Blockchain as a Service:Hyperledger Fabric RAM authentication

Authorizable Hyperledger Fabric resource types

When you grant permissions to a RAM user, describe Hyperledger Fabric resources as follows:

In these formats, $regionId is the region where the resource is located. $accountId is the ID of the Alibaba Cloud account that owns the resource. $consortiumId/$organizationId/$channelId/$chaincodeId is the ID of the resource in BaaS.

Authorizable Hyperledger Fabric APIs

The following table lists the Hyperledger Fabric blockchain APIs that are authorized by default. RAM users and Security Token Service (STS) token holders have permissions for these APIs by default:

The following table lists the authorizable APIs in Hyperledger Fabric and their corresponding ARN formats:

Examples of Hyperledger Fabric RAM rules

Example 1: Grant read-only permissions for BaaS. These permissions allow users to view the blockchain status and download the SDK using the console or APIs.

{
   "Statement": [{ 
       "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
       "Effect": "Allow",
       "Resource": "acs:baas:*:*:*"
   }],
   "Version": "1"
}

{
  "Statement": [{
     "Action": "baas:*Chaincode",
     "Effect": "Allow",
     "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/*", "acs:baas:*:*:consortium/*","acs:baas:*:*:channel/*"]
  }],
  "Version": "1"
}

Example 3: Grant fine-grained permissions to a chaincode developer. This authorization typically requires all read permissions and chaincode management permissions for a specific organization. In accordance with the least privilege principle, the user is restricted to creating chaincodes only for specified consortiums, organizations, and channels. The user can also install or instantiate chaincodes only on specific organizations. Replace $consortiumId/$organizationId/$channelId with the ID of the resource in BaaS.

{
 "Statement": [{
   "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
   "Effect": "Allow",
   "Resource": "acs:baas:*:*:*"
 },
 {
   "Action": "baas:*Chaincode",
   "Effect": "Allow",
   "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/$organizationId","acs:baas:*:*:consortium/$consortiumId","acs:baas:*:*:channel/$channelId"]
 }],
 "Version": "1"
}