin`: 管理员。 `ops`：运维人员。 `dev`：开发人员。 `restricted`: 受限用户。自定义的ClusterRole名称。
RoleType	String	是	是	授权类型。	取值： `cluster`：集群维度。 `namespace`: 命名空间维度。 `all-clusters`: 所有集群维度。
IsCustom	Boolean	否	是	该授权是否为自定义授权。	取值： true：自定义授权。 false：不是自定义授权。
IsRamRole	Boolean	否	是	是否是RAM角色授权。	取值： true：是RAM角色授权。 false：不是RAM角色授权。
Namespace	String	否	是	命名空间名称。	集群维度授权时默认为空。

返回值

Fn::GetAtt

无

示例

`YAML`格式

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  UserId:
    Type: String
    Description:
      en: The ID of the RAM user.
    Required: true
  Permissions:
    AssociationPropertyMetadata:
      Parameters:
        RoleName:
          Type: String
          Description:
            en: |-
              he predefined role name. Valid values:
              admin: administrator
              ops: O&M engineer
              dev: developer
              restricted: restricted user
              The custom cluster role.
          Required: true
        ClusterId:
          Type: String
          Description:
            en: The ID of the cluster that you want to manage. When the role_type parameter is set to all-clusters, this parameter is set to an empty string.
          Required: true
        RoleType:
          Type: String
          Description:
            en: |-
              The authorization type. Valid values:
              cluster: indicates that the permissions are scoped to a cluster.
              namespace: specifies that the permissions are scoped to a namespace of a cluster.
              all-clusters: specifies that the permissions are scoped to all clusters.
          AllowedValues:
            - cluster
            - namespace
            - all-clusters
          Required: true
    AssociationProperty: List[Parameters]
    Type: Json
    Description:
      en: 'The permissions that you want to grant to the RAM user. '
    Required: true
    MinLength: 0
    MaxLength: 20
Resources:
  GrantPermissions:
    Type: ALIYUN::CS::GrantPermissions
    Properties:
      UserId:
        Ref: UserId
      Permissions:
        Ref: Permissions

`JSON`格式

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "UserId": {
      "Type": "String",
      "Description": {
        "en": "The ID of the RAM user."
      },
      "Required": true
    },
    "Permissions": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "RoleName": {
            "Type": "String",
            "Description": {
              "en": "he predefined role name. Valid values:\nadmin: administrator\nops: O&M engineer\ndev: developer\nrestricted: restricted user\nThe custom cluster role."
            },
            "Required": true
          },
          "ClusterId": {
            "Type": "String",
            "Description": {
              "en": "The ID of the cluster that you want to manage. When the role_type parameter is set to all-clusters, this parameter is set to an empty string."
            },
            "Required": true
          },
          "RoleType": {
            "Type": "String",
            "Description": {
              "en": "The authorization type. Valid values:\ncluster: indicates that the permissions are scoped to a cluster.\nnamespace: specifies that the permissions are scoped to a namespace of a cluster.\nall-clusters: specifies that the permissions are scoped to all clusters."
            },
            "AllowedValues": [
              "cluster",
              "namespace",
              "all-clusters"
            ],
            "Required": true
          }
        }
      },
      "AssociationProperty": "List[Parameters]",
      "Type": "Json",
      "Description": {
        "en": "The permissions that you want to grant to the RAM user. "
      },
      "Required": true,
      "MinLength": 0,
      "MaxLength": 20
    }
  },
  "Resources": {
    "GrantPermissions": {
      "Type": "ALIYUN::CS::GrantPermissions",
      "Properties": {
        "UserId": {
          "Ref": "UserId"
        },
        "Permissions": {
          "Ref": "Permissions"
        }
      }
    }
  }
}

语法

属性

Permissions语法

Permissions属性

返回值

示例

YAML格式

JSON格式

`YAML`格式

`JSON`格式