Perform access control based on RAM policies

Attach a custom policy to a RAM user

By default, a RAM user or group has no permissions. You must grant permissions to the RAM user or group before the RAM user or group can be used to perform operations in the console or call API operations.

1. Create a custom policy based on the scenarios in the following sections. For more information about how to create a custom policy, see Create a custom policy.
2. In the left-side navigation pane, choose Identities > Users.
3. Find the RAM user in the User Logon Name/Display Name column and click Add Permissions in the Actions column.
4. In the Add Permissions panel, the Principal field is automatically filled.
5. In the Select Policy section, click the policy name that you want to attach to the RAM user in the Authorization Policy Name column.
   Note In the Selected section, you can click the cross sign (×) next to the policy name to remove the policy.
6. Click OK.
7. Click Complete.

Example 1: Grant the permissions on a file system to the RAM user

• The following sample code shows how to authorize the RAM user to modify a file system:

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": [
              "nas:DescribeFileSystems",
              "nas:ModifyFileSystem"
          ],
          "Resource": "acs:nas:*:*:filesystem/07d0b4****"
      }],
      "Version": "1"
  }

• The following sample code shows how to authorize the RAM user to view all the file systems:

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": "nas:DescribeFileSystems",
          "Resource": "*"
      }],
      "Version": "1"
  }

• The following sample code shows how to grant the RAM user full access to a file system:

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:*"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d0b4****"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "nas:CreateMountTarget",
              "Resource": [
                  "acs:vpc:*:*:vswitch/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "cms:Describe*",
              "Resource": "*"
          }
      ],
      "Version": "1"
  }

Example 2: Grant the permissions on the mount targets of a file system to the RAM user

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateMountTarget",
            "nas:DescribeMountTargets",
            "nas:ModifyMountTarget",
            "nas:DeleteMountTarget"
        ],
        "Resource": [
            "acs:nas:*:*:filesystem/07d0b4****",
            "acs:vpc:*:*:vswitch/*"
        ]
    }],
    "Version": "1"
}

Example 3: Grant the permissions on the permission groups of a file system to the RAM user

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateAccessGroup",
            "nas:DescribeAccessGroups",
            "nas:ModifyAccessGroup",
            "nas:DeleteAccessGroup",
            "nas:CreateAccessRule",
            "nas:DescribeAccessRules",
            "nas:ModifyAccessRule",
            "nas:DeleteAccessRule"
        ],
        "Resource": "acs:nas:*:*:accessgroup/*"
    }],
    "Version": "1"
}

Example 4: Grant the permissions to view the metrics of a file system to the RAM user

{
    "Statement": [{
        "Effect": "Allow",
        "Action": "cms:Describe*",
        "Resource": "*"
    }],
    "Version": "1"
}

Authentication list