Alibaba Cloud provides Resource Access Management (RAM) for you to manage permissions for Function Compute. When you use RAM, you do not need to share the AccessKey pair of your Alibaba Cloud account with other users. Instead, you can grant them only the minimal required permissions. An AccessKey pair includes an AccessKey ID and an AccessKey secret. This topic describes the policies for Function Compute, including system policies and custom policies. This topic also provides sample custom policies.

Policy types

In RAM, a policy is a set of permissions that are described based on the policy syntax and structure. A policy accurately describes the authorized resource set, action set, and authorization conditions. The policies for Function Compute include the following types:
  • System policies: the policies that are created by Alibaba Cloud. You can use these policies, but cannot modify them. Alibaba Cloud maintains the version updates of the policies.
  • Custom policies: the policies that you can create, update, and delete. You maintain the version updates of these policies.

System policies

Before you log on to the Function Compute console as a RAM user for the first time, you must attach a system policy for accessing Function Compute and system policies for accessing other Alibaba Cloud services to the RAM user by using your Alibaba Cloud account. You can access Alibaba Cloud services including Function Compute as the RAM user only after the system policies are attached to the RAM user.

The system policies include the following types:
  • System policies for Function Compute
    Policy Description
    AliyunFCReadOnlyAccess The read-only permissions on all Function Compute resources.
    AliyunFCInvocationAccess The permissions to invoke all functions.
    AliyunFCFullAccess The permissions to manage all Function Compute resources.
    Note The permissions to manage all Function Compute resources defined in the AliyunFCFullAccess policy include the permissions to invoke all functions defined in the AliyunFCInvocationAccess policy and the read-only permissions on all Function Compute resources defined in the AliyunFCReadOnlyAccess policy. After you attach the AliyunFCFullAccess policy to a RAM user, you do not need to attach the AliyunFCInvocationAccess or AliyunFCReadOnlyAccess policy to the RAM user.
  • System policies for other Alibaba Cloud services
    Alibaba Cloud service System policy
    Log Service
    • AliyunLogReadOnlyAccess: the read-only permissions on all Log Service resources.
    • AliyunLogFullAccess: the permissions to manage all Log Service resources.
    Note To access Log Service as a RAM user, you need to attach only the AliyunLogReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Object Storage Service (OSS)
    • AliyunOSSReadOnlyAccess: the read-only permissions on all OSS resources.
    • AliyunOSSFullAccess: the permissions to manage all OSS resources.
    CloudMonitor AliyunCloudMonitorReadOnlyAccess: the read-only permissions on all CloudMonitor resources.
    SSL Certificates Service AliyunYundunCertReadOnlyAccess: the read-only permissions on all SSL Certificates Service resources.
    Virtual Private Cloud (VPC) AliyunVPCReadOnlyAccess: the read-only permissions on all VPC resources.
    Elastic Compute Service (ECS) AliyunECSReadOnlyAccess: the read-only permissions on all ECS resources.
    RAM
    • AliyunRAMReadOnlyAccess: the read-only permissions on all RAM resources, including the permissions to view users, groups, and authorization information.
    • AliyunRAMFullAccess: the permissions to manage all RAM resources, including the permissions to manage users and grant permissions.
    Note If you attach only the AliyunRAMReadOnlyAccess policy to a RAM user, you can only obtain the list of roles in the console as the RAM user. If you need to perform other operations as the RAM user, you must attach the AliyunRAMFullAccess policy to the RAM user.
    Application Real-Time Monitoring Service (ARMS)
    • AliyunARMSReadOnlyAccess: the read-only permissions on all ARMS resources.
    • AliyunARMSFullAccess: the permissions to manage all ARMS resources.
    Note To access ARMS as a RAM user, you need to attach only the AliyunARMSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Message Service (MNS)
    • AliyunMNSReadOnlyAccess: the read-only permissions on all MNS resources.
    • AliyunMNSFullAccess: the permissions to manage all MNS resources.
    Note To access MNS as a RAM user, you need to attach only the AliyunMNSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    EventBridge
    • AliyunEventBridgeReadOnlyAccess: the read-only permissions on all EventBridge resources.
    • AliyunEventBridgeFullAccess: the permissions to manage all EventBridge resources.
    Note To access EventBridge as a RAM user, you need to attach only the AliyunEventBridgeReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Message Queue for Apache RocketMQ
    • AliyunMQReadOnlyAccess: the read-only permissions on all Message Queue for Apache RocketMQ resources.
    • AliyunMQFullAccess: the permissions to manage all Message Queue for Apache RocketMQ resources.
    Note To access Message Queue for Apache RocketMQ as a RAM user, you need to attach only the AliyunMQReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Container Registry
    • AliyunContainerRegistryReadOnlyAccess: the read-only permissions on all Container Registry resources.
    • AliyunContainerRegistryFullAccess: the permissions to manage all Container Registry resources.
    Note To access Container Registry as a RAM user, you need to attach only the AliyunContainerRegistryReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Apsara File Storage NAS
    • AliyunNASReadOnlyAccess: the read-only permissions on all NAS resources.
    • AliyunNASFullAccess: the permissions to manage all NAS resources.
    Note To access NAS as a RAM user, you need to attach only the AliyunNASReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    ApsaraDB RDS
    • AliyunRDSReadOnlyAccess: the read-only permissions on all ApsaraDB RDS resources.
    • AliyunRDSFullAccess: the permissions to manage all ApsaraDB RDS resources.
    Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
    Apsara Devops AliyunRDCDevStudioRole: the permissions to create Apsara Devops accounts and initialize Apsara Devops organization workspaces.
Notice If you cannot update OSS event triggers as a RAM user after you grant permissions related to triggers, for example, attach the AliyunOSSFullAccess policy to the RAM user by using an Alibaba Cloud account, attach the following custom policy to the RAM user by using the Alibaba Cloud account. After the custom policy is attached, you can update the OSS event triggers as the RAM user.
 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }

Custom policies

In addition to the system policies, Function Compute supports custom policies that allow you to grant fine-grained permissions to RAM users. For more information about the elements of a policy, see Policy elements.

Resource Action Description
acs:fc:<region>:<account-id>:services/<serviceName> fc:GetService The specified service.
fc:UpdateService
fc:DeleteService
acs:fc:<region>:<account-id>:services/* fc:CreateService All services.
fc:ListServices
acs:fc:<region>:<account-id>:services/<serviceName>.<qualifier> fc:GetService The service of a specified version.
acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName> fc:GetFunction The specified function in a specified service.
fc:UpdateFunction
fc:DeleteFunction
fc:InvokeFunction
acs:fc:<region>:<account-id>:services/<serviceName>/functions/* fc:CreateFunction All functions in a specified service.
fc:ListFunctions
acs:fc:<region>:<account-id>:services/<serviceName>.*/functions/<functionName> fc:GetFunction All functions in all versions of a specified service.
fc:UpdateFunction
fc:DeleteFunction
fc:InvokeFunction
fc:PutProvisionConfig
fc:GetProvisionConfig
fc:PutFunctionOnDemandConfig
fc:DeleteFunctionOnDemandConfig
fc:PutFunctionAsyncInvokeConfig
fc:DeleteFunctionAsyncInvokeConfig
fc:GetFunctionAsyncInvokeConfig
fc:GetFunctionOnDemandConfig
acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/triggers/<triggerName> fc:GetTrigger The specified trigger of a specified function in a specified service.
fc:UpdateTrigger
fc:DeleteTrigger
acs:fc:<region>:<account-id>:services/<serviceName>/functions/<functionName>/triggers/* fc:CreateTrigger All triggers of a specified function in a specified service.
fc:ListTriggers
acs:fc:<region>:<account-id>:services/<serviceName>/versions fc:PublishServiceVersion All service versions.
fc:ListServiceVersions
acs:fc:<region>:<account-id>:services/<serviceName>/versions/<versionID> fc:DeleteServiceVersion The specified service version.
acs:fc:<region>:<account-id>:services/<serviceName>/aliases/* fc:CreateAlias All service aliases.
fc:ListAliases
acs:fc:<region>:<account-id>:services/<serviceName>/aliases/<aliasName> fc:GetAlias The specified service alias.
fc:UpdateAlias
fc:DeleteAlias
acs:fc:<region>:<account-id>:custom-domains/* fc:CreateCustomDomain All custom domain names.
fc:ListCustomDomains
acs:fc:<region>:<account-id>:custom-domains/<domainName> fc:GetCustomDomain The specified custom domain name.
fc:UpdateCustomDomain
fc:DeleteCustomDomain
acs:fc:<region>:<account-id>:tag fc:TagResource A single tag.
fc:GetResourceTags
fc:UnTagResource
acs:fc:<region>:<account-id>:tags/* fc:ListTaggedResources All tags.
acs:fc:<region>:<account-id>:account-settings/* fc:GetAccountSettings The settings of your account.
acs:fc:<region>:<account-id>:layerarn/:arn fc:GetLayerVersionByArn All layers.
acs:fc:<region>:<account-id>:layers/* fc:ListLayers
acs:fc:<region>:<account-id>:layers/:layerName/versions/:version fc:PublishLayerAsPublic
acs:fc:<region>:<account-id>:layers/:layerName/versions/* fc:ListLayerVersions All layer versions.
fc:CreateLayerVersion
acs:fc:<region>:<account-id>:layers/:layerName/versions/:version fc:GetLayerVersion
fc:DeleteLayerVersion
acs:fc:<region>:<account-id>:on-demand-configs/* fc:ListOnDemandConfigs The on-demand configurations.
acs:fc:<region>:<account-id>:provision-configs/* fc:ListProvisionConfigs The provisioned configurations.
acs:fc:<region>:<account-id>:services/:serviceName/binding fc:DeleteVpcBinding The VPC configuration.
acs:fc:<region>:<account-id>:services/:serviceName/binding/* fc:CreateVpcBinding
fc:ListVpcBindings
acs:fc:<region>:<account-id>:services/:serviceName/functions/:functionName/async-invoke-configs/* fc:ListFunctionAsyncInvokeConfigs The asynchronous invocation configurations.
acs:fc:<region>:<account-id>:services/:serviceName/functions/:functionName/code fc:GetFunctionCode All function code.
acs:fc:<region>:<account-id>:services/:serviceName/functions/:functionName/stateful-async-invocations/* fc:ListStatefulAsyncInvocations Stateful asynchronous invocations.
acs:fc:<region>:<account-id>:services/:serviceName/functions/:functionName/stateful-async-invocations/:invocationId fc:GetStatefulAsyncInvocation
fc:StopStatefulAsyncInvocation
You can use the preceding actions and resources to define the following custom policy that is used to grant the permissions to invoke the demo function in the test service in the China (Hangzhou) region.
{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:services/test/functions/demo",
            "Effect": "Allow"
        }
    ]
}

Sample custom policies

Custom policy used to grant the permissions to create and query services, and create and invoke functions

{
    "Version":"1",
    "Statement":[
        {
            "Action":[
                "fc:CreateService",
                "fc:GetService",
                "fc:CreateFunction",
                "fc:GetFunction",
                "fc:InvokeFunction"
            ],
            "Resource":"*",
            "Effect":"Allow"
        },
        {
            "Action":[
                "ram:PassRole"
            ],
            "Effect":"Allow",
            "Resource":"*"
        }
    ]
}

Custom policy used to grant the permissions to access logs

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "log:ListProject",
                "log:ListLogStore"
            ],
            "Resource": "acs:log:*:*:project/*"
        }
    ]
}

Custom policy used to grant the permissions to access OSS event triggers

{
  "Statement": [
    {
      "Action": [
        "oss:ListBucket",
        "oss:GetBucketEventNotification",
        "oss:PutBucketEventNotification",
        "oss:DeleteBucketEventNotification"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}