Agent Sandbox:Configure RAM User Permissions

Use the console or OpenAPI

Use an Alibaba Cloud account or RAM user to manage Teams, API Keys, and other resources in the console. Use Alibaba Cloud AK or STS temporary credentials to call Agent Sandbox Flash Edition OpenAPI. Both methods use RAM policies to control the allowed operations and resources.

Use the E2B SDK, CLI, or compatible APIs

Use an Agent Sandbox Flash Edition API Key to create and access sandboxes through the E2B SDK, E2B CLI, or compatible HTTP APIs. Agent Sandbox Flash Edition RAM permissions are not required. Each API Key is bound to one Team. Use separate Teams and API Keys for different projects and environments, and do not share an API Key between test and production applications. For instructions, see Create an API Key.

Manage all Agent Sandbox Flash Edition resources in an account

This scenario applies to a platform administrator who manages all Teams and resources. The following policy grants Agent Sandbox Flash Edition permissions in all regions of the account. It does not grant permissions on Function Compute or other Alibaba Cloud services. To limit the policy to one region, change Resource to acs:fcsandbox:<region>:<account-id>:*:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": "*"
    }
  ]
}

Manage a specified resource group

This scenario applies to an administrator who manages the test and production Teams of all projects in one department but cannot access other departments. The following example limits permissions to the department's resource group:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:ResourceGroupId": "<department-resource-group-id>"
        }
      }
    }
  ]
}

After logging on to the console, the RAM user must switch to an authorized resource group. When calling list operations, also specify the corresponding resourceGroupID.

Manage a specified Team

This scenario applies to project developers or production operators. The following policy allows management of the specified Team and its child resources, but does not allow the identity to create other Teams:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": [
        "acs:fcsandbox:<region>:<account-id>:teams/<team-id>",
        "acs:fcsandbox:<region>:<account-id>:teams/<team-id>/*"
      ]
    }
  ]
}

The Team and its child resources use separate ARNs, so both Resource entries are required. This policy does not include account-level Team list permissions. If the user must select a Team in the console, add fcsandbox:ListTeams permission scoped to the resource group. The user can then see the Team list in the same resource group. To strictly limit Team visibility, use a separate resource group for the project.

Action

Action in a permission policy specifies which Agent Sandbox Flash Edition OpenAPI operations a RAM identity can call. The format is:

fcsandbox:<action>

For example, CreateTeam corresponds to fcsandbox:CreateTeam, and CreateVolume corresponds to fcsandbox:CreateVolume. Before configuring a policy, find the required operation in the Agent Sandbox Flash Edition OpenAPI documentation and configure Action based on its authorization information.

Resource ARN

acs:fcsandbox:<region>:<account-id>:<resource-path>