RAM authorization - Alibaba Cloud Linux - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Alibaba Cloud Linux for RAM permission policies. The RAM code (RamCode) for Alibaba Cloud Linux is sysom , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Alibaba Cloud Linux. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
sysom:UpgradeAgentForCluster	UpgradeAgentForCluster	update	All Resource ``	None	None
sysom:GetProblemPercentage	GetProblemPercentage	get	All Resource ``	None	None
sysom:GetGpuClusterArgsOptions	GetGpuClusterArgsOptions	get	All Resource ``	None	None
sysom:CpuHighAgentStreamResponse	CpuHighAgentStreamResponse	none	All Resource ``	None	None
sysom:ListInstanceStatus	ListInstanceStatus	list	All Resource ``	None	None
sysom:InvokeAnomalyDiagnosis	InvokeAnomalyDiagnosis	create	All Resource ``	None	None
sysom:ListClusters	ListClusters	list	All Resource ``	None	None
sysom:GetCopilotHistory	GetCopilotHistory	list	All Resource ``	None	None
sysom:CreateVmcoreDiagnosisTask	CreateVmcoreDiagnosisTask	none	All Resource ``	None	None
sysom:GetHotspotCompare	GetHotspotCompare	get	All Resource ``	None	None
sysom:UpgradeAgent	UpgradeAgent	update	All Resource ``	None	None
sysom:GetInspectionReport	GetInspectionReport	get	All Resource ``	None	None
sysom:GetHotspotAnalysis	GetHotspotAnalysis	get	All Resource ``	None	None
sysom:GenerateCopilotResponse	GenerateCopilotResponse	none	All Resource ``	None	None
sysom:GetGpuClusterListAlarmRecord	GetGpuClusterListAlarmRecord	get	All Resource ``	None	None
sysom:ListDiagnosis	ListDiagnosis	list	All Resource ``	None	None
sysom:InitialSysom	InitialSysom	create	All Resource ``	None	None
sysom:StartAIAnalysis	StartAIAnalysis	get	All Resource ``	None	None
sysom:ListAgentInstallRecords	ListAgentInstallRecords	list	All Resource ``	None	None
sysom:GetHealthPercentage	GetHealthPercentage	get	All Resource ``	None	None
sysom:InvokeDiagnosis	InvokeDiagnosis	create	Diagnosis `acs:sysom::{#accountId}:diagnosis/`	None	None
sysom:ListInstancesWithEcsInfo	ListInstancesWithEcsInfo	get	All Resource ``	None	None
sysom:ListInstanceHealth	ListInstanceHealth	list	All Resource ``	None	None
sysom:ListAifgJobs	ListAifgJobs	list	All Resource ``	None	None
sysom:GetListRecord	GetListRecord	get	All Resource ``	None	None
sysom:GetServiceFuncStatus	GetServiceFuncStatus	get	All Resource ``	None	None
sysom:DescribeMetricList	DescribeMetricList	get	All Resource ``	None	None
sysom:UpdateAlertStrategy	UpdateAlertStrategy	none	All Resource ``	None	None
sysom:UpdateAlertEnabled	UpdateAlertEnabled	none	All Resource ``	None	None
sysom:GetAlertStrategy	GetAlertStrategy	none	All Resource ``	None	None
sysom:ListInstances	ListInstances	list	All Resource ``	None	None
sysom:GetAgentTask	GetAgentTask	get	All Resource ``	None	None
sysom:CreateAlertStrategy	CreateAlertStrategy	none	All Resource ``	None	None
sysom:ListInstancesEcsInfoList	ListInstancesEcsInfoList	get	All Resource ``	None	None
sysom:GetHotspotPidList	GetHotspotPidList	get	All Resource ``	None	None
sysom:UninstallAgentWithType	UninstallAgentWithType	delete	All Resource ``	None	None
sysom:InstallAgentForCluster	InstallAgentForCluster	create	All Resource ``	None	None
sysom:UpdateAlertDestination	UpdateAlertDestination	update	All Resource ``	None	None
sysom:GetAlertDestination	GetAlertDestination	get	All Resource ``	None	None
sysom:GetAifgResult	GetAifgResult	get	*Diagnosis `acs:sysom::{#accountId}:diagnosis/{#DiagnosisId}`	None	None
sysom:CreateClusterVpcEndpointConnection	CreateClusterVpcEndpointConnection	create	All Resource ``	None	None
sysom:GetVmcoreDiagnosisTask	GetVmcoreDiagnosisTask	none	All Resource ``	None	None
sysom:hotSpotUniqList	GetHotSpotUniqList	get	All Resource ``	None	None
sysom:GetHotspotTracking	GetHotspotTracking	get	All Resource ``	None	None
sysom:InstallAgentWithType	InstallAgentWithType	create	All Resource ``	None	None
sysom:DeleteAlertDestination	DeleteAlertDestination	delete	All Resource ``	None	None
sysom:UpgradeAgentWithType	UpgradeAgentWithType	update	All Resource ``	None	None
sysom:ListRegions	ListRegions	list	All Resource ``	None	None
sysom:GetHostCount	GetHostCount	get	All Resource ``	None	None
sysom:GetListGpuCluster	GetListGpuCluster	get	All Resource ``	None	None
sysom:GetBasicResources	GetResources	get	All Resource ``	None	None
sysom:StartAIDiffAnalysis	StartAIDiffAnalysis	get	All Resource ``	None	None
sysom:ListPodsOfInstance	ListPodsOfInstance	list	All Resource ``	None	None
sysom:ListPluginsInstances	ListPluginsInstances	get	All Resource ``	None	None
sysom:CheckInstanceSupport	CheckInstanceSupport	none	All Resource ``	None	None
sysom:ListClusterAgentInstallRecords	ListClusterAgentInstallRecords	list	All Resource ``	None	None
sysom:DeleteAlertStrategy	DeleteAlertStrategy	delete	All Resource ``	None	None
sysom:ListAlertStrategies	ListAlertStrategies	list	All Resource ``	None	None
sysom:GetAbnormalEventsCount	GetAbnormalEventsCount	get	All Resource ``	None	None
sysom:ListAbnormalyEvents	ListAbnormalyEvents	list	All Resource ``	None	None
sysom:InstallAgent	InstallAgent	none	All Resource ``	None	None
sysom:UpdateFuncSwitchRecord	UpdateFuncSwitchRecord	get	All Resource ``	None	None
sysom:ListAlertDestinations	ListAlertDestinations	list	All Resource ``	None	None
sysom:ListInstanceInfo	ListInstanceInfo	list	All Resource ``	None	None
sysom:GetAifgUrl	GetAifgUrl	get	*Diagnosis `acs:sysom::{#accountId}:diagnosis/{#DiagnosisId}`	None	None
sysom:GetAIQueryResult	GetAIQueryResult	get	All Resource ``	None	None
sysom:GenerateCopilotStreamResponse	GenerateCopilotStreamResponse	none	All Resource ``	None	None
sysom:GetGpuClusterTopology	GetGpuClusterTopology	get	All Resource ``	None	None
sysom:CreateAlertDestination	CreateAlertDestination	create	All Resource ``	None	None
sysom:GetConfigByName	GetConfigByName	get	All Resource ``	None	None
sysom:ListAgents	ListAgents	list	All Resource ``	None	None
sysom:UpdateEventsAttention	UpdateEventsAttention	update	All Resource ``	None	None
sysom:GetDiagnosisResult	GetDiagnosisResult	get	*Diagnosis `acs:sysom::{#accountId}:diagnosis/{#DiagnosisId}`	None	None
sysom:ListAlertItems	ListAlertItems	none	All Resource ``	None	None
sysom:ListAllInstances	ListAllInstances	list	All Resource ``	None	None
sysom:CreateInstanceInspection	CreateInstanceInspection	create	All Resource ``	None	None
sysom:UninstallAgent	UninstallAgent	delete	All Resource ``	None	None
sysom:GetInstantScore	GetInstantScore	get	All Resource ``	None	None
sysom:StartAifgAnalysis	StartAifgAnalysis	create	All Resource ``	None	None
sysom:ListVmcoreDiagnosisTask	ListVmcoreDiagnosisTask	none	All Resource ``	None	None
sysom:GetHotspotInstanceList	GetHotspotInstanceList	get	All Resource ``	None	None
sysom:GetRangeScore	GetRangeScore	get	All Resource ``	None	None
sysom:GetAgent	GetAgent	get	All Resource ``	None	None
sysom:AuthDiagnosis	AuthDiagnosis	none	All Resource ``	None	None
sysom:UninstallAgentForCluster	UninstallAgentForCluster	create	All Resource ``	None	None

Resource

The following table lists the resources defined by Alibaba Cloud Linux. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Diagnosis	acs:sysom::{#accountId}:diagnosis/* acs:sysom::{#accountId}:diagnosis/{#DiagnosisId}

Condition

Alibaba Cloud Linux does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: