RAM authorization - API Gateway - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by API Gateway for RAM permission policies. The RAM code (RamCode) for API Gateway is apigateway,cloudapi , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by API Gateway. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
apigateway:AddAccessControlListEntry	AddAccessControlListEntry	update	*AccessControlList `acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId}`	None	None
apigateway:OpenApiGatewayService	OpenApiGatewayService	none	All Resource ``	None	None
apigateway:DescribeGroupQps	DescribeGroupQps	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteDataset	DeleteDataset	delete	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:DescribeInstanceQps	DescribeInstanceQps	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribeAppAttributes	DescribeAppAttributes	get	App `acs:apigateway:{#regionId}:{#accountId}:app/`	None	None
apigateway:ModifyPlugin	ModifyPlugin	update	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:DescribeGroupLatency	DescribeGroupLatency	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:SetSignatureApis	SetSignatureApis	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApisByBackend	DescribeApisByBackend	get	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:DescribeVpcAccesses	DescribeVpcAccesses	get	*Vpc `acs:apigateway:{#regionId}:{#accountId}:vpcaccess/{#VpcAccessId}`	None	None
apigateway:CreateApiStageVariable	CreateApiStageVariable	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeLogConfig	DescribeLogConfig	get	*LogConfig `acs:apigateway:{#regionId}:{#accountId}:logconfig/{#LogType}`	None	None
apigateway:DescribeHistoryApis	DescribeHistoryApis	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ResetAppSecret	ResetAppSecret	update	All Resource ``	None	None
apigateway:ModifyApiGroupNetworkPolicy	ModifyApiGroupNetworkPolicy	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApisByIpControl	DescribeApisByIpControl	get	All Resource ``	None	None
apigateway:ModifyApp	ModifyApp	update	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:RemoveApisAuthorities	RemoveApisAuthorities	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteDomain	DeleteDomain	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ModifyTrafficControl	ModifyTrafficControl	update	*TrafficControl `acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/{#TrafficControlId}`	None	None
apigateway:AddTrafficSpecialControl	AddTrafficSpecialControl	create	*TrafficControl `acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/{#TrafficControlId}`	None	None
apigateway:DeleteSignature	DeleteSignature	delete	All Resource ``	None	None
apigateway:DeleteTrafficSpecialControl	DeleteTrafficSpecialControl	delete	All Resource ``	None	None
apigateway:RemoveAccessControlListEntry	RemoveAccessControlListEntry	update	*AccessControlList `acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId}`	None	None
apigateway:ModifyVpcAccessAndUpdateApis	ModifyVpcAccessAndUpdateApis	update	All Resource ``	None	None
apigateway:SetDomainWebSocketStatus	SetDomainWebSocketStatus	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeInstanceDropConnections	DescribeInstanceDropConnections	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribeTrafficControlsByApi	DescribeTrafficControlsByApi	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApps	DescribeApps	get	App `acs:apigateway:{#regionId}:{#accountId}:app/`	None	None
apigateway:CreateLogConfig	CreateLogConfig	create	All Resource ``	None	None
apigateway:DescribeApiIpControls	DescribeApiIpControls	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteDatasetItem	DeleteDatasetItem	delete	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:UpdatePrivateDNS	UpdatePrivateDNS	update	All Resource ``	None	None
apigateway:DescribeAccessControlListAttribute	DescribeAccessControlListAttribute	get	All Resource ``	None	None
apigateway:ModifyIpControl	ModifyIpControl	update	All Resource ``	None	None
apigateway:CreatePlugin	CreatePlugin	create	Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/`	None	None
apigateway:CreateApi	CreateApi	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribePluginSchemas	DescribePluginSchemas	get	All Resource ``	None	None
apigateway:SetDomainCertificate	SetDomainCertificate	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteAllTrafficSpecialControl	DeleteAllTrafficSpecialControl	delete	All Resource ``	None	None
apigateway:DeleteAppKey	DeleteAppKey	delete	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:ModifyDatasetItem	ModifyDatasetItem	update	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:DeleteAccessControlList	DeleteAccessControlList	delete	All Resource ``	None	None
apigateway:DescribeAuthorizedApps	DescribeAuthorizedApps	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiTrafficData	DescribeApiTrafficData	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribePluginsByGroup	DescribePluginsByGroup	get	All Resource ``	None	None
apigateway:DescribeInstancePackets	DescribeInstancePackets	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribeApiQpsData	DescribeApiQpsData	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:AttachGroupPlugin	AttachGroupPlugin	none	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:ListPrivateDNS	ListPrivateDNS	list	All Resource ``	None	None
apigateway:DescribeSummaryData	DescribeSummaryData	get	All Resource ``	None	None
apigateway:ModifyApi	ModifyApi	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeModels	DescribeModels	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiProductApis	DescribeApiProductApis	get	All Resource ``	None	None
apigateway:DescribeUpdateVpcInfoTask	DescribeUpdateVpcInfoTask	get	All Resource ``	None	None
apigateway:AssociateInstanceWithPrivateDNS	AssociateInstanceWithPrivateDNS	update	All Resource ``	None	None
apigateway:ModifyInstanceAttribute	ModifyInstanceAttribute	update	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DeleteInstance	DeleteInstance	delete	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:ModifyLogConfig	ModifyLogConfig	update	All Resource ``	None	None
apigateway:DescribeSignaturesByApi	DescribeSignaturesByApi	get	All Resource ``	None	None
apigateway:SetApiProductsAuthorities	SetApiProductsAuthorities	create	All Resource ``	None	None
apigateway:DescribeDatasetItemList	DescribeDatasetItemList	get	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:RemoveSignatureApis	RemoveSignatureApis	delete	All Resource ``	None	None
apigateway:RemoveTrafficControlApis	RemoveTrafficControlApis	delete	All Resource ``	None	None
apigateway:DeleteApi	DeleteApi	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:RemoveAppsAuthorities	RemoveAppsAuthorities	delete	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}` App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppIds}`	None	None
apigateway:DeleteTrafficControl	DeleteTrafficControl	delete	*TrafficControl `acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/{#TrafficControlId}`	None	None
apigateway:SetAccessControlListAttribute	SetAccessControlListAttribute	update	*AccessControlList `acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId}`	None	None
apigateway:SdkGenerateByAppForRegion	SdkGenerateByAppForRegion	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:DeleteApp	DeleteApp	delete	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:SetApisAuthorities	SetApisAuthorities	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:CreateDataset	CreateDataset	create	Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/`	None	None
apigateway:DescribeDomain	DescribeDomain	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeDatasetInfo	DescribeDatasetInfo	get	All Resource ``	None	None
apigateway:DescribeApisWithStageNameIntegratedByApp	DescribeApisWithStageNameIntegratedByApp	get	All Resource ``	None	None
apigateway:DescribeTrafficControls	DescribeTrafficControls	get	*TrafficControl `acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/{#TrafficControlId}`	None	None
apigateway:AddIpControlPolicyItem	AddIpControlPolicyItem	create	*IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId}`	None	None
apigateway:DeployApi	DeployApi	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ImportOAS	ImportOAS	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:BatchAbolishApis	BatchAbolishApis	update	All Resource ``	None	None
apigateway:CreateTrafficControl	CreateTrafficControl	create	TrafficControl `acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/`	None	None
apigateway:DeleteApiGroup	DeleteApiGroup	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:SdkGenerateByGroup	SdkGenerateByGroup	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ModifyIpControlPolicyItem	ModifyIpControlPolicyItem	update	*IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId}`	None	None
apigateway:CreateIpControl	CreateIpControl	create	IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/`	None	None
apigateway:CreateModel	CreateModel	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeSystemParameters	DescribeSystemParameters	get	All Resource ``	None	None
apigateway:ModifyInstanceVpcAttributeForConsole	ModifyInstanceVpcAttributeForConsole	update	All Resource ``	None	None
apigateway:DeleteDomainCertificate	DeleteDomainCertificate	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiGroup	DescribeApiGroup	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DryRunSwagger	DryRunSwagger	none	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ExportOAS	ExportOAS	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiSignatures	DescribeApiSignatures	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DetachApiProduct	DetachApiProduct	delete	All Resource ``	None	None
apigateway:DescribeDeployApiTask	DescribeDeployApiTask	get	All Resource ``	None	None
apigateway:DescribeApiLatencyData	DescribeApiLatencyData	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApp	DescribeApp	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:DescribeApiTrafficControls	DescribeApiTrafficControls	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApis	DescribeApis	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeAppSecurity	DescribeAppSecurity	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:SdkGenerateByApp	SdkGenerateByApp	create	All Resource ``	None	None
apigateway:DeleteApiProduct	DeleteApiProduct	delete	All Resource ``	None	None
apigateway:SetVpcAccess	SetVpcAccess	update	Vpc `acs:apigateway:{#regionId}:{#accountId}:vpcaccess/`	None	None
apigateway:CreateApiGroup	CreateApiGroup	create	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/`	None	None
apigateway:DissociateInstanceWithPrivateDNS	DissociateInstanceWithPrivateDNS	update	All Resource ``	None	None
apigateway:DescribeBackendList	DescribeBackendList	get	Backend `acs:apigateway:{#regionId}:{#accountId}:backend/`	None	None
apigateway:ModifyApiConfiguration	ModifyApiConfiguration	update	All Resource ``	None	None
apigateway:ModifySignature	ModifySignature	update	All Resource ``	None	None
apigateway:SetAppsAuthorities	SetAppsAuthorities	update	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}` App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppIds}`	None	None
apigateway:DeleteModel	DeleteModel	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeMarketRemainsQuota	DescribeMarketRemainsQuota	get	All Resource ``	None	None
apigateway:ListTagResources	ListTagResources	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#ResourceId}`	None	None
apigateway:DescribeAbolishApiTask	DescribeAbolishApiTask	get	All Resource ``	None	None
apigateway:DescribeInstanceNewConnections	DescribeInstanceNewConnections	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribePurchasedApiGroup	DescribePurchasedApiGroup	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:CreatePrivateDNS	CreatePrivateDNS	create	All Resource ``	None	None
apigateway:CreateAppKey	CreateAppKey	create	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:RemoveVpcAccessAndAbolishApis	RemoveVpcAccessAndAbolishApis	delete	All Resource ``	None	None
apigateway:DescribeIpControls	DescribeIpControls	get	IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/`	None	None
apigateway:CreateSignature	CreateSignature	create	All Resource ``	None	None
apigateway:DescribeDeployedApis	DescribeDeployedApis	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribePluginTemplates	DescribePluginTemplates	get	All Resource ``	None	None
apigateway:CreateDatasetItem	CreateDatasetItem	create	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:RemoveIpControlApis	RemoveIpControlApis	delete	All Resource ``	None	None
apigateway:DescribeInstances	DescribeInstances	get	Instance `acs:apigateway:{#regionId}:{#accountId}:instance/`	None	None
apigateway:AbolishApi	AbolishApi	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:CreateAppCode	CreateAppCode	create	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:RemoveIpControlPolicyItem	RemoveIpControlPolicyItem	delete	*IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId}`	None	None
apigateway:CreateApp	CreateApp	create	App `acs:apigateway:{#regionId}:{#accountId}:app/`	None	None
apigateway:DescribeApisBySignature	DescribeApisBySignature	get	All Resource ``	None	None
apigateway:ModifyInstanceSpec	ModifyInstanceSpec	update	All Resource ``	None	None
apigateway:ModifyApiGroup	ModifyApiGroup	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteMonitorGroup	DeleteMonitorGroup	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:EnableInstanceAccessControl	EnableInstanceAccessControl	update	*AccessControlList `acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId}`	None	None
apigateway:DescribeDatasetItemInfo	DescribeDatasetItemInfo	get	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:DeletePrivateDNS	DeletePrivateDNS	delete	All Resource ``	None	None
apigateway:DescribeApi	DescribeApi	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:QueryRequestLogs	QueryRequestLogs	get	All Resource ``	None	None
apigateway:DeletePlugin	DeletePlugin	delete	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:SetDomain	SetDomain	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteApiStageVariable	DeleteApiStageVariable	delete	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiProductsByApp	DescribeApiProductsByApp	get	All Resource ``	None	None
apigateway:DisableInstanceAccessControl	DisableInstanceAccessControl	update	*AccessControlList `acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId}`	None	None
apigateway:DescribeApiMarketAttributes	DescribeApiMarketAttributes	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ModifyIntranetDomainPolicy	ModifyIntranetDomainPolicy	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DeleteBackend	DeleteBackend	delete	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:DescribeIpControlPolicyItems	DescribeIpControlPolicyItems	get	*IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId}`	None	None
apigateway:DescribeInstanceClusterList	DescribeInstanceClusterList	list	All Resource ``	None	None
apigateway:CreateInstance	CreateInstance	create	Instance `acs:apigateway:{#regionId}:{#accountId}:instance/`	None	None
apigateway:ImportSwagger	ImportSwagger	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DetachPlugin	DetachPlugin	update	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:DescribeInstanceClusterInfo	DescribeInstanceClusterInfo	get	All Resource ``	None	None
apigateway:DescribeApiGroups	DescribeApiGroups	get	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/`	None	None
apigateway:SetWildcardDomainPatterns	SetWildcardDomainPatterns	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApisByTrafficControl	DescribeApisByTrafficControl	get	All Resource ``	None	None
apigateway:ModifyModel	ModifyModel	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApisByVpcAccess	DescribeApisByVpcAccess	list	All Resource ``	None	None
apigateway:DetachGroupPlugin	DetachGroupPlugin	none	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:DescribeInstanceSlbConnect	DescribeInstanceSlbConnect	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribeAppsByApiProduct	DescribeAppsByApiProduct	get	All Resource ``	None	None
apigateway:AttachApiProduct	AttachApiProduct	create	All Resource ``	None	None
apigateway:DescribeAppSecurities	DescribeAppSecurities	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:DeleteLogConfig	DeleteLogConfig	delete	*LogConfig `acs:apigateway:{#regionId}:{#accountId}:logconfig/{#LogType}`	None	None
apigateway:BatchDeployApis	BatchDeployApis	update	All Resource ``	None	None
apigateway:CreateBackend	CreateBackend	create	All Resource ``	None	None
apigateway:TagResources	TagResources	create	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#ResourceId}` App `acs:apigateway:{#regionId}:{#accountId}:app/{#ResourceId}`	None	None
apigateway:DescribeInstanceHttpCode	DescribeInstanceHttpCode	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DeleteIpControl	DeleteIpControl	delete	*IpControl `acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId}`	None	None
apigateway:DescribeImportOASTask	DescribeImportOASTask	get	All Resource ``	None	None
apigateway:ModifyBackendModel	ModifyBackendModel	update	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:DescribeInstanceTraffic	DescribeInstanceTraffic	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribeUpdateBackendTask	DescribeUpdateBackendTask	get	All Resource ``	None	None
apigateway:ModifyApiGroupInstance	ModifyApiGroupInstance	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeApiDoc	DescribeApiDoc	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:RemoveApiProductsAuthorities	RemoveApiProductsAuthorities	delete	All Resource ``	None	None
apigateway:DescribePluginApis	DescribePluginApis	get	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:DeleteAppCode	DeleteAppCode	delete	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:ResetAppCode	ResetAppCode	update	All Resource ``	None	None
apigateway:RemoveVpcAccess	RemoveVpcAccess	delete	All Resource ``	None	None
apigateway:DescribeApisByApp	DescribeApisByApp	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:DescribeApiHistories	DescribeApiHistories	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribePurchasedApis	DescribePurchasedApis	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeInstanceDropPacket	DescribeInstanceDropPacket	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:DescribePluginGroups	DescribePluginGroups	get	*Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:CreateMonitorGroup	CreateMonitorGroup	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ModifyBackend	ModifyBackend	update	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:DescribeApiHistory	DescribeApiHistory	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:SwitchApi	SwitchApi	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeDeployedApi	DescribeDeployedApi	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:ReactivateDomain	ReactivateDomain	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribePurchasedApiGroups	DescribePurchasedApiGroups	get	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/`	None	None
apigateway:CreateAccessControlList	CreateAccessControlList	create	All Resource ``	None	None
apigateway:DeleteBackendModel	DeleteBackendModel	delete	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:ModifyDataset	ModifyDataset	update	*Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId}`	None	None
apigateway:DescribeAuthorizedApis	DescribeAuthorizedApis	get	*App `acs:apigateway:{#regionId}:{#accountId}:app/{#AppId}`	None	None
apigateway:CreateBackendModel	CreateBackendModel	create	*Backend `acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId}`	None	None
apigateway:DescribeBackendInfo	DescribeBackendInfo	get	All Resource ``	None	None
apigateway:SetIpControlApis	SetIpControlApis	update	All Resource ``	None	None
apigateway:DescribePlugins	DescribePlugins	get	Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/`	None	None
apigateway:SetAppsAuthToApiProduct	SetAppsAuthToApiProduct	create	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apiproduct/{#ApiProductId}`	None	None
apigateway:DescribeAccessControlLists	DescribeAccessControlLists	get	All Resource ``	None	None
apigateway:DescribeDatasetList	DescribeDatasetList	get	Dataset `acs:apigateway:{#regionId}:{#accountId}:dataset/`	None	None
apigateway:DescribePluginsByApi	DescribePluginsByApi	get	All Resource ``	None	None
apigateway:DescribeApiGroupVpcWhitelist	DescribeApiGroupVpcWhitelist	get	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:SetTrafficControlApis	SetTrafficControlApis	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeGroupTraffic	DescribeGroupTraffic	get	All Resource ``	None	None
apigateway:AttachPlugin	AttachPlugin	update	ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}` Plugin `acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId}`	None	None
apigateway:DescribeInstanceLatency	DescribeInstanceLatency	get	*Instance `acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
apigateway:ModifyApiGroupVpcWhitelist	ModifyApiGroupVpcWhitelist	update	*ApiGroup `acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId}`	None	None
apigateway:DescribeSignatures	DescribeSignatures	get	Signature `acs:apigateway:{#regionId}:{#accountId}:secretkey/`	None	None
apigateway:ValidateVpcConnectivity	ValidateVpcConnectivity	get	All Resource ``	None	None

Resource

The following table lists the resources defined by API Gateway. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
AccessControlList	acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/{#AclId} acs:apigateway:{#regionId}:{#accountId}:accesscontrollist/*
ApiGroup	acs:apigateway:{#regionId}:{#accountId}:apigroup/{#GroupId} acs:apigateway:{#regionId}:{#accountId}:apigroup/* acs:apigateway:{#regionId}:{#accountId}:apigroup/{#ResourceId} acs:apigateway:{#regionId}:{#accountId}:apiproduct/{#ApiProductId}
Dataset	acs:apigateway:{#regionId}:{#accountId}:dataset/{#DatasetId} acs:apigateway:{#regionId}:{#accountId}:dataset/*
Instance	acs:apigateway:{#regionId}:{#accountId}:instance/{#InstanceId} acs:apigateway:{#regionId}:{#accountId}:instance/*
App	acs:apigateway:{#regionId}:{#accountId}:app/* acs:apigateway:{#regionId}:{#accountId}:app/{#AppId} acs:apigateway:{#regionId}:{#accountId}:app/{#AppIds} acs:apigateway:{#regionId}:{#accountId}:app/{#ResourceId}
Plugin	acs:apigateway:{#regionId}:{#accountId}:plugin/{#PluginId} acs:apigateway:{#regionId}:{#accountId}:plugin/*
Backend	acs:apigateway:{#regionId}:{#accountId}:backend/{#BackendId} acs:apigateway:{#regionId}:{#accountId}:backend/*
Vpc	acs:apigateway:{#regionId}:{#accountId}:vpcaccess/{#VpcAccessId} acs:apigateway:{#regionId}:{#accountId}:vpcaccess/*
LogConfig	acs:apigateway:{#regionId}:{#accountId}:logconfig/{#LogType} acs:apigateway:{#regionId}:{#accountId}:logconfig/*
TrafficControl	acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/{#TrafficControlId} acs:apigateway:{#regionId}:{#accountId}:trafficcontrol/*
Signature	acs:apigateway:{#regionId}:{#accountId}:signature/{#SignatureId} acs:apigateway:{#regionId}:{#accountId}:signature/* acs:apigateway:{#regionId}:{#accountId}:secretkey/*
AccessControl	acs:apigateway:{#regionId}:{#accountId}:accesscontrol/{#AclId} acs:cloudapi:{#regionId}:{#accountId}:accesscontrol/{#AclId} acs:apigateway:{#regionId}:{#accountId}:accesscontrol/*
IpControl	acs:apigateway:{#regionId}:{#accountId}:ipcontrol/{#IpControlId} acs:apigateway:{#regionId}:{#accountId}:ipcontrol/*
VpcAccess	acs:apigateway:{#regionId}:{#accountId}:vpcaccess/{#VpcAccessId}

Condition

API Gateway does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: