访问控制(RAM)是阿里云提供的管理用户身份与资源访问权限的服务。使用RAM可以让您避免与其他用户共享阿里云账号密钥,并可按需为用户授予最小权限。RAM中使用权限策略描述授权的具体内容。
本文为您介绍专有网络VPC(VPC)为RAM权限策略定义的操作(Action)、资源(Resource)和条件(Condition)。专有网络VPC(VPC)的RAM代码(RamCode)为vpc,支持的授权粒度为RESOURCE。
权限策略通用结构
权限策略支持JSON格式,其通用结构如下:
{
"Version": "1",
"Statement": [
{
"Effect": "<Effect>",
"Action": "<Action>",
"Resource": "<Resource>",
"Condition": {
"<Condition_operator>": {
"<Condition_key>": [
"<Condition_value>"
]
}
}
}
]
}
- Effect:权限策略效果。取值:Allow(允许)、Deny(拒绝)。
- Action:授予允许或拒绝权限的具体操作。具体信息,请参见操作(Action)。
- Resource:受操作影响的具体对象,您可以使用资源ARN来描述指定资源。具体信息,请参见资源(Resource)。
- Condition:指授权生效的条件。可选字段。具体信息,请参见条件(Condition)。
- Condition_operator:条件运算符,不同类型的条件对应不同的条件运算符。具体信息,请参见权限策略基本元素。
- Condition_key:条件关键字。
- Condition_value:条件关键字对应的值。
操作(Action)
下表是专有网络VPC(VPC)定义的操作,这些操作可以在RAM权限策略语句的Action
元素中使用,用来授予执行该操作的权限。下面对表中的具体项提供说明:- 操作:是指具体的权限点。
- API:是指操作对应的API接口。
- 访问级别:是指每个操作的访问级别,取值为写入(Write)、读取(Read)或列出(List)。
- 资源类型:是指操作中支持授权的资源类型。具体说明如下:
- 对于必选的资源类型,用背景高亮的方式表示。
- 对于不支持资源级授权的操作,用
全部资源
表示。
- 条件关键字:是指云产品自身定义的条件关键字。该列不体现适用于任何操作的通用条件关键字。
- 关联操作:是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限,操作才能成功。
操作 | API | 访问级别 | 资源类型 | 条件关键字 | 关联操作 |
---|---|---|---|---|---|
vpc:ActiveFlowLog | ActiveFlowLog | Write | FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} | 无 | 无 |
vpc:AddSourcesToTrafficMirrorSession | AddSourcesToTrafficMirrorSession | Write | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId} | 无 | 无 |
vpc:AllocateVpcIpv6Cidr | AllocateVpcIpv6Cidr | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/* | 无 | 无 |
vpc:AssociateHaVip | AssociateHaVip | Write | Instance acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId}HaVip acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} | 无 | 无 |
vpc:AssociateNetworkAcl | AssociateNetworkAcl | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:AssociateRouteTable | AssociateRouteTable | Write | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#vswitchId} | 无 | 无 |
vpc:AssociateRouteTableWithGateway | AssociateRouteTableWithGateway | Write | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId} | 无 | 无 |
vpc:AssociateRouteTablesWithVpcGatewayEndpoint | AssociateRouteTablesWithVpcGatewayEndpoint | Write | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
vpc:AssociateVpcCidrBlock | AssociateVpcCidrBlock | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:AttachDhcpOptionsSetToVpc | AttachDhcpOptionsSetToVpc | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:ChangeResourceGroup | ChangeResourceGroup | Write | PhysicalConnection acs:vpc:*:{#accountId}:physicalconnection/{#PhysicalConnectionId}VirtualBorderRouter acs:vpc:*:{#AccountId}:virtualborderrouter/{#VbrId}RouterInterface acs:vpc:*:{#AccountId}:routerinterface/{#RouterInterfaceId} | 无 | 无 |
vpc:CopyNetworkAclEntries | CopyNetworkAclEntries | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} | 无 | 无 |
vpc:CreateDefaultVSwitch | CreateDefaultVSwitch | Write | VSwitch acs:vpc:{#regionid}:{#accountId}:vswitch/* | 无 | 无 |
vpc:CreateDefaultVpc | CreateDefaultVpc | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/* | 无 | 无 |
vpc:CreateDhcpOptionsSet | CreateDhcpOptionsSet | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/* | 无 | 无 |
vpc:CreateFlowLog | CreateFlowLog | Write | VSwitch acs:vpc:{#regionid}:{#accountId}:vswitch/{#VSwitchId}FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/*VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:CreateHaVip | CreateHaVip | Write | HaVip acs:vpc:{#regionId}:{#accountId}:havip/*VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:CreateIpv4Gateway | CreateIpv4Gateway | Write | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/* | 无 | 无 |
vpc:CreateNetworkAcl | CreateNetworkAcl | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/*VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:CreateRouteEntries | CreateRouteEntries | Write | RouteEntry acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:CreateRouteEntry | CreateRouteEntry | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:CreateRouteTable | CreateRouteTable | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/* | 无 | 无 |
vpc:CreateTrafficMirrorFilter | CreateTrafficMirrorFilter | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/* | 无 | 无 |
vpc:CreateTrafficMirrorFilterRules | CreateTrafficMirrorFilterRules | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:CreateTrafficMirrorSession | CreateTrafficMirrorSession | Write | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/*TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:CreateVSwitch | CreateVSwitch | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/* | vpc:tag | 无 |
vpc:CreateVSwitchCidrReservation | CreateVSwitchCidrReservation | Write | VSwitchCidrReservation acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/* | 无 | 无 |
vpc:CreateVpc | CreateVpc | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/* | 无 | 无 |
vpc:CreateVpcGatewayEndpoint | CreateVpcGatewayEndpoint | Write | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/* | 无 | 无 |
vpc:CreateVpcPrefixList | CreateVpcPrefixList | Write | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/* | 无 | 无 |
vpc:DeactiveFlowLog | DeactiveFlowLog | Write | FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} | 无 | 无 |
vpc:DeleteDhcpOptionsSet | DeleteDhcpOptionsSet | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} | 无 | 无 |
vpc:DeleteFlowLog | DeleteFlowLog | Write | FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} | 无 | 无 |
vpc:DeleteHaVip | DeleteHaVip | Write | HaVip acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} | 无 | 无 |
vpc:DeleteIpv4Gateway | DeleteIpv4Gateway | Write | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId} | 无 | 无 |
vpc:DeleteNetworkAcl | DeleteNetworkAcl | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} | 无 | 无 |
vpc:DeleteRouteEntries | DeleteRouteEntries | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId} | 无 | 无 |
vpc:DeleteRouteEntry | DeleteRouteEntry | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:DeleteRouteTable | DeleteRouteTable | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:DeleteTrafficMirrorFilter | DeleteTrafficMirrorFilter | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:DeleteTrafficMirrorFilterRules | DeleteTrafficMirrorFilterRules | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:DeleteTrafficMirrorSession | DeleteTrafficMirrorSession | Write | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId} | 无 | 无 |
vpc:DeleteVSwitch | DeleteVSwitch | Write | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:DeleteVSwitchCidrReservation | DeleteVSwitchCidrReservation | Write | VSwitchCidrReservation acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId} | 无 | 无 |
vpc:DeleteVpc | DeleteVpc | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | vpc:tag | 无 |
vpc:DeleteVpcGatewayEndpoint | DeleteVpcGatewayEndpoint | Write | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
vpc:DeleteVpcPrefixList | DeleteVpcPrefixList | Write | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} | 无 | 无 |
vpc:DeletionProtection | DeletionProtection | Write | Address acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId} | 无 | 无 |
vpc:DescribeFlowLogs | DescribeFlowLogs | Read | FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/* | 无 | 无 |
vpc:DescribeGrantRulesToCen | DescribeGrantRulesToCen | Read | VirtualBorderRouter acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#InstanceId}GrantRuleToCen acs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId} | 无 | 无 |
vpc:DescribeHaVips | DescribeHaVips | Read | HaVip acs:vpc:{#regionId}:{#accountId}:havip/* | 无 | 无 |
vpc:DescribeNetworkAclAttributes | DescribeNetworkAclAttributes | Read | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} | 无 | 无 |
vpc:DescribeNetworkAcls | DescribeNetworkAcls | List | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/* | 无 | 无 |
vpc:DescribeRouteEntryList | DescribeRouteEntryList | Read | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:DescribeRouteTableList | DescribeRouteTableList | List | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/* | vpc:VRouter vpc:VBR | 无 |
vpc:DescribeRouteTables | DescribeRouteTables | List | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | vpc:VBR vpc:VRouter | 无 |
vpc:DescribeTagKeys | DescribeTagKeys | Read | 全部资源 * | 无 | 无 |
vpc:DescribeTagKeysForExpressConnect | DescribeTagKeysForExpressConnect | List | 全部资源 * | 无 | 无 |
vpc:DescribeTags | DescribeTags | Read | 全部资源 * | vpc:tag | 无 |
vpc:DescribeVRouters | DescribeVRouters | List | VRouter acs:vpc:{#regionId}:{#accountId}:vrouter/* | vpc:VPC | 无 |
vpc:DescribeVSwitchAttributes | DescribeVSwitchAttributes | Read | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:DescribeVSwitches | DescribeVSwitches | List | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/* | vpc:VPC | 无 |
vpc:DescribeVpcAttribute | DescribeVpcAttribute | Read | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | vpc:tag | 无 |
vpc:DescribeVpcs | DescribeVpcs | List | VPC acs:vpc:{#regionId}:{#accountId}:vpc/*VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VPCId} | vpc:tag | 无 |
vpc:DetachDhcpOptionsSetFromVpc | DetachDhcpOptionsSetFromVpc | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:DisableVpcClassicLink | DisableVpcClassicLink | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:DissociateRouteTableFromGateway | DissociateRouteTableFromGateway | Read | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId} | 无 | 无 |
vpc:DissociateRouteTablesFromVpcGatewayEndpoint | DissociateRouteTablesFromVpcGatewayEndpoint | Write | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
vpc:EnableVpcClassicLink | EnableVpcClassicLink | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:EnableVpcIpv4Gateway | EnableVpcIpv4Gateway | Write | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId} | 无 | 无 |
vpc:GetDhcpOptionsSet | GetDhcpOptionsSet | Read | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} | 无 | 无 |
vpc:GetFlowLogServiceStatus | GetFlowLogServiceStatus | Read | FlowLogService acs:vpc:{#regionId}:{#accountId}:flowlog/* | 无 | 无 |
vpc:GetIpv4GatewayAttribute | GetIpv4GatewayAttribute | Read | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#Ipv4GatewayId} | 无 | 无 |
vpc:GetTrafficMirrorServiceStatus | GetTrafficMirrorServiceStatus | Read | 全部资源 * | 无 | 无 |
vpc:GetVSwitchCidrReservationUsage | GetVSwitchCidrReservationUsage | Read | VSwitchCidrReservation acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId} | 无 | 无 |
vpc:GetVpcGatewayEndpointAttribute | GetVpcGatewayEndpointAttribute | Read | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
vpc:GetVpcPrefixListAssociations | GetVpcPrefixListAssociations | Read | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} | 无 | 无 |
vpc:GetVpcPrefixListEntries | GetVpcPrefixListEntries | Read | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} | 无 | 无 |
vpc:GetVpcRouteEntrySummary | GetVpcRouteEntrySummary | List | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#vpcId} | 无 | 无 |
vpc:GrantInstanceToCen | GrantInstanceToCen | Write | 全部资源 * | 无 | 无 |
vpc:ListDhcpOptionsSets | ListDhcpOptionsSets | Read | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/*DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} | 无 | 无 |
vpc:ListGatewayRouteTableEntries | ListGatewayRouteTableEntries | List | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId} | 无 | 无 |
vpc:ListIpv4Gateways | ListIpv4Gateways | List | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/* | 无 | 无 |
vpc:ListPrefixLists | ListPrefixLists | List | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/* | 无 | 无 |
vpc:ListTagResources | ListTagResources | Read | BandwidthPackage acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#BandwidthPackageId}Address acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}NatGateway acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTable}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | vpc:tag | 无 |
vpc:ListTagResourcesForExpressConnect | ListTagResourcesForExpressConnect | List | PhysicalConnection acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}VirtualBorderRouter acs:vpc:{#regionId}:{#AccountId}:virtualborderrouter/{#VbrId}RouterInterface acs:vpc:{#regionId}:{#AccountId}:routerinterface/{#RouterInterfaceId} | 无 | 无 |
vpc:ListTrafficMirrorFilters | ListTrafficMirrorFilters | List | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/* | 无 | 无 |
vpc:ListTrafficMirrorSessions | ListTrafficMirrorSessions | List | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/* | 无 | 无 |
vpc:ListVSwitchCidrReservations | ListVSwitchCidrReservations | List | VSwitchCidrReservation acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/* | 无 | 无 |
vpc:ListVpcEndpointServicesByEndUser | ListVpcEndpointServicesByEndUser | List | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/* | 无 | 无 |
vpc:ListVpcGatewayEndpoints | ListVpcGatewayEndpoints | List | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/*GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
vpc:ModifyFlowLogAttribute | ModifyFlowLogAttribute | Write | FlowLog acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} | 无 | 无 |
vpc:ModifyHaVipAttribute | ModifyHaVipAttribute | Write | HaVip acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} | 无 | 无 |
vpc:ModifyNetworkAclAttributes | ModifyNetworkAclAttributes | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} | 无 | 无 |
vpc:ModifyRouteEntry | ModifyRouteEntry | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:ModifyRouteTableAttributes | ModifyRouteTableAttributes | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | vpc:VRouter | 无 |
vpc:ModifyVRouterAttribute | ModifyVRouterAttribute | Write | VRouter acs:vpc:{#regionId}:{#accountId}:vrouter/{#VRouterId} | 无 | 无 |
vpc:ModifyVSwitchAttribute | ModifyVSwitchAttribute | Write | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:ModifyVSwitchCidrReservationAttribute | ModifyVSwitchCidrReservationAttribute | Write | 全部资源 * | 无 | 无 |
vpc:ModifyVpcAttribute | ModifyVpcAttribute | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | vpc:tag | 无 |
vpc:ModifyVpcPrefixList | ModifyVpcPrefixList | Write | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} | 无 | 无 |
vpc:MoveResourceGroup | MoveResourceGroup | Write | 全部资源 * | 无 | 无 |
vpc:OpenFlowLogService | OpenFlowLogService | Write | FlowLogService acs:vpc:{#regionId}:{#accountId}:flowlog/* | 无 | 无 |
vpc:OpenTrafficMirrorService | OpenTrafficMirrorService | Write | 全部资源 * | 无 | 无 |
vpc:RemoveSourcesFromTrafficMirrorSession | RemoveSourcesFromTrafficMirrorSession | Write | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId} | 无 | 无 |
vpc:ReplaceVpcDhcpOptionsSet | ReplaceVpcDhcpOptionsSet | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:RetryVpcPrefixListAssociation | RetryVpcPrefixListAssociation | Write | PrefixList acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} | 无 | 无 |
vpc:RevokeInstanceFromCen | RevokeInstanceFromCen | Write | VirtualBorderRouter acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VirtualBorderRouterId} | 无 | 无 |
vpc:TagResources | TagResources | Write | BandwidthPackage acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#BandwidthPackageId}Address acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}NatGateway acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | vpc:tag | 无 |
vpc:TagResourcesForExpressConnect | TagResourcesForExpressConnect | Write | PhysicalConnection acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}VirtualBorderRouter acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}RouterInterface acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId} | 无 | 无 |
vpc:UnTagResources | UnTagResources | Write | Address acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}NatGateway acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | vpc:tag | 无 |
vpc:UnassociateHaVip | UnassociateHaVip | Write | Instance acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId}HaVip acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} | 无 | 无 |
vpc:UnassociateNetworkAcl | UnassociateNetworkAcl | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:UnassociateRouteTable | UnassociateRouteTable | Write | VSwitch acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} | 无 | 无 |
vpc:UnassociateVpcCidrBlock | UnassociateVpcCidrBlock | Write | VPC acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} | 无 | 无 |
vpc:UntagResourcesForExpressConnect | UntagResourcesForExpressConnect | Write | PhysicalConnection acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}VirtualBorderRouter acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}RouterInterface acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId} | 无 | 无 |
vpc:UpdateDhcpOptionsSetAttribute | UpdateDhcpOptionsSetAttribute | Write | DhcpOptionsSet acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} | 无 | 无 |
vpc:UpdateGatewayRouteTableEntryAttribute | UpdateGatewayRouteTableEntryAttribute | Write | RouteTable acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} | 无 | 无 |
vpc:UpdateIpv4GatewayAttribute | UpdateIpv4GatewayAttribute | Write | Ipv4Gateway acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId} | 无 | 无 |
vpc:UpdateNetworkAclEntries | UpdateNetworkAclEntries | Write | NetworkAcl acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} | 无 | 无 |
vpc:UpdateTrafficMirrorFilterAttribute | UpdateTrafficMirrorFilterAttribute | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:UpdateTrafficMirrorFilterRuleAttribute | UpdateTrafficMirrorFilterRuleAttribute | Write | TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:UpdateTrafficMirrorSessionAttribute | UpdateTrafficMirrorSessionAttribute | Write | TrafficMirrorSession acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}TrafficMirrorFilter acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} | 无 | 无 |
vpc:UpdateVpcGatewayEndpointAttribute | UpdateVpcGatewayEndpointAttribute | Write | GatewayEndpoint acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} | 无 | 无 |
资源(Resource)
下表是专有网络VPC(VPC)定义的资源,这些资源可以在RAM权限策略语句的Resource
元素中使用,用来授予对该资源执行具体操作的权限。 其中,资源ARN是资源在阿里云上的唯一标识。具体说明如下:{#}
为变量标识,需要您替换为实际值。例如:{#ramcode}
需要您替换为实际的云服务RAM代码。-
*
表示全部。例如:{#resourceType}
为*
时:表示全部资源。{#regionId}
为*
时:表示全部地域。{#accountId}
为*
时:表示全部阿里云账号。
资源类型 | 资源ARN |
---|---|
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} |
FlowLogService | acs:vpc:{#regionId}:{#accountId}:flowlogservice |
TrafficMirrorSession | acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId} |
TrafficMirrorFilter | acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} |
Ipv6Gateway | acs:vpc:{#regionId}:{#accountId}:ipv6gateway/{#Ipv6GatewayId} |
DhcpOptionsSet | acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} |
NetworkAcl | acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} |
RouteTable | acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} |
VSwitch | acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/vswitch/{#VSwitchId} |
GatewayEndpoint | acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} |
GlobalAccelerationInstance | acs:vpc:{#regionId}:{#accountId}:globalaccelerationinstance/{#GlobalAccelerationInstanceId} |
Ipv4Gateway | acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#Ipv4GatewayId} |
VSwitchCidrReservation | acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId} |
Ipv6Address | acs:vpc:{#regionId}:{#accountId}:ipv6address/{#Ipv6AddressId} |
FlowLog | acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} |
PrefixList | acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} |
Ipv6InternetBandwidth | acs:vpc:{#regionId}:{#accountId}:ipv6internetbandwidth/{#Ipv6InternetBandwidthId} |
RouteEntry | acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}/routeentry/{#RouteEntryId} |
HaVip | acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} |
PublicIpAddressPool | acs:vpc:{#regionId}:{#accountId}:publicipaddresspool/{#PublicIpAddressPoolId} |
TrafficMirrorService | acs:vpc:{#regionId}:{#accountId}:trafficmirrorsessionservice |
VRouter | acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/vrouter/{#VRouterId} |
Ipv6EgressRule | acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/ipv6gateway/{#Ipv6GatewayId}/ipv6egressrule/{#Ipv6EgressRuleId} |
GrantRuleToCen | acs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId}/grantruletocen/{#CenId} |
条件(Condition)
下表是专有网络VPC(VPC)定义的产品级条件关键字,这些条件关键字可以在RAM权限策略语句的
Condition
元素中使用,用来描述授予权限的条件。以下仅列举产品级的条件关键字,阿里云定义的通用条件关键字也同样适用专有网络VPC(VPC)。其中,数据类型决定了您可以使用哪些条件运算符将请求中的值与权限策略语句中的值进行比较。您必须使用与数据类型匹配的条件运算符,否则无法匹配策略语句,授权行为无效。数据类型与条件运算符的对应关系,请参见条件操作类型。
条件关键字 | 描述 | 类型 |
---|---|---|
vpc:PhysicalConnection | 物理专线信息 | String |
vpc:VBR | 边界路由器信息 | String |
vpc:VPC | VPC信息 | String |
vpc:VRouter | 路由器信息 | String |
vpc:tag | VPC的标签 | String |
vpc:TargetAccountRDId | 对端用户资源目录ID信息 | String |