访问控制(RAM)是阿里云提供的管理用户身份与资源访问权限的服务。使用RAM可以让您避免与其他用户共享阿里云账号密钥,并可按需为用户授予最小权限。RAM中使用权限策略描述授权的具体内容。
本文为您介绍专有网络VPC(VPC)为RAM权限策略定义的操作(Action)、资源(Resource)和条件(Condition)。专有网络VPC(VPC)的RAM代码(RamCode)为vpc,支持的授权粒度为RESOURCE。
权限策略通用结构
权限策略支持JSON格式,其通用结构如下:
{
"Version": "1",
"Statement": [
{
"Effect": "<Effect>",
"Action": "<Action>",
"Resource": "<Resource>",
"Condition": {
"<Condition_operator>": {
"<Condition_key>": [
"<Condition_value>"
]
}
}
}
]
}
- Effect:权限策略效果。取值:Allow(允许)、Deny(拒绝)。
- Action:授予允许或拒绝权限的具体操作。具体信息,请参见操作(Action)。
- Resource:受操作影响的具体对象,您可以使用资源ARN来描述指定资源。具体信息,请参见资源(Resource)。
- Condition:指授权生效的条件。可选字段。具体信息,请参见条件(Condition)。
- Condition_operator:条件运算符,不同类型的条件对应不同的条件运算符。具体信息,请参见权限策略基本元素。
- Condition_key:条件关键字。
- Condition_value:条件关键字对应的值。
操作(Action)
下表是专有网络VPC(VPC)定义的操作,这些操作可以在RAM权限策略语句的Action
元素中使用,用来授予执行该操作的权限。下面对表中的具体项提供说明:- 操作:是指具体的权限点。
- API:是指操作对应的API接口。
- 访问级别:是指每个操作的访问级别,取值为写入(Write)、读取(Read)或列出(List)。
- 资源类型:是指操作中支持授权的资源类型。具体说明如下:
- 对于必选的资源类型,用背景高亮的方式表示。
- 对于不支持资源级授权的操作,用
全部资源
表示。
- 条件关键字:是指云产品自身定义的条件关键字。该列不体现适用于任何操作的通用条件关键字。
- 关联操作:是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限,操作才能成功。
操作 | API | 访问级别 | 资源类型 | 条件关键字 | 关联操作 |
---|---|---|---|---|---|
vpc:CreateIpsecServer | CreateIpsecServer | create | 全部资源 * | 无 | 无 |
vpc:DescribeSslVpnClientCert | DescribeSslVpnClientCert | get | SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/{#SslVpnClientCertId} | 无 | 无 |
vpc:ModifySslVpnServer | ModifySslVpnServer | update | SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} | 无 | 无 |
vpc:UpdateIpsecServer | UpdateIpsecServer | update | 全部资源 * | 无 | 无 |
vpc:DeleteIpsecServer | DeleteIpsecServer | delete | IpsecServer acs:vpc:{#regionId}:{#accountId}:vpnipsecserver/{#IpsecServerId} | 无 | 无 |
vpc:DeleteSslVpnClientCert | DeleteSslVpnClientCert | Write | SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/{#SslVpnClientCertId} | 无 | 无 |
vpc:DeleteSslVpnServer | DeleteSslVpnServer | Write | SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} | 无 | 无 |
vpc:CreateSslVpnServer | CreateSslVpnServer | create | SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/*VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId} | 无 | 无 |
vpc:DescribeVpnGateways | DescribeVpnGateways | list | VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/*VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnInstanceId} | 无 | 无 |
vpc:CreateSslVpnClientCert | CreateSslVpnClientCert | create | SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/*SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} | 无 | 无 |
vpc:DescribeVpnGateway | DescribeVpnGateway | get | VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId} | 无 | 无 |
vpc:DescribeSslVpnServers | DescribeSslVpnServers | list | SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/*SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} | 无 | 无 |
vpc:MoveVpnResourceGroup | MoveVpnResourceGroup | update | 全部资源 * | 无 | 无 |
vpc:DescribeSslVpnClientCerts | DescribeSslVpnClientCerts | list | SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/*SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/{#SslVpnClientCertId} | 无 | 无 |
vpc:ModifySslVpnClientCert | ModifySslVpnClientCert | Write | SslVpnClientCert acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/{#SslVpnClientCertId} | 无 | 无 |
vpc:ModifyVpnGatewayAttribute | ModifyVpnGatewayAttribute | update | VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId} | 无 | 无 |
vpc:DescribeVpnSslServerLogs | DescribeVpnSslServerLogs | get | SslVpnServer acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} | 无 | 无 |
vpc:ListIpsecServers | ListIpsecServers | list | 全部资源 * | 无 | 无 |
vpc:DescribeSslVpnClients | DescribeSslVpnClients | list | VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId} | 无 | 无 |
vpc:CreateVpnGateway | CreateVpnGateway | create | VpnGateway acs:vpc:{#regionId}:{#accountId}:vpngateway/* | 无 | 无 |
资源(Resource)
下表是专有网络VPC(VPC)定义的资源,这些资源可以在RAM权限策略语句的Resource
元素中使用,用来授予对该资源执行具体操作的权限。 其中,资源ARN是资源在阿里云上的唯一标识。具体说明如下:{#}
为变量标识,需要您替换为实际值。例如:{#ramcode}
需要您替换为实际的云服务RAM代码。-
*
表示全部。例如:{#resourceType}
为*
时:表示全部资源。{#regionId}
为*
时:表示全部地域。{#accountId}
为*
时:表示全部阿里云账号。
资源类型 | 资源ARN |
---|---|
RouterInterface | acs:vpc:*:{#accountId}:routerinterface/* |
VSwitch | acs:vpc:{#regionid}:{#accountId}:vswitch/* |
TrafficMirrorSession | acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId} |
RouteTable | acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} |
IpsecServer | acs:vpc:{#Region}:{#AccountId}: vpnipsecserver/{#IpsecServerId} |
VpnGateway | acs:vpc:{#Region}:{#AccountId}:vpngateway/{#VpnInstanceId} |
VpnGateway | acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId} |
GatewayEndpoint | acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId} |
VSwitch | acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId} |
Ipv6Translator | acs:vpc:{#regionId}:{#accountId}:ipv6trans/* |
PhysicalConnection | acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId} |
HaVip | acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} |
TrafficQos | acs:vpc:{#regionId}:{#accountId}:TrafficQos/* |
GatewayEndpoint | acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/* |
Instance | acs:ecs:{#regionId}:{#accountId}:instance/{#Instanceid} |
GlobalAccelerationInstance | acs:vpc:{#regionId}:{#accountId}:globalaccelerationinstance/* |
Ipv6Translator | acs:vpc:{#regionId}:{#accountId}:ipv6trans/{#Ipv6TranslatorId} |
RouterInterface | acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId} |
SslVpnClientCert | acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/{#SslVpnClientCertId} |
DhcpOptionsSet | acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId} |
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId} |
PhysicalConnection | acs:vpc:{#regionid}:{#accountid}:physicalconnection/{#PhysicalConnectionId} |
Address | acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId} |
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/* |
SnatEntry | acs:vpc:{#regionId}:{#accountId}:snattable/* |
VirtualBorderRouter | acs:expressconnect:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId} |
CommonBandwidthPackage | acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/* |
FlowLog | acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId} |
NatGateway | acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId} |
VSwitchCidrReservation | acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/* |
GlobalAccelerationInstance | acs:vpc:{#regionId}:{#accountId}:globalaccelerationinstance/{#GlobalAccelerationInstanceId} |
VirtualBorderRouter | acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId} |
VirtualBorderRouter | acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VirtualBorderRouterId} |
VpnConnection | acs:vpc:{#regionId}:{#accountId}:* |
TrafficMirrorFilter | acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId} |
BandwidthPackage | acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#BandwidthPackageId} |
VirtualBorderRouter | acs:vpc:{#regionId}:{#AccountId}:virtualborderrouter/{#VbrId} |
CustomerGateway | acs:vpc:{#regionId}:{#accountId}:customergateway/{#CustomerGatewayId} |
PrefixList | acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId} |
NetworkAcl | acs:vpc:{#regionId}:{#accountId}:networkacl/* |
PublicIpAddressPoolService | acs:vpc:{#regionId}:{#accountId}:publicipaddresspoolservice/* |
VPC | acs:vpc:{#regionId}:{#AccountId}:vpc/{#VpcId} |
VirtualBorderRouter | acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#virtualborderrouterId} |
Ipv6Address | acs:vpc:{#regionId}:{#accountId}:ipv6address/{#Ipv6AddressId} |
Ipv4Gateway | acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#Ipv4GatewayId} |
NatGateway | acs:vpc:{#regionId}:{#accountId}:natgateway/* |
VpnConnection | acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId} |
SnatTable | acs:vpc:{#regionId}:{#accountId}:snattable/{#SnatTableId} |
NetworkAcl | acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId} |
PhysicalConnection | acs:vpc:{#regionId}:{#accountId}:physicalconnection/* |
TrafficMirrorService | acs:vpc:{#regionId}:{#accountId}:trafficmirror/* |
Address | acs:vpc:{#regionId}:{#accountId}:eip/* |
NatGateway | acs:vpc:{#regionId}:{#accountId}:natgateway/{#natgatewayid} |
VpnConnections | acs:vpc:{#regionId}:{#accountId}:vpnconnection/{#VpnConnectionId} |
PhysicalConnection | acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#physicalconnectionId} |
BandwidthPackage | acs:vpc:{#regionId}:{#accountId}:bandwidthpackage/{#BandwidthPackageId} |
Eip | acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId} |
Ipv6Gateway | acs:vpc:{#regionId}:{#accountId}:ipv6gateway/{#Ipv6GatewayId} |
PublicIpAddressPool | acs:vpc:{#regionId}:{#accountId}:publicipaddresspool/{#PublicIpAddressPoolId} |
Ipv6InternetBandwidth | acs:vpc:{#regionId}:{#accountId}:vpc/* |
VpnGateway | acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnInstanceId} |
Ipv4Gateway | acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId} |
SslVpnServer | acs:vpc:{#regionId}:{#accountId}:sslvpnserver/{#SslVpnServerId} |
SegmentAddress | acs:vpc:{#regionId}:{#accountId}:eip/* |
IpsecServer | acs:vpc:{#regionId}:{#accountId}:ipsecserver/* |
ForwardTable | acs:vpc:{#regionId}:{#accountId}:forwardtable/{#ForwardTableId} |
RouteTable | acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId} |
TrafficMirrorSession | acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/* |
IpsecServer | acs:vpc:{#regionId}:{#accountId}:vpnipsecserver/{#IpsecServerId} |
Ipv6InternetBandwidth | acs:vpc:{#regionId}:{#accountId}:ipv6bandwidth/{#Ipv6InternetBandwidthId} |
PhysicalConnection | acs:vpc:{#regionId}:{#AccountId}:physicalconnection/{#PhysicalConnectionId} |
RouterInterface | acs:vpc:{#regionId}:{#AccountId}:routerinterface/{#RouterInterfaceId} |
DhcpOptionsSet | acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/* |
VSwitch | acs:vpc:{#regionId}:{#accountId}:vswitch/{#vswitchId} |
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId} |
TrafficMirrorFilter | acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/* |
CustomerGateway | acs:vpc:{#regionId}:{#accountId}:customergateway/* |
Instance | acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId} |
Ipv6InternetBandwidth | acs:vpc:{#regionId}:{#accountId}:ipv6bandwidth/* |
SslVpnServer | acs:vpc:{#regionId}:{#accountId}:sslvpnserver/* |
BandwidthPackage | acs:vpc:{#regionId}:{#accountId}:bandwidthpackage/* |
RouteEntry | acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId} |
VirtualBorderRouter | acs:vpc:*:{#accountId}:virtualborderrouter/{#VirtualBorderRouterId} |
FlowLogService | acs:vpc:{#regionId}:{#accountId}:flowlog/* |
PublicIpAddressPool | acs:vpc:{#regionId}:{#accountId}:publicipaddresspool/* |
VpnGateway | acs:vpc:{#regionId}:{#accountId}:vpngateway/* |
SslVpnClientCert | acs:vpc:{#regionId}:{#accountId}:sslvpnclientcert/* |
BandwidthPackage | acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/* |
NatIp | acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId} |
VSwitchCidrReservation | acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId} |
GatewayInfo | acs:vpc:{#regionId}:{#accountId}:eip/* |
NatIpCidr | acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId} |
IPv6Translator | acs:vpc:{#regionId}:{#accountId}:ipv6trans/* |
IPv6Translator | acs:vpc:{#regionId}:{#accountId}:ipv6trans/{#IPv6TranslatorId} |
RouteTable | acs:vpc:{#regionId}:{#accountId}:routetable/* |
CustomerGateway | acs:vpc:{#Region}:{#AccountId}:customergateway/{#CustomerGatewayId} |
VpnAttachment | acs:vpc:{#Region}:{#AccountId}:vpnattachment/{#VpnConnectionId} |
VpnConnection | acs:vpc:{#Region}:{#AccountId}:vpnconnection/{#VpnConnectionId} |
SslVpnServer | acs:vpc:{#Region}:{#AccountId}:sslvpnserver/{#SslVpnServerId} |
PrefixList | acs:vpc:{#regionId}:{#accountId}:prefixlist/* |
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/{#vpcId} |
PhysicalConnection | acs:vpc:*:{#accountId}:physicalconnection/{#PhysicalConnectionId} |
VirtualBorderRouter | acs:vpc:*:{#AccountId}:virtualborderrouter/{#VbrId} |
RouterInterface | acs:vpc:*:{#AccountId}:routerinterface/{#RouterInterfaceId} |
Association | acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} |
Instance | acs:ecs:{#regionId}:{#accountId}:instance/* |
Ipv4Gateway | acs:vpc:{#regionId}:{#accountId}:ipv4gateway/* |
RouteTable | acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTable} |
FlowLog | acs:vpc:{#regionId}:{#accountId}:flowlog/* |
RouterInterface | acs:vpc:{#regionId}:{#accountId}:routerinterface/* |
VPC | acs:vpc:{#regionId}:{#accountId}:vpc/{#VPCId} |
VSwitch | acs:vpc:{#regionId}:{#accountId}:vswitch/* |
VirtualBorderRouter | acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/* |
CommonBandwidthPackage | acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#CommonBandwidthPackageId} |
VpnConnection | acs:vpc:{#regionId}:{#accountId}:vpnconnection/* |
Ipv6Address | acs:vpc:{#regionId}:{#accountId}:ipv6address/* |
Ipv6Gateway | acs:vpc:{#regionId}:{#accountId}:ipv6gateway/* |
VirtualBorderRouter | acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#InstanceId} |
GrantRuleToCen | acs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId} |
HaVip | acs:vpc:{#regionId}:{#accountId}:havip/* |
VpnGateway | acs:vpc:{#regionId}:{#accountId}: |
Instance | acs:ecs:{#regionId}:{#accountId}:instance/{#BackendServerId} |
Eip | acs:vpc:{#regionId}:{#accountId}:eip/{#EipId} |
VRouter | acs:vpc:{#regionId}:{#accountId}:vrouter/{#VRouterId} |
Ipv6EgressRule | acs:vpc:{#regionId}:{#accountId}:ipv6gateway/{#Ipv6GatewayId} |
VSwitch | acs:vpc:{#regionid}:{#accountId}:vswitch/{#VSwitchId} |
physicalconnection | acs:vpc:{#regionId}:{#accountId}:physicalconnection/* |
GlobalAccelerationInstance | acs:vpc:{#regionId}:{#accountId}:GlobalAccelerationInstance/* |
VirtualBorderRouter | acs:vpc:{#regionId}:{#AccountId}:virtualborderrouter/* |
FullNat | acs:vpc:{#regionId}:{#accountId}:vpcfullnattable/{#FullNatTableId} |
SegmentAddress | acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId} |
Instance | acs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId} |
VRouter | acs:vpc:{#regionId}:{#accountId}:vrouter/* |
条件(Condition)
下表是专有网络VPC(VPC)定义的产品级条件关键字,这些条件关键字可以在RAM权限策略语句的
Condition
元素中使用,用来描述授予权限的条件。以下仅列举产品级的条件关键字,阿里云定义的通用条件关键字也同样适用专有网络VPC(VPC)。其中,数据类型决定了您可以使用哪些条件运算符将请求中的值与权限策略语句中的值进行比较。您必须使用与数据类型匹配的条件运算符,否则无法匹配策略语句,授权行为无效。数据类型与条件运算符的对应关系,请参见条件操作类型。
条件关键字 | 描述 | 类型 |
---|---|---|
vpc:PhysicalConnection | 物理专线信息 | String |
vpc:VBR | 边界路由器信息 | String |
vpc:VPC | VPC信息 | String |
vpc:VRouter | 路由器信息 | String |
vpc:tag | VPC的标签 | String |
vpc:TargetAccountRDId | 对端用户资源目录ID信息 | String |