RAM authorization

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Container Service for Kubernetes for RAM permission policies. The RAM code (RamCode) for Container Service for Kubernetes is cs , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Container Service for Kubernetes. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
cs:RunClusterCheck	RunClusterCheck	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:InstallNodePoolComponents	InstallNodePoolComponents	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ResumeUpgradeCluster	ResumeUpgradeCluster	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetUpgradeStatus	GetUpgradeStatus	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CreateCluster	CreateCluster	create	Cluster `acs:cs:{#regionId}:{#accountId}:cluster/`	cs:ClusterType cs:ClusterSpec cs:ClusterProfile cs:EnableSecretEncryption cs:EnableApiServerEip cs:EnableAddonLogtailDs cs:EnableCoreControlPlaneComponentsLog cs:AddonNames cs:EnableSNAT cs:EnableNodePoolPublicIP	None
cs:Queryk8sComponentsUpdateVersion	DescribeClusterAddonsVersion	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetClusterAddonInstance	GetClusterAddonInstance	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CreateTemplate	CreateTemplate	create	All Resource ``	None	None
cs:DeleteAutoRepairPolicy	DeleteAutoRepairPolicy	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ModifyAutoRepairPolicy	ModifyAutoRepairPolicy	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:RemoveNodePoolNodes	RemoveNodePoolNodes	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteCluster	DeleteCluster	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeKubernetesVersionMetadata	DescribeKubernetesVersionMetadata	get	All Resource ``	None	None
cs:QueryK8sComponentUpgradeStatus	DescribeClusterAddonUpgradeStatus	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeResourcesDeleteProtection	DescribeResourcesDeleteProtection	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterUserKubeconfig	DescribeClusterUserKubeconfig	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:KubeConfigDurationMinutes	None
cs:ListClusterAddonInstances	ListClusterAddonInstances	list	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteClusterNodepool	DeleteClusterNodepool	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterAddonsUpgradeStatus	DescribeClusterAddonsUpgradeStatus	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListUserKubeConfigStates	ListUserKubeConfigStates	none	All Resource ``	None	None
cs:PauseComponentUpgrade	PauseComponentUpgrade	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CancelComponentUpgrade	CancelComponentUpgrade	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CancelTask	CancelTask	update	All Resource ``	None	None
cs:CreateKubernetesTrigger	CreateKubernetesTrigger	create	All Resource ``	None	None
cs:MigrateCluster	MigrateCluster	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CancelOperationPlan	CancelOperationPlan	delete	All Resource ``	None	None
cs:GetClusters	DescribeClusters	get	Cluster `acs:cs::{#accountId}:cluster/*`	None	None
cs:ModifyClusterAddon	ModifyClusterAddon	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:AddonName cs:AddonNames	None
cs:CreateClusterInspectConfig	CreateClusterInspectConfig	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteTrigger	DeleteTrigger	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListOperationPlans	ListOperationPlans	list	All Resource ``	None	None
cs:GetKubernetesTrigger	GetKubernetesTrigger	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateContactGroupForAlert	UpdateContactGroupForAlert	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ModifyNodePoolNodeConfig	ModifyNodePoolNodeConfig	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetClusterInspectReportDetail	GetClusterInspectReportDetail	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeEvents	DescribeEvents	get	All Resource ``	None	None
cs:CreateAutoRepairPolicy	CreateAutoRepairPolicy	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ScaleClusterNodePool	ScaleClusterNodePool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateClusterInspectConfig	UpdateClusterInspectConfig	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetClusterDiagnosisResult	GetClusterDiagnosisResult	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteKubernetesTrigger	DeleteKubernetesTrigger	delete	All Resource ``	None	None
cs:StartAlert	StartAlert	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:OpenAckService	OpenAckService	update	All Resource ``	None	None
cs:DescribeSubaccountK8sClusterUserConfig	DescribeSubaccountK8sClusterUserConfig	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeExternalAgent	DescribeExternalAgent	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetClusterDiagnosisCheckItems	GetClusterDiagnosisCheckItems	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeTaskInfo	DescribeTaskInfo	get	All Resource ``	None	None
cs:DescribeUserClusterNamespaces	DescribeUserClusterNamespaces	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetClusterCheck	GetClusterCheck	list	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeletePolicyInstance	DeletePolicyInstance	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteClusterNodes	DeleteClusterNodes	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CreateClusterNodePool	CreateClusterNodePool	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeRegions	DescribeRegions	get	All Resource ``	None	None
cs:UpgradeK8sComponents	UpgradeClusterAddons	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListClusterChecks	ListClusterChecks	list	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:AttachInstances	AttachInstances	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteClusterInspectConfig	DeleteClusterInspectConfig	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteTemplate	DeleteTemplate	delete	All Resource ``	None	None
cs:CreateClusterDiagnosis	CreateClusterDiagnosis	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ScanClusterVuls	ScanClusterVuls	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListClusterInspectReports	ListClusterInspectReports	list	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeTemplates	DescribeTemplates	get	All Resource ``	None	None
cs:CreateAutoscalingConfig	CreateAutoscalingConfig	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribePolicyDetails	DescribePolicyDetails	get	All Resource ``	None	None
cs:ListAutoRepairPolicies	ListAutoRepairPolicies	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ModifyClusterTags	ModifyClusterTags	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateTemplate	UpdateTemplate	update	All Resource ``	None	None
cs:ListTagResources	ListTagResources	get	All Resource ``	None	None
cs:GetClusterInspectConfig	GetClusterInspectConfig	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListClusterAddonInstanceResources	ListClusterAddonInstanceResources	list	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterEvents	DescribeClusterEvents	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeAddons	DescribeAddons	get	All Resource ``	None	None
cs:UnInstallClusterAddons	UnInstallClusterAddons	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:EnableAddonLogtailDs	None
cs:UpdateResourcesDeleteProtection	UpdateResourcesDeleteProtection	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateKMSEncryption	UpdateKMSEncryption	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:SyncClusterNodePool	SyncClusterNodePool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribePolicies	DescribePolicies	get	All Resource ``	None	None
cs:InstallClusterAddons	InstallClusterAddons	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:AddonNames	None
cs:DescribeUserQuota	DescribeUserQuota	get	All Resource ``	None	None
cs:ResumeTask	ResumeTask	update	All Resource ``	None	None
cs:GetClusters	DescribeClustersV1	get	Cluster `acs:cs::{#accountId}:cluster/*`	None	None
cs:UntagResources	UntagResources	delete	All Resource ``	None	None
cs:ModifyClusterNodePool	ModifyClusterNodePool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterNodePoolDetail	DescribeClusterNodePoolDetail	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribePolicyInstances	DescribePolicyInstances	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:RunClusterInspect	RunClusterInspect	create	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CancelClusterUpgrade	CancelClusterUpgrade	delete	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteAlertContact	DeleteAlertContact	delete	All Resource ``	None	None
cs:CheckControlPlaneLogEnable	CheckControlPlaneLogEnable	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:GetUserPermissions	DescribeUserPermission	get	All Resource ``	None	None
cs:DeployPolicyInstance	DeployPolicyInstance	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ModifyPolicyInstance	ModifyPolicyInstance	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterNodePools	DescribeClusterNodePools	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:RepairClusterNodePool	RepairClusterNodePool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#cluster_id}`	None	None
cs:DescribeClusterAddonMetadata	DescribeClusterAddonMetadata	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateClusterAuditLogConfig	UpdateClusterAuditLogConfig	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DeleteAlertContactGroup	DeleteAlertContactGroup	delete	All Resource ``	None	None
cs:CleanClusterUserPermissions	CleanClusterUserPermissions	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpgradeCluster	UpgradeCluster	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ModifyCluster	ModifyCluster	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:EnableApiServerEip cs:ApiServerEipId	None
cs:DescribeClusterResources	DescribeClusterResources	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:PauseTask	PauseTask	update	All Resource ``	None	None
cs:DescribeClusterTasks	DescribeClusterTasks	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#cluster_id}`	None	None
cs:GrantPermission	GrantPermissions	update	All Resource ``	None	None
cs:DescribeClusterDetail	DescribeClusterDetail	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CreateTrigger	CreateTrigger	create	All Resource ``	None	None
cs:DescribeClusterAddonInstance	DescribeClusterAddonInstance	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterV2UserKubeconfig	DescribeClusterV2UserKubeconfig	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#clusterId}`	cs:KubeConfigDurationMinutes	None
cs:StopAlert	StopAlert	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterNodes	DescribeClusterNodes	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:TagResources	TagResources	update	All Resource ``	None	None
cs:DescribeAddon	DescribeAddon	get	All Resource ``	None	None
cs:ListOperationPlansForRegion	ListOperationPlansForRegion	none	All Resource ``	None	None
cs:DescribeTemplateAttribute	DescribeTemplateAttribute	get	All Resource ``	None	None
cs:PauseClusterUpgrade	PauseClusterUpgrade	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:CheckServiceRole	CheckServiceRole	none	All Resource ``	None	None
cs:ResumeComponentUpgrade	ResumeComponentUpgrade	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:FixNodePoolVuls	FixNodePoolVuls	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#cluster_id}`	None	None
cs:DescribeClusterAttachScripts	DescribeClusterAttachScripts	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateNodePoolComponent	UpdateNodePoolComponent	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateK8sClusterUserConfigExpire	UpdateK8sClusterUserConfigExpire	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeTrigger	DescribeTrigger	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClustersForRegion	DescribeClustersForRegion	list	All Resource ``	None	None
cs:ListAddons	ListAddons	list	All Resource ``	None	None
cs:DescribeClusterVuls	DescribeClusterVuls	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribePolicyInstancesStatus	DescribePolicyInstancesStatus	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:AttachInstancesToNodePool	AttachInstancesToNodePool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:ListClusterKubeconfigStates	ListClusterKubeconfigStates	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeClusterLogs	DescribeClusterLogs	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeEventsForRegion	DescribeEventsForRegion	list	All Resource ``	None	None
cs:RevokeK8sClusterKubeConfig	RevokeK8sClusterKubeConfig	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateUserPermissions	UpdateUserPermissions	none	All Resource ``	None	None
cs:CleanUserPermissions	CleanUserPermissions	none	All Resource ``	None	None
cs:GetClusterAuditProject	GetClusterAuditProject	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:UpdateControlPlaneLog	UpdateControlPlaneLog	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	cs:EnableCoreControlPlaneComponentsLog	None
cs:UpgradeClusterNodepool	UpgradeClusterNodepool	update	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribeNodePoolVuls	DescribeNodePoolVuls	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#cluster_id}`	None	None
cs:DescribeAutoRepairPolicy	DescribeAutoRepairPolicy	none	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None
cs:DescribePolicyGovernanceInCluster	DescribePolicyGovernanceInCluster	get	*Cluster `acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}`	None	None

Resource

The following table lists the resources defined by Container Service for Kubernetes. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Cluster	acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId} acs:cs:{#regionId}:{#accountId}:cluster/* acs:cs::{#accountId}:cluster/ acs:cs:{#regionId}:{#accountId}:cluster/{#cluster_id}
Unrestricted	acs:cs::{#accountId}:cluster/ acs:cs:{#regionId}:{#accountId}:*

Condition

The following table lists the product-level condition keys defined by Container Service for Kubernetes. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
cs:EnableAddonLogtailDs	Whether log component logtail-ds is enabled for the cluster	Boolean
cs:EnableApiServerEip	Whether API Server public network access is enabled for the cluster	Boolean
cs:EnableSNAT	Whether configuring SNAT for the cluster's VPC is allowed	Boolean
cs:AddonNames	Cluster component names, Example: [\\\\\\\\\\"metrics-server\\\\\\\\\\",\\\\\\\\\\"terway-eniip\\\\\\\\\\"]	Array
cs:ClusterType	The type of the cluster	String
cs:ClusterSpec	The specification of ACK managed cluster	String
cs:AddonName	Cluster component name, Example: aliyun-acr-credential-helper,metrics-server	String
cs:EnableSecretEncryption	Whether to enable secret encryption in the ACK cluster	Boolean
cs:ClusterProfile	Subtype identifier of ACK managed cluster	String
cs:ApiServerEipId	The ID of the EIP that you want to associate with the cluster API server, Example: eip-2zep1n4o1ic48m3m****	String
cs:EnableNodePoolPublicIP	Whether it is allowed to assign a public IPv4 address to each node in the cluster	Boolean
cs:EnableCoreControlPlaneComponentsLog	Whether the core component log function of the control plane is enabled for the cluster	Boolean
cs:KubeConfigDurationMinutes	The validity period of a temporary kubeconfig file. Unit: minutes	Numeric

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: