Tablestore:Create a custom policy

Single API operation

"Action": "ots:GetRow"                    

Multiple APIs

"Action": [
"ots:PutRow",
"ots:GetRow"
]                  

All read-only API operations

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ots:BatchGet*",
        "ots:Describe*",
        "ots:Get*",
        "ots:List*",
        "ots:Consume*",
        "ots:Search",
        "ots:ComputeSplitPointsBySize"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}                

All read and write API operations

"Action": "ots:*"               

All SQL-related API operations

"Action": "ots:SQL*"

Accessible Resources for Management APIs

Management APIs handle instance-level operations and are called from the console or using OpenAPI. The acs:ots:[region]:[user_id]: prefix is omitted from the resources described below. Only the instance is specified.

Resources accessed by data APIs

Table operations and data read/write operations act on tables and rows and can be called from the Tablestore console or using Tablestore SDKs. If you specify the Action and Resource elements for these operations, some features may become unavailable in the Tablestore console. The acs:ots:[region]:[user_id]: prefix is omitted from the resource names below. Only the instance and table are specified.

Resources for Tunnel API access

Tunnel Service operations handle tunnel-related tasks and can be called from the Tablestore console or using Tablestore SDKs. If you specify the Action and Resource elements for these operations, some features may become unavailable in the Tablestore console. The acs:ots:[region]:[user_id]: prefix is omitted from the resource names below. Only the instance and table are specified.

IP address-based access control

You can create an IP address whitelist to specify the IP addresses or CIDR blocks allowed to access Tablestore resources. This method is suitable for the following scenarios:

• Restrict access from multiple IP addresses.

  The following example shows how to allow requests only from the IP addresses 10.10.XX.XX and 10.11.XX.XX to access Tablestore resources:

  {
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "ots:*",
          "Resource": "acs:ots:*:*:*",
          "Condition": {
              "IpAddress": {
                  "acs:SourceIp": [
                      "10.10.XX.XX",
                      "10.11.XX.XX"
                  ]
              }
          }
      }
  ],
  "Version": "1"
  }                           

• You can restrict individual IP addresses and CIDR blocks.

  The following example shows how to allow requests only from the IP address 10.10.XX.XX or the CIDR block 10.10.XX.XX/24 to access Tablestore resources:

  {
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "ots:*",
          "Resource": "acs:ots:*:*:*",
          "Condition": {
              "IpAddress": {
                  "acs:SourceIp": [
                      "10.10.XX.XX",
                      "10.10.XX.XX/24"
                  ]
              }
          }
      }
  ],
  "Version": "1"
  }                            

HTTPS-based access control

You can use a custom policy to require that access to Tablestore occurs over HTTPS.

The following example requires that requests to access Tablestore use HTTPS.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ],
    "Version": "1"
}                    

TLS version-based access control

You can use a custom policy to restrict access to Tablestore to requests that use TLS v1.2 or TLS v1.3 only.

The following example restricts access to Tablestore to TLS v1.2 and TLS v1.3 only.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ots:*",
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringNotEquals": {
                  "ots:TLSVersion": [
                    "TLSv1.2",
                    "TLSv1.3"
                  ]
                }
            }
        }
    ]
}

MFA-based access control

You can create a custom policy to allow access to Tablestore resources only for requests that pass multi-factor authentication (MFA).

The following example restricts access to Tablestore to requests that pass MFA.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "Bool": {
                    "acs:MFAPresent ": "true"
                }
            }
        }
    ],
    "Version": "1"
}                    

Time-based access control

You can create a custom policy to specify when access requests are allowed or denied. Requests sent before the specified time are either allowed or denied.

The following example allows users to access Tablestore only before 00:00 on January 1, 2016 (UTC+8).

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2016-01-01T00:00:00+08:00"
                }
            }
        }
    ],
    "Version": "1"
}                    

Scenario 1: Multiple access control conditions

In this scenario, RAM users whose IP addresses belong to the 10.10.XX.XX/24 CIDR block can perform read or write operations on the instances named online-01 and online-02, including all tables in those instances. Access is allowed only over HTTPS before 00:00:00 on January 1, 2016.

1. Log on to the RAM console using your Alibaba Cloud account (the Resource Access Management (RAM) service is enabled by default).

2. Create a custom policy.

   1. In the navigation pane on the left, choose Permission Management > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Access Policy page, click the Script Editor tab. Enter the following script in the policy document and click OK.

      {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "ots:*",
              "Resource": [
                  "acs:ots:*:*:instance/online-01",
                  "acs:ots:*:*:instance/online-01/table*",
                  "acs:ots:*:*:instance/online-02",
                  "acs:ots:*:*:instance/online-02/table*"
              ],
              "Condition": {
                  "IpAddress": {
                      "acs:SourceIp": [
                          "10.10.XX.XX/24"
                      ]
                  },
                  "DateLessThan": {
                      "acs:CurrentTime": "2016-01-01T00:00:00+08:00"
                  },
                  "Bool": {
                      "acs:SecureTransport": "true"
                  }
              }
          }
      ],
      "Version": "1"
      }                            

   4. In the Create Access Policy dialog box, enter a policy name and description, and then click OK.

3. Attach the policy to a RAM user.

   1. In the navigation pane on the left, choose Identity Management > Users.

   2. On the Users page, find the RAM user to whom you want to grant permissions, and click Add Permissions in the Actions column.

   3. In the Grant Permission panel, select Custom Policy, search for the name of the policy you created, and select the check box next to the policy to add it to the Selected Policy column.

   4. Click Grant Permissions.

   5. Click Shutdown.

Scenario 2: Reject requests

In this scenario, RAM users who use the IP address 10.10.XX.XX cannot write data to tables in instances whose names contain the online or product prefix in the China (Beijing) region. This policy does not apply to instance-level operations.

1. Log on to the RAM console using your Alibaba Cloud account (the RAM service is enabled by default).

2. You can create an access policy.

   1. In the navigation pane on the left, choose Permission Management > Permission Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the Script Editor tab, enter the following content in the policy editor, and click OK.

      {
          "Statement": [
              {
                  "Effect": "Deny",
                  "Action": [
                      "ots:Create*",
                      "ots:Insert*",
                      "ots:Put*",
                      "ots:Update*",
                      "ots:Delete*",
                      "ots:BatchWrite*"
                  ],
                  "Resource": [
                      "acs:ots:cn-beijing:*:instance/online*/table*",
                      "acs:ots:cn-beijing:*:instance/product*/table*"
                  ],
                  "Condition": {
                      "IpAddress": {
                          "acs:SourceIp": [
                              "10.10.XX.XX"
                          ]
                      }
                  }
              }
          ],
          "Version": "1"
      }                 

   4. In the Create Policy dialog box, configure the Name and Description parameters and click OK.

3. Attach the policy to a RAM user.

   1. In the navigation pane on the left, choose Identities > Users.

   2. On the Users page, find the RAM user to whom you want to attach the policy. In the Actions column, click Add Permissions.

   3. In the Grant Permission panel, select Custom Policy, search for the name of the policy you created, and select the check box next to the policy to add it to the Selected Policy column.

   4. Click Grant Permissions.

   5. Click Close.

Scenario 3: Restrict the instances that a RAM user can manage

In this scenario, a RAM user can manage only specific instances and cannot view or manage other instances.

1. Log on to the RAM console using your Alibaba Cloud account (the RAM service is enabled by default).

2. Create an access policy.

   1. In the navigation pane on the left, choose Permission Management > Permission Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Access Policy page, click the Script Editor tab.

   4. Enter the following policy document, and then click OK.

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "ots:ListInstance",
              "ots:ListTagResources"
            ],
            "Resource": "acs:ots:*:*:instance/*"
          },
          {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": [
              "acs:ots:*:*:instance/yourInstance",
              "acs:ots:*:*:instance/yourInstance/table*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": "cms:Query*",
            "Resource": "*"
          }
        ]
      }

      For more information about access policies, see the following table.

      access policy	Description
      { "Effect": "Allow", "Action": [ "ots:ListInstance", "ots:ListTagResources" ], "Resource": "acs:ots:*:*:instance/*" }	Important You must configure this option so that RAM users can manage only specific instances in the console. You must grant the RAM user the permissions to retrieve the instance list and the tag list because the Overview page of the Tablestore console needs to request them.
      { "Effect": "Allow", "Action": "ots:*", "Resource": [ "acs:ots:*:*:instance/yourInstance", "acs:ots:*:*:instance/yourInstance/table*" ] }	Grant the RAM user all permissions on the yourInstance instance and all tables in the instance.
      { "Effect": "Allow", "Action": "cms:Query*", "Resource": "*" }	Grant the RAM user the permissions to use CloudMonitor to view the monitoring data of instances and tables.

3. In the Create Policy dialog box, configure the Policy Name and Description parameters and click OK.

4. Attach the policy to a RAM user.

   1. In the navigation pane on the left, choose Identities > Users.

   2. On the Users page, find the RAM user to whom you want to grant permissions. In the Actions column, click Add Permissions.

   3. In the Grant Permission panel, select Custom Policy, search for the name of the policy you created, and select the check box next to the policy to add it to the Selected Policy column.

   4. Click Grant Permissions.

   5. Click Close.