You can create custom permission policies and attach them to RAM users so that they can log on to the ActionTrail console and perform authorized operations.
Background information
-
Before you use RAM to manage ActionTrail permissions, understand the following system policies:
-
AliyunActionTrailFullAccess: grants a RAM user permissions to manage ActionTrail resources.
-
AliyunActionTrailReadOnlyAccess: grants read-only permissions on ActionTrail resources.
If the system policies cannot meet your business requirements, you can create custom policies.
-
-
Before you grant ActionTrail permissions, familiarize yourself with the permission definitions. For more information, see RAM authentication.
Procedure
-
Create a RAM user.
For more information, see Create a RAM user.
-
Create a custom policy.
For more information, see Create custom policies and Policy example.
-
Attach the policy to a RAM user.
For more information, see Grant permissions to a RAM user.
Access policy examples
The following policy allows RAM users to perform read-only operations only from the IP address range 42.120.XX.X/24.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"actiontrail:Lookup*",
"actiontrail:Describe*",
"actiontrail:Get*",
"actiontrail:Check*",
"actiontrail:List*"
],
"Resource": "*",
"Condition": {
"IpAddress": {
"acs:SourceIp": "42.120.XX.X/24"
}
}
}
]
}