Call the GrantPermissions API to update RBAC permissions for a RAM user or role - Container Service for Kubernetes - Alibaba Cloud - Container Service for Kubernetes

By default, RAM users or roles who aren't cluster creators and haven't been granted full cluster permissions have no RBAC permissions in the cluster. You can call this interface to update RBAC access permissions for RAM users/roles, including accessible resources, permission scopes, and preset roles, for enhanced security control on resources in Container Service for Kubernetes (ACK) clusters.

Operation description

If you use a Resource Access Management (RAM) account to call this operation, make sure it has permissions to modify cluster authorization information for other RAM users or RAM roles. Otherwise, the StatusForbidden or ForbiddenGrantPermissions error code is returned. For more information, see Use a RAM user to grant RBAC permissions to other RAM users.
This operation overwrites all existing cluster permissions for the target RAM user or RAM role. You must specify all the permissions you want to grant to the RAM user or RAM role in the request.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cs:GrantPermission

update

*All Resource

*

None

Request syntax

POST /permissions/users/{uid} HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
uid	string	Yes	The ID of the RAM user or RAM role whose permissions you want to update.	2367****

Request parameters

Parameter	Type	Required	Description	Example
body	array<object>	No	The request body.
	object	No	The queried permissions.
cluster	string	Yes	The ID of the cluster on which you want to grant permissions to the RAM role or RAM role. Set this parameter to an empty string if `role_type` is set to `all-clusters`.	c796c60***
is_custom	boolean	No	Specifies whether to assign a custom role to the RAM user or RAM role. If you want to assign a custom role to the RAM user or RAM role, set `role_name` to the name of the custom role.	false
role_name	string	Yes	The predefined role name. Valid values: `admin`: administrator `admin-view`: read-only administrator `ops`: O&M engineer `dev`: developer `restricted`: restricted user Custom role Note: You cannot grant namespace-level permissions to the `admin`, `admin-view`, and `ops` roles. You cannot grant all cluster-level permissions to the `admin-view` role. Valid values: ops : ops dev : dev restricted : restricted admin-view : admin-view admin : admin	ops
role_type	string	Yes	The authorization type. Valid values: `cluster`: authorizes the RAM user or RAM role to manage the specified clusters. `namespace`: authorizes the RAM user or RAM role to manage the specified namespaces. `all-clusters`: authorizes the RAM user or RAM role to manage all clusters.	cluster
namespace	string	No	The namespace that you want to authorize the RAM user or RAM role to manage. This parameter is required only if you set role_type to namespace.	test
is_ram_role	boolean	No	Specifies whether to use a RAM role to grant permissions.	false

Response elements

Element

Type

Description

Example

None defined.

Examples

Success response

JSON format

{}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.