Create a custom policy

Procedure

1. Log on to the RAM console by using your Alibaba Cloud account.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the Create Custom Policy page, specify the Policy Name and Note parameters.
5. In the Configuration Mode section, select Script.
6. In the Policy Document section, select an existing system policy and modify the policy document.
   

   Note You can enter a keyword in the search box to perform a fuzzy search.

   Enter a script for the permission that you want to grant. Examples:

   • Permission to access the virtual private clouds (VPCs) that belong to your Alibaba Cloud account

     "elasticsearch:DescribeVpcs","elasticsearch:DescribeVSwitches"

     Note For more information about the related policy document, see the document of the AliyunVPCReadOnlyAccess policy.
   • Permission to pay for orders

     ["bss:PayOrder"] 

     Note For more information about the related policy document, see the document of the AliyunBSSOrderAccess policy.
   • Permission to call API operations

     Method	URI	Resource	Action
     GET	/instances	instances/*	ListInstance
     POST	/instances	instances/*	CreateInstance
     GET	/instances/instanceId	instances/instanceId	DescribeInstance
     DELETE	/instances/instanceId	instances/instanceId	DeleteInstance
     POST	/instances/instanceId/actions/restart	instances/instanceId	RestartInstance
     PUT	/instances/instanceId	instances/instanceId	UpdateInstance

   For more information about the related policy document, see Policy examples.

7. Click OK.

Policy examples

• Policy for an administrator
  In this example, all the operation permissions on all Elasticsearch clusters are granted to a RAM user of the Alibaba Cloud account whose ID is 133071096032****.

  {
      "Statement": [
          {
              "Action": [
                  "elasticsearch:*"
              ],
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": [
                  "cms:*"
              ],
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "bss:PayOrder",
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": "ram:CreateServiceLinkedRole",
              "Resource": "*",
              "Effect": "Allow",
              "Condition": {
                  "StringEquals": {
                      "ram:ServiceName": [
                          "collector.elasticsearch.aliyuncs.com"
                      ]
                  }
              }
          }
      ],
      "Version": "1"
  }

• Policy for operation permissions on a specific cluster
  In this example, the following permissions are granted to a RAM user of the Alibaba Cloud account whose ID is 133071096032****:

  • Permissions on CloudMonitor
  • Permission to perform all Elasticsearch-related operations on a specific cluster
  • Permission to view clusters
  • Permission to view all the tags that are added to clusters
  • Permission to view shippers

  Note External interfaces that are used to call some services, such as Beats, Advanced Monitoring and Alerting, and Tag, are integrated into the cluster management page of the Elasticsearch console. Therefore, when you grant the permissions on a specific cluster, you must refer to the following sample policy document.

  {
      "Statement": [
          {
              "Action": [
                  "elasticsearch:*"
              ],
              "Effect": "Allow",
              "Resource": "acs:elasticsearch:*:133071096032****:instances/es-cn-2r42b7uyg003k****"
          },
          {
              "Action": [
                  "cms:DescribeActiveMetricRuleList",
                  "cms:ListAlarm",
                  "cms:QueryMetricList"
              ],
              "Effect": "Allow",
              "Resource": "*"
          },
          {
              "Action": [
                  "elasticsearch:ListTags"
              ],
              "Effect": "Allow",
              "Resource": "acs:elasticsearch:*:133071096032****:tags/*"
          },
          {
              "Action": [
                  "elasticsearch:ListInstance",
                  "elasticsearch:ListSnapshotReposByInstanceId"
              ],
              "Effect": "Allow",
              "Resource": "acs:elasticsearch:*:133071096032****:instances/*"
          },
          {
              "Action": [
                  "elasticsearch:ListLogstash"
              ],
              "Effect": "Allow",
              "Resource": "acs:elasticsearch:*:133071096032****:logstashes/*"
          }, 
          {
              "Action": [
                  "elasticsearch:ListCollectors"
              ],
              "Effect": "Allow",
              "Resource": "acs:elasticsearch:*:133071096032****:collectors/*"
          }
      ],
      "Version": "1"
  }

[
  "cms:DescribeActiveMetricRuleList",
  "cms:ListAlarm",
  "cms:QueryMetricList"
]

"bss:PayOrder"

[
  "elasticsearch:DescribeVpcs",
  "elasticsearch:DescribeVSwitches"
]

[
  "elasticsearch:*"
]

[
  "elasticsearch:ListTags"
]

[
  "elasticsearch:ListInstance",
  "elasticsearch:ListSnapshotReposByInstanceId" 
]

[
  "elasticsearch:ListCollectors"
]

[
  "elasticsearch:ListLogstash"
]