Perform access control based on RAM policies

Procedure

1. Create a RAM user. For more information, see Create a RAM user.
2. Select the permission policies that you want to grant to the RAM user.
   Permission policies consist of system policies and custom policies.

   • System policies: the default permission policies that are provided by Alibaba Cloud. The following system policies are commonly used in Apsara File Storage NAS:
     • AliyunNASFullAccess (not recommended): grants a RAM user full access to a NAS file system. Granting this permission to a RAM user is highly risky and is not recommended.
     • AliyunNASReadOnlyAccess: grants a RAM user the read-only permission on a NAS file system.
   • Custom policies: the permission policies that are customized. Custom policies allow you to manage permissions in a more fine-grained and flexible manner.

     You can create custom policies by writing scripts based on your business requirements. The following examples are used for reference. For more information, see Create a custom policy.

3. Grant permissions to the RAM user.

   Attach the permission policies selected in Step 2. For more information, see Grant permissions to a RAM user.

Example 1: Grant a RAM user the permissions on a file system

• The following sample code shows how to grant a RAM user full access to the file system whose ID is 07d****294.
  Note You cannot grant a RAM user the permissions to view a single file system. If you want to grant a RAM user full access to a single file system, grant the RAM user the permissions to view all file systems. Then, grant the RAM user the permissions to delete and modify a single file system.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:*"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "nas:CreateMountTarget",
              "Resource": [
                  "acs:vpc:*:*:vswitch/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "cms:Describe*",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": "nas:DescribeFileSystems",
              "Resource": "*"
          }
      ],
      "Version": "1"
  }

• The following sample code shows how to grant a RAM user the permissions to modify the file system whose ID is 07d****294.

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": [
              "nas:DescribeFileSystems",
              "nas:ModifyFileSystem"
          ],
          "Resource": "acs:nas:*:*:filesystem/07d****294"
      }],
      "Version": "1"
  }

• The following sample code shows how to grant the RAM user the permissions to view all the file systems:

  {
      "Statement": [{
          "Effect": "Allow",
          "Action": "nas:DescribeFileSystems",
          "Resource": "*"
      }],
      "Version": "1"
  }

Example 2: Grant a RAM user the permissions on the mount targets of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateMountTarget",
            "nas:DescribeMountTargets",
            "nas:ModifyMountTarget",
            "nas:DeleteMountTarget"
        ],
        "Resource": [
            "acs:nas:*:*:filesystem/07d****294",
            "acs:vpc:*:*:vswitch/*"
        ]
    }],
    "Version": "1"
}

Example 3: Grant a RAM user the permissions on the permission groups of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "nas:CreateAccessGroup",
            "nas:DescribeAccessGroups",
            "nas:ModifyAccessGroup",
            "nas:DeleteAccessGroup",
            "nas:CreateAccessRule",
            "nas:DescribeAccessRules",
            "nas:ModifyAccessRule",
            "nas:DeleteAccessRule"
        ],
        "Resource": "acs:nas:*:*:accessgroup/*"
    }],
    "Version": "1"
}

Example 4: Grant a RAM user the permissions to view the monitoring metrics of a file system

{
    "Statement": [{
        "Effect": "Allow",
        "Action": "cms:Describe*",
        "Resource": "*"
    }],
    "Version": "1"
}

Example 5: Grant a RAM user the permissions to manage the recycle bin of a file system

• The following sample code shows how to grant a RAM user full access to the recycle bin of the file system whose ID is 07d****294.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:EnableRecycleBin",
                  "nas:DisableAndCleanRecycleBin ",
                  "nas:UpdateRecycleBinAttribute",
                  "nas:GetRecycleBinAttribute",
                  "nas:CreateRecycleBinRestoreJob",
                  "nas:CreateRecycleBinDeleteJob",
                  "nas:CancelRecycleBinJob",
                  "nas:ListRecycleBinJobs",
                  "nas:ListRecycledDirectoriesAndFiles",
                  "nas:ListRecentlyRecycledDirectories"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          }
      ],
      "Version": "1"
  }

• The following sample code shows how to grant a RAM user the permissions to restore files temporarily stored in the recycle bin of the file system whose ID is 07d****294.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:GetRecycleBinAttribute",
                  "nas:CreateRecycleBinRestoreJob",
                  "nas:CancelRecycleBinJob",
                  "nas:ListRecycleBinJobs",
                  "nas:ListRecycledDirectoriesAndFiles",
                  "nas:ListRecentlyRecycledDirectories"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          }
      ],
      "Version": "1"
  }

• The following sample code shows how to grant a RAM user the permissions to permanently delete files from the recycle bin of the file system whose ID is 07d****294.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:GetRecycleBinAttribute",
                  "nas:CreateRecycleBinDeleteJob",
                  "nas:CancelRecycleBinJob",
                  "nas:ListRecycleBinJobs",
                  "nas:ListRecycledDirectoriesAndFiles",
                  "nas:ListRecentlyRecycledDirectories"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          }
      ],
      "Version": "1"
  }

• The following sample code shows how to grant a RAM user the permissions to modify the configurations for the recycle bin of the file system whose ID is 07d****294.

  {
      "Statement": [{
              "Effect": "Allow",
              "Action": [
                  "nas:EnableRecycleBin",
                  "nas:UpdateRecycleBinAttribute",
                  "nas:DisableAndCleanRecycleBin",
                  "nas:GetRecycleBinAttribute"
              ],
              "Resource": [
                  "acs:nas:*:*:filesystem/07d****294"
              ]
          }
      ],
      "Version": "1"
  }

Authentication list of custom policies

FAQ

• Why do I need to use Resource Access Management (RAM) to grant required permissions when I create a mount target in the classic network?
• How can I obtain an AccessKey pair?