Create a custom policy

This topic describes how to create a custom policy in Elasticsearch. Custom policies enable finer-grained access control than system policies.

1. Log on to the RAM console by using an Alibaba Cloud account.
2. In the left-side navigation pane, click Policies under Permissions.
3. On the page that appears, click Create Policy.
4. On the Create Custom Policy page, specify the Policy Name and Note parameters.
5. Under Configuration Mode, select Script.
6. In the Policy Document section, select an existing system policy and edit the script.
   

   Note You can enter keywords into the search box to perform fuzzy search.

   Enter a permission script as required.

   • Permission to access the Virtual Private Cloud (VPC) to which the Elasticsearch cluster belongs

     "vpc:DescribeVSwitch*","vpc:DescribeVpc*"

     Note For more information, see the template for the AliyunVPCReadOnlyAccess policy.
   • Permission to purchase clusters

     ["bss:PayOrder"] 

     Note For more information, see the template for the AliyunBSSOrderAccess policy.
   • Permission to call API operations

     Method	URI	Resource	Operation
     GET	/instances	instances/*	ListInstance
     POST	/instances	instances/*	CreateInstance
     GET	/instances/$instanceId	instances/$instanceId	DescribeInstance
     DELETE	/instances/$instanceId	instances/$instanceId	DeleteInstance
     POST	/instances/$instanceId/actions/restart	instances/$instanceId	RestartInstance
     PUT	/instances/$instanceId	instances/$instanceId	UpdateInstance

     Examples:

     Notice If tags are bound to your Elasticsearch cluster, you must grant operation permissions on the tags to RAM users. For more information, see Grant permissions on tags to a RAM user.

     • In the following example, a RAM user of the Alibaba Cloud account whose account ID is 1234 is granted the operation permissions (except the cluster creation permission) on all Elasticsearch clusters in the China (Hangzhou) region. In addition, the policy allows only specified IP addresses to access the clusters.

       {
         "Statement": [
           {
             "Action": [
               "elasticsearch:ListInstance",
               "elasticsearch:DescribeInstance",
               "elasticsearch:DeleteInstance",
               "elasticsearch:RestartInstance",
               "elasticsearch:UpdateInstance"
             ],
             "Condition": {
               "IpAddress": {
                 "acs:SourceIp": "xxx.xx.xxx.x/xx"
               }
             },
             "Effect": "Allow",
             "Resource": "acs:elasticsearch:cn-hangzhou:1234:instances/*"
           }
         ],
         "Version": "1"
       }

     • In the following example, a RAM user of the Alibaba Cloud account whose account ID is 1234 is granted the operation permissions (except the cluster creation permission) on specified Elasticsearch clusters in the China (Hangzhou) region. In addition, the policy allows only specified IP addresses to access the clusters.

       {
         "Statement": [
           {
             "Action": [
               "elasticsearch:ListInstance"
             ],
             "Condition": {
               "IpAddress": {
                 "acs:SourceIp": "xxx.xx.xxx.x/xx"
               }
             },
             "Effect": "Allow",
             "Resource": "acs:elasticsearch:cn-hangzhou:1234:instances/*"
           },
           {
             "Action": [
               "elasticsearch:DescribeInstance",
               "elasticsearch:DeleteInstance",
               "elasticsearch:RestartInstance",
               "elasticsearch:UpdateInstance"
             ],
             "Condition": {
               "IpAddress": {
                 "acs:SourceIp": "xxx.xx.xxx.x/xx"
               }
             },
             "Effect": "Allow",
             "Resource": "acs:elasticsearch:cn-hangzhou:1234:instances/$instanceId"
           }
         ],
         "Version": "1"
       }

     • In the following example, a RAM user of the Alibaba Cloud account whose account ID is 1234 is granted all the operation permissions on Elasticsearch clusters in all regions.

       {
         "Statement": [
           {
             "Action": [
                 "elasticsearch:*"
                   ],
             "Effect": "Allow",
             "Resource": "acs:elasticsearch:*:1234:instances/*"
           }
         ],
         "Version": "1"
       }

     • In the following example, a RAM user of the Alibaba Cloud account whose account ID is 1234 is granted the operation permissions (except the cluster creation and query permissions) on Elasticsearch clusters in all regions.

       {
         "Statement": [
           {
             "Action": [
                 "elasticsearch:DescribeInstance",
                 "elasticsearch:DeleteInstance",
                 "elasticsearch:UpdateInstance",
                 "elasticsearch:RestartInstance"
                   ],
             "Effect": "Allow",
             "Resource": "acs:elasticsearch:*:1234:instances/$instanceId"
           }
         ],
         "Version": "1"
       }

7. Click OK.