ActionTrail:Custom policies

What is a custom policy?

Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.

• After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.

• You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.

• Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.

References

• Create a custom policy

• Modify a custom policy

• Delete a custom policy

• Manage policy grants

• Manage custom policy versions

Scenarios of custom policies and sample custom policies

• Example 1: Grant a RAM user full permissions on ActionTrail and permissions to list Object Storage Service (OSS) buckets and Simple Log Service projects, so the RAM user can manage trails.

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "actiontrail:*",
                  "oss:GetService",
                  "log:ListProject"
              ],
              "Resource": "*",
              "Effect": "Allow"
          }
      ]
  }
                          

• Example 2: Grant a RAM user permissions to manage trails in ActionTrail and permissions to manage Logstores, indexes, dashboards, charts, and projects in Simple Log Service, so the RAM user can manage alerts.

  { 
      "Version": "1", 
      "Statement": [
        {
       "Effect": "Allow",
       "Action": [
         "actiontrail:DescribeTrails",
         "actiontrail:SetDefaultTrail",
         "actiontrail:GetDefaultTrail",
         "actiontrail:CreateTrail"
       ],
       "Resource": "*"   
       },
     {
       "Effect": "Allow",
       "Action": [
         "log:CreateLogStore",
         "log:CreateIndex",
         "log:UpdateIndex"
       ],
       "Resource": [
         "acs:log:*:*:project/Project name/logstore/internal-alert-history",
         "acs:log:*:*:project/sls-alert-*/logstore/internal-alert-center-log"
       ]   
       },
     {
       "Effect": "Allow",
       "Action": [
         "log:CreateDashboard",
         "log:CreateChart",
         "log:UpdateDashboard"
       ],
       "Resource": "acs:log:*:*:project/Project name/dashboard/*"
     },
     {
       "Effect": "Allow",
       "Action": [
         "log:*"
       ],
       "Resource": "acs:log:*:*:project/Project name/job/*"   
       },
     {
       "Effect": "Allow",
       "Action": [
         "log:CreateProject"
       ],
       "Resource": [
         "acs:log:*:*:project/sls-alert-*"
       ]
     }
   ]
  }

Authorization information

Before you create custom policies, make sure that you understand the access control requirements of your business and the authorization information about ActionTrail. For more information, see RAM authorization.