All Products
Search
Document Center

Global Accelerator (GA)

Last Updated: Sep 30, 2021

Resource Access Management (RAM) users or RAM roles must be granted permissions before they can access cloud resources. RAM uses policies to define permissions. A cloud service defines elements that can be used in a policy statement, such as Action, Resource, and Condition. This topic describes the permissions on Global Accelerator (GA).

The code (RamCode) in RAM that is used to indicate GA is ga. You can grant permissions on GA at the resource level.

Action

The following table describes the values that you can use in the Action element of a policy statement. The values are defined by GA. The following list describes the columns in the table:
  • Action: the value that you can use in the Action element to specify the operation on a resource.

  • API: the API operation that you can call to perform the action. In most cases, only one API operation of a cloud service is required to perform an action. In some cases, multiple API operations must be called to perform an action, or an API operation can be called to perform multiple actions.

  • Access level: the access level of each action. The levels are read, write, and list.

  • Resource type: the type of the resource on which you can authorize a RAM user or a RAM role to perform the operation. Take note of the following items:

    • The required resource types are displayed in bold characters.

    • If the permissions cannot be granted at the resource level, All resources is used in the Resource type column of the action.

  • Condition key: the condition keys that are defined by a cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Policy elements.

  • Dependent action: other actions that a RAM user or a RAM role must have permissions to perform the action. To successfully call the action, a RAM user or a RAM role must have the permissions to perform the dependent action.

Actions

APIs

Access level

Resource types

Condition keys

Dependent actions

ga:AddEntriesToAcl

AddEntriesToAcl

Write


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/{#aclId}


N/A

N/A

ga:AssociateAclsWithListener

AssociateAclsWithListener

Write


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}


N/A

N/A

ga:AssociateAdditionalCertificatesWithListener

AssociateAdditionalCertificatesWithListener

Write


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:AttachDdosToAccelerator

AttachDdosToAccelerator

WRITE


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:AttachLogStoreToEndpointGroup

AttachLogStoreToEndpointGroup

Write


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/*


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:BandwidthPackageAddAccelerator

BandwidthPackageAddAccelerator

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:BandwidthPackageRemoveAccelerator

BandwidthPackageRemoveAccelerator

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CheckAcceleratorPrivilege

N/A

READ


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CheckListenerPort

N/A

Read


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:ConfigEndpointProbe

ConfigEndpointProbe

WRITE


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}


N/A

N/A

ga:CreateAccelerator

CreateAccelerator

WRITE


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/*


N/A

N/A

ga:CreateAcl

CreateAcl

Write


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/*


N/A

N/A

ga:CreateBandwidthPackage

CreateBandwidthPackage

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*


N/A

N/A

ga:CreateEndpointGroup

CreateEndpointGroup

WRITE


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/*


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CreateEndpointGroups

CreateEndpointGroups

Write


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/*


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:CreateForwardingRules

CreateForwardingRules

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CreateIpSets

CreateIpSets

WRITE


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/*


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CreateListener

CreateListener

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/*


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:CreateSpareIps

CreateSpareIps

Write


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DeleteAccelerator

DeleteAccelerator

WRITE


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DeleteAcl

DeleteAcl

Write


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/{#aclId}


N/A

N/A

ga:DeleteBandwidthPackage

DeleteBandwidthPackage

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


N/A

N/A

ga:DeleteEndpointGroup

DeleteEndpointGroup

WRITE


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}


N/A

N/A

ga:DeleteEndpointGroups

DeleteEndpointGroups

Write


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}


N/A

N/A

ga:DeleteForwardingRules

DeleteForwardingRules

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:DeleteIpSet

DeleteIpSet

WRITE


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}


N/A

N/A

ga:DeleteIpSets

DeleteIpSets

WRITE


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}


N/A

N/A

ga:DeleteListener

DeleteListener

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:DeleteSpareIps

DeleteSpareIps

Write


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DescribeAccelerator

DescribeAccelerator

READ


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DescribeBandwidthPackage

DescribeBandwidthPackage

READ


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


N/A

N/A

ga:DescribeEndpointGroup

DescribeEndpointGroup

READ


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}


N/A

N/A

ga:DescribeIpSet

DescribeIpSet

READ


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}


N/A

N/A

ga:DescribeListener

DescribeListener

READ


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:DetachDdosFromAccelerator

DetachDdosFromAccelerator

WRITE


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DetachLogStoreFromEndpointGroup

DetachLogStoreFromEndpointGroup

Write


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/*


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:DissociateAclsFromListener

DissociateAclsFromListener

Write


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:DissociateAdditionalCertificatesFromListener

DissociateAdditionalCertificatesFromListener

Write


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:GetAcl

GetAcl

Read


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/*


N/A

N/A

ga:GetHealthStatus

GetHealthStatus

Read


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:GetSpareIp

GetSpareIp

Read


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:ListAccelerators

ListAccelerators

LIST


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/*


N/A

N/A

ga:ListAcls

ListAcls

List


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/*


N/A

N/A

ga:ListAvailableAccelerateAreas

ListAvailableAccelerateAreas

LIST


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:ListBandwidthPackages

ListBandwidthPackages

LIST


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*


N/A

N/A

ga:ListBandwidthackages

ListBandwidthackages

LIST


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*


N/A

N/A

ga:ListEips

N/A

LIST


Ga:eip


acs:ga:{#regionId}:{#accountId}:eip/*


N/A

N/A

ga:ListEndpointGroups

ListEndpointGroups

LIST


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/*


N/A

N/A

ga:ListForwardingRules

ListForwardingRules

LIST


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:ListIpSets

ListIpSets

LIST


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/*


N/A

N/A

ga:ListListenerCertificates

ListListenerCertificates

List


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:ListListeners

ListListeners

LIST


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/*


N/A

N/A

ga:ListSpareIps

ListSpareIps

List


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:RemoveEntriesFromAcl

RemoveEntriesFromAcl

Write


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/{#aclId}


N/A

N/A

ga:ReplaceBandwidthPackage

ReplaceBandwidthPackage

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


N/A

N/A

ga:UpdateAccelerator

UpdateAccelerator

WRITE


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:UpdateAcceleratorConfirm

UpdateAcceleratorConfirm

Write


Ga:Accelerator


acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


N/A

N/A

ga:UpdateAclAttribute

UpdateAclAttribute

Write


Ga:Acl


acs:ga:{#regionId}:{#accountId}:acl/{#aclId}


N/A

N/A

ga:UpdateBandwidthPackage

UpdateBandwidthPackage

WRITE


Ga:BandwidthPackage


acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


N/A

N/A

ga:UpdateEndpointGroup

UpdateEndpointGroup

WRITE


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}


N/A

N/A

ga:UpdateEndpointGroupAttribute

UpdateEndpointGroupAttribute

WRITE


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}


N/A

N/A

ga:UpdateEndpointGroups

UpdateEndpointGroups

Write


Ga:EndpointGroup


acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}


N/A

N/A

ga:UpdateForwardingRules

UpdateForwardingRules

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

ga:UpdateIpSet

UpdateIpSet

WRITE


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}


N/A

N/A

ga:UpdateIpSets

UpdateIpSets

WRITE


Ga:IpSet


acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}


N/A

N/A

ga:UpdateListener

UpdateListener

WRITE


Ga:Listener


acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


N/A

N/A

Resource

The following table describes the values that you can use in the Resource element of a policy statement. The values are defined by GA.

The Alibaba Cloud Resource Name (ARN) is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

  • {#} indicates a variable. {#} must be replaced with an actual value. For example, {#regionId} must be replaced with the actual ID of the region where your resource resides.

  • An asterisk (*) is used as a wildcard. Examples:

    • If you specify {#resourceType}/*, all resources are specified.

    • If {#regionId} is set to *, all regions are specified.

    • If {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type

ARN

Accelerator

acs:ga:{#regionId}:{#accountId}:ga/{#AcceleratorId}

BandwidthPackage

acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#BandwidthPackageId}

EndpointGroup

acs:ga:{#regionId}:{#accountId}:endpointgroup/{#EndpointGroupId}

Listener

acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}

IpSet

acs:ga:{#regionId}:{#accountId}:ipset/{#IpSetId}

Acl

acs:ga:{#regionId}:{#accountId}:acl/{#AclId}

Condition

GA does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Policy elements.