Perform access control based on RAM policies

Procedure

1. Create a RAM user. For more information, see Create a RAM user.
2. Select the permission policies that you want to attach to the RAM user.
   Permission policies consist of system policies and custom policies.

   • System policies: the default permission policies that are provided by Alibaba Cloud. The following system policies are commonly used in Apsara File Storage NAS:
     • AliyunNASFullAccess: authorizes a RAM user to manage NAS file systems
     • AliyunNASReadOnlyAccess: authorizes a RAM user to view NAS file systems
   • Custom policies: the permission policies that are customized. Custom policies allow you to manage permissions in a more fine-grained and flexible manner.

     You can create custom policies by writing scripts based on your business requirements. The following examples are used for reference. For more information, see Create a custom policy.

3. Grant permissions to the RAM user.

   Attach the permission policies selected in Step 2. For more information, see Grant permissions to a RAM user.

Example 1: Grant a RAM user the permissions on a file system

• The following sample code shows how to grant a RAM user full access permissions on the file system whose ID is 07d****294:
  Note You cannot grant a RAM user the permissions to view a single file system. If you want to grant a RAM user full access permissions on a single file system, grant the RAM user the permissions to view all file systems. Then, grant the RAM user the permissions to delete and modify a single file system.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:*"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "nas:CreateMountTarget",
              "Resource": [
                  "acs:vpc:*:*:vswitch/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "cms:Describe*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "nas:DescribeFileSystems",
              "Resource": "*"
          }
      ],
      "Version": "1"
  }

• The following sample code shows how to authorize a RAM user to modify the file system whose ID is 07d****294:

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": [
              "nas:DescribeFileSystems",
              "nas:ModifyFileSystem"
          ],
          "Resource": "acs:nas:*:*:filesystem/07d****294"
      }],
      "Version": "1"
  }

• The following sample code shows how to authorize the RAM user to view all the file systems:

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": "nas:DescribeFileSystems",
          "Resource": "*"
      }],
      "Version": "1"
  }

Example 2: Grant a RAM user the permissions on the mount targets of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateMountTarget",
            "nas:DescribeMountTargets",
            "nas:ModifyMountTarget",
            "nas:DeleteMountTarget"
        ],
        "Resource": [
            "acs:nas:*:*:filesystem/07d****294",
            "acs:vpc:*:*:vswitch/*"
        ]
    }],
    "Version": "1"
}

Example 3: Grant a RAM user the permissions on the permission groups of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateAccessGroup",
            "nas:DescribeAccessGroups",
            "nas:ModifyAccessGroup",
            "nas:DeleteAccessGroup",
            "nas:CreateAccessRule",
            "nas:DescribeAccessRules",
            "nas:ModifyAccessRule",
            "nas:DeleteAccessRule"
        ],
        "Resource": "acs:nas:*:*:accessgroup/*"
    }],
    "Version": "1"
}

Example 4: Grant a RAM user the permissions to view the monitoring metrics of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": "cms:Describe*",
        "Resource": "*"
    }],
    "Version": "1"
}

Authentication list of custom policies

FAQ

• Why is Resource Access Management (RAM) authorization required when I create a mount target in the classic network?
• How can I obtain an AccessKey pair?