API Gateway:Use RAM to manage API permissions

• RAM users can view, create, or delete API groups, APIs, or plug-ins in API Gateway. They do not own these resources — the Alibaba Cloud account can revoke their permissions at any time.

• Tag-based authorization can isolate resources between the Alibaba Cloud account and RAM users.

• Before you manage API permissions with RAM, familiarize yourself with RAM and API Gateway. Alibaba Cloud Help Center provides documentation on RAM and API Gateway for you to get familiar with the services.

Policy overview

A policy defines permissions using four elements: Effect, Resource, Action, and Condition.

1. System policy

API Gateway provides two built-in system policies. View them on the Policies page of the RAM console.

• AliyunApiGatewayFullAccess: grants full management permissions on all API Gateway resources, including API groups, APIs, throttling policies, and applications.

• AliyunApiGatewayReadOnlyAccess: grants read-only access to all API Gateway resources, including API groups, APIs, throttling policies, and applications. However, the RAM user cannot manage the resources.

2. Custom policy

Create a custom policy to grant finer-grained permissions on specific actions or resources. For example, you can create a custom policy to grant the edit permissions on GetUsers. To view your custom policies, log on to the RAM console, choose Permissions > Policies, and select Custom Policy from the Policy Type drop-down list.

Policy syntax

A policy uses a specific syntax to define permissions. Attach a policy to a user or group to grant permissions on specific resources.

Example:

{
  "Version": "1",
  "Statement": [
    {
  "Action": "apigateway:Describe*",
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}
                

 "Action":"<service-name>:<action-name>"

Resource syntax

The Resource element specifies the objects that a statement covers. In API Gateway, you can specify API groups, throttling policies, and applications. Use the following format:

acs:<service-name>:<region>:<account-id>:<relative-id>

Parameters:

• acs: the Alibaba Cloud public cloud namespace.

• service-name: the Alibaba Cloud service name. Set to apigateway for API Gateway.

• region: the region where the policy applies. Use the wildcard (*) for all regions.

• account-id: the account ID, such as 123456789012****. Supports the wildcard (*).

• relative-id: the resource identifier, specified in a file-path-like format.

An RDPath is in one of the following formats:

acs:apigateway:$regionid:$accountid:apigroup/$groupId

Example:

acs:apigateway:*:*:apigroup/cbd157704e624ab58a204fd3e0b5ad79

The following table lists the API operations available for the action-name parameter in API Gateway policies. For more information, see "API Gateway API Reference".

Examples

Authorize a RAM user to query all APIs:

{
          "Version": "1",
          "Statement": [
            {
                      "Action": "apigateway:Describe*",
                      "Resource":"acs:apigateway:$regionid:$accountid:apigroup/*",
                      "Effect": "Allow"
            }
          ]
}                        

Authorize a RAM user to query all API groups to which the `version:v1` tag is attached:

{
	  "Version": "1",
	  "Statement": [
	    {
      		"Action": "apigateway:Describe*",
	      	"Resource":"acs:apigateway:$regionid:$accountid:apigroup/*",
	      	"Effect": "Allow", 
                 "Condition": {
                        "StringEquals": {
                             "apigateway:tag/version": "v1"
                        }
                 }
             }
	  ]
}			

Authorize a RAM user to manage all APIs in an API group:

{
          "Version": "1",
          "Statement": [
            {
                      "Action": "apigateway:*",
                      "Resource": [
                              "acs:apigateway:$regionid:$accountid:apigroup/$groupId",
                              "acs:apigateway:$regionid:$accountid:app/$appId",
                              "acs:apigateway:$regionid:$accountid:vpcaccess/*"
                      ],
                      "Effect": "Allow"
            }
          ]
}

Note: In the preceding examples, you can specify the wildcard character (*) for variables based on your business requirements.