RAM authorization

Resource authorization

By default, a RAM user account is not authorized to call Alibaba Cloud APIs to create or modify cloud resources. Before using a RAM user account to call an API, you must grant the RAM user account the corresponding permission to call the API by creating an authorization policy and attaching the policy to the RAM user account.

When creating the authorization policy, you can specify the resource to authorize by its Alibaba Resource Name (ARN). An ARN is used to identify the resource to authorize.

The ARN format is as follows:

acs:service-name:region:account-id:resource-relative-id

where:

• acs: the abbreviation for Alibaba Cloud Service.
• service-name: the name of an Alibaba Cloud service, such as ecs, oss, and ros.

• region: the region where the service resides. If this option is not supported, use the asterisk (*) wildcard instead.

• account-id: the ID of the user account, such as 1234567890123456.

• resource-relative-id: the specific description of a resource. The description varies by service. For more information, see the documentation of each service.

  For example, acs:oss:1234567890123456:sample_bucket/file1.txt indicates a resource named sample_bucket/file1.txt in Alibaba Could OSS and 1234567890123456 is the ID of the user account to which the resource belongs.

Types of ROS resources that can be authorized

ROS API operations that can be authorized

The following table lists ROS API operations that can be authorized and their corresponding ARN formats.