All Products
Search

This Product

    ApsaraMQ for MQTT:RAM policies for ApsaraMQ for MQTT

    Document Center

    ApsaraMQ for MQTT:RAM policies for ApsaraMQ for MQTT

    Last Updated:Mar 11, 2026

    Resource Access Management (RAM) lets you control access to your ApsaraMQ for MQTT resources without sharing the AccessKey pair of your Alibaba Cloud account with other users. An AccessKey pair consists of an AccessKey ID and an AccessKey secret. You can create RAM users and grant each user only the permissions they need.

    How access control works

    ApsaraMQ for MQTT authorizes access through RAM policies. Each policy specifies which actions a RAM user can perform on which resources. There are four resource types:

    Resource typeDescriptionNaming formatExample
    InstanceAn MQTT broker instanceacs:mq:*:*:instance/{mqttInstanceId}acs:mq:*:*:instance/post-cn-09k1noy****
    TopicA message topic within an instanceacs:mq:*:*:topic/{mqttInstanceId}/{topic}acs:mq:*:*:topic/post-cn-09k1noy**<b data-pending="uicontrol" id="pending_017209d0">/Topic_</b>**
    GroupA client group within an instanceacs:mq:*:*:groupId/{mqttInstanceId}/{gid}acs:mq:*:*:groupId/post-cn-09k1noy**<b data-pending="uicontrol" id="pending_7dfa6d2e">/GID_</b>**
    RuleA data routing rule within an instanceacs:mq:*:*:rule/{mqttInstanceId}/{ruleId}acs:mq:*:*:rule/post-cn-09k1noy**<b data-pending="uicontrol" id="pending_34ea50ef">/111</b>**

    Two types of policies are available:

    • System policies -- Predefined by Alibaba Cloud. Ready to use, but not editable.

    • Custom policies -- Defined and maintained by you. You maintain the policy versions. Provide fine-grained, resource-level access control.

    For details on policy syntax, see Policy structure and syntax. For the resource element format, see Resource.

    Instance access prerequisite

    Before you grant permissions on any topic, group, or rule, you must first grant the mq:MqttInstanceAccess action on the parent instance. Without instance-level access, the RAM user cannot reach the resources within that instance.

    This prerequisite applies to all permission categories: console operations, API calls, and client publish/subscribe.

    System policies

    ApsaraMQ for MQTT provides four default system policies.

    PolicyDescription
    AliyunMQFullAccessFull management access to all ApsaraMQ for MQTT operations in the console, equivalent to an Alibaba Cloud account.
    AliyunMQPubOnlyAccessPublish-only access. Allows publishing messages through SDKs to all resources under the Alibaba Cloud account.
    AliyunMQSubOnlyAccessSubscribe-only access. Allows subscribing to messages through SDKs from all resources under the Alibaba Cloud account.
    AliyunMQReadOnlyAccessRead-only access. Allows viewing resource information in the console or through API calls.
    Important

    ApsaraMQ for MQTT does not have its own independent system policies. These policies are shared with ApsaraMQ for RocketMQ -- attaching any of these policies to a RAM user grants access to both services.

    AliyunMQFullAccess and AliyunMQReadOnlyAccess do not include permissions to view the instance list in the console. Grant mq:MqttInstanceAccess separately to enable instance list access. See Instance management actions.

    Custom policy actions

    Custom policies let you specify exactly which actions a RAM user can perform on specific resources. The following sections list all available actions grouped by scope.

    For sample custom policies, see Sample permission policies.

    Client publish and subscribe actions

    These actions control message publishing and subscribing through ApsaraMQ for MQTT SDKs.

    Resource naming formats:

    • Topic: acs:mq:*:*:topic/{mqttInstanceId}/{topic}

    • Group ID: acs:mq:*:*:groupId/{mqttInstanceId}/{gid}

    ActionDescription
    mq:PUBPublish messages to a topic
    mq:SUBSubscribe to messages from a topic
    Client publish and subscribe permissions cannot be granted across Alibaba Cloud accounts.

    Instance management actions

    Resource naming format: acs:mq:*:*:instance/{mqttInstanceId}

    ActionDescription
    mq:MqttInstanceAccessQuery basic instance information. Required before granting any topic, group, or rule permissions.
    mq:ListMqttInstanceList all instances
    mq:UpdateMqttInstanceModify instance information
    mq:DeleteMqttInstanceDelete an instance
    mq:UpdateMqttInstanceWarnUpdate alert settings for an instance
    mq:MqttMetaDataAccess the Overview page and homepage in the ApsaraMQ for MQTT console
    After you grant mq:MqttMetaData, also grant mq:ListMqttInstance so that the RAM user can view the instance list in the console.

    Topic management actions

    Resource naming format: acs:mq:*:*:topic/{mqttInstanceId}/{topic}

    ActionDescription
    mq:CreateMqttTopicCreate a topic
    mq:DeleteMqttTopicDelete a topic
    mq:ListMqttTopicList topics
    mq:UpdateMqttTopicUpdate a topic description
    mq:QueryMqttClientByTopicQuery which clients subscribe to a topic
    mq:QueryMqttMsgTransTrendQuery messaging statistics for a topic
    mq:SendMqttMessageByConsoleSend a test message from the console

    Group management actions

    Resource naming format: acs:mq:*:*:groupId/{mqttInstanceId}/{gid}

    ActionDescription
    mq:CreateMqttGroupIdCreate a group
    mq:DeleteMqttGroupIdDelete a group
    mq:ListMqttGroupIdList groups
    mq:QueryMqttClientByClientIdQuery client information by client ID
    mq:QueryMqttClientByGroupIdQuery client information by group ID
    mq:QueryMqttHistoryOnlineQuery historical online connections by group ID
    mq:QueryMqttTraceDeviceTrace a specific client
    mq:QueryMqttDeviceTraceQuery details of a specific client

    Rule management actions

    Resource naming format: acs:mq:*:*:rule/{mqttInstanceId}/{ruleId}

    When you grant rule permissions, make sure the related instances, topics, and groups all belong to the same Alibaba Cloud account.

    ActionDescription
    mq:CreateMqttInboundRuleCreate a data inbound rule
    mq:DeleteMqttInboundRuleDelete a data inbound rule
    mq:ListMqttInboundRuleList data inbound rules
    mq:UpdateMqttInboundRuleUpdate a data inbound rule
    mq:CreateMqttOutboundRuleCreate a data outbound rule
    mq:DeleteMqttOutboundRuleDelete a data outbound rule
    mq:ListMqttOutboundRuleList data outbound rules
    mq:UpdateMqttOutboundRuleUpdate a data outbound rule
    mq:CreateClientStatusNotifyRuleCreate a client status notification rule
    mq:DeleteClientStatusNotifyRuleDelete a client status notification rule
    mq:ListClientStatusNotifyRuleList client status notification rules
    mq:UpdateClientStatusNotifyRuleUpdate a client status notification rule

    API operation permissions

    Each API operation requires mq:MqttInstanceAccess plus one or more additional actions. For rule-related APIs, make sure the related instances, topics, and groups all belong to the same Alibaba Cloud account.

    Token management

    APIResource naming formatRequired actions
    ApplyTokenInstance: acs:mq:*:*:instance/{mqttInstanceId}, Topic: acs:mq:*:*:topic/{mqttInstanceId}/{topic}mq:MqttInstanceAccess, mq:ApplyToken
    RevokeTokenacs:mq:*:*:*mq:MqttInstanceAccess, mq:RevokeToken
    QueryTokenacs:mq:*:*:*mq:MqttInstanceAccess, mq:QueryToken

    Message operations

    APIRequired actions
    SendMessagemq:MqttInstanceAccess, mq:SendMessage

    Group operations

    All group API operations use the following resource naming formats:

    • Instance: acs:mq:*:*:instance/{mqttInstanceId}

    • Group: acs:mq:*:*:groupId/{mqttInstanceId}/{gid}

    APIRequired actions
    CreateGroupIdmq:MqttInstanceAccess, mq:CreateMqttGroupId
    DeleteGroupIdmq:MqttInstanceAccess, mq:DeleteMqttGroupId
    ListGroupIdmq:MqttInstanceAccess, mq:ListMqttGroupId
    QuerySessionByClientIdmq:MqttInstanceAccess, mq:QuerySessionByClientId
    BatchQuerySessionByClientIdsmq:MqttInstanceAccess, mq:BatchQuerySessionByClientIds

    Device credential operations

    APIRequired actions
    RegisterDeviceCredentialmq:MqttInstanceAccess, mq:RegisterDeviceCredential
    GetDeviceCredentialmq:MqttInstanceAccess, mq:GetDeviceCredential
    ListDeviceCredentialClientIdmq:MqttInstanceAccess, mq:ListDeviceCredentialClientId
    UnRegisterDeviceCredentialmq:MqttInstanceAccess, mq:UnRegisterDeviceCredential
    RefreshDeviceCredentialmq:MqttInstanceAccess, mq:RefreshDeviceCredential

    Message trace operations

    APIResource naming formatRequired actions
    QueryMqttTraceDevice--mq:MqttInstanceAccess, mq:QueryMqttDeviceTrace
    QueryMqttTraceMessageOfClient--mq:MqttInstanceAccess, mq:QueryMqttDeviceTrace
    QueryMqttTraceMessagePublishInstance: acs:mq:*:*:instance/{mqttInstanceId}mq:MqttInstanceAccess, mq:QueryMqttPubTrace
    QueryMqttTraceMessageSubscribe--mq:MqttInstanceAccess, mq:QueryMqttSubTrace

    Custom authentication operations

    APIRequired actions
    AddCustomAuthIdentitymq:MqttInstanceAccess, mq:AddCustomAuthIdentity
    QueryCustomAuthIdentitymq:MqttInstanceAccess, mq:QueryCustomAuthIdentity
    UpdateCustomAuthIdentitymq:MqttInstanceAccess, mq:UpdateCustomAuthIdentity
    DeleteCustomAuthIdentitymq:MqttInstanceAccess, mq:DeleteCustomAuthIdentity
    AddCustomAuthPermissionmq:MqttInstanceAccess, mq:AddCustomAuthPermission
    QueryCustomAuthPermissionmq:MqttInstanceAccess, mq:QueryCustomAuthPermission
    UpdateCustomAuthPermissionmq:MqttInstanceAccess, mq:UpdateCustomAuthPermission
    DeleteCustomAuthPermissionmq:MqttInstanceAccess, mq:DeleteCustomAuthPermission
    AddCustomAuthConnectBlackmq:MqttInstanceAccess, mq:DeleteCustomAuthConnectBlack
    QueryCustomAuthConnectBlackmq:MqttInstanceAccess, mq:QueryCustomAuthConnectBlack
    DeleteCustomAuthConnectBlackmq:MqttInstanceAccess, mq:AddCustomAuthConnectBlack

    Topic operations

    All topic API operations use the following resource naming formats:

    • Instance: acs:mq:*:*:instance/{mqttInstanceId}

    • Topic: acs:mq:*:*:topic/{mqttInstanceId}/{topic}

    APIRequired actions
    CreateTopicmq:MqttInstanceAccess, mq:CreateMqttTopic
    ListTopicsmq:MqttInstanceAccess, mq:SUB, mq:ListMqttTopic
    DeleteTopicmq:MqttInstanceAccess, mq:PUB, mq:DeleteMqttTopic
    UpdateTopicmq:MqttInstanceAccess, mq:UpdateMqttTopic

    Rule operations

    All rule API operations use the following resource naming formats:

    • Instance: acs:mq:*:*:instance/{mqttInstanceId}

    • Rule: acs:mq:*:*:rule/{mqttInstanceId}/{ruleId}

    APIRequired actions
    CreateMqttInboundRulemq:MqttInstanceAccess, mq:CreateMqttInboundRule
    ListMqttInboundRuleInPagesmq:MqttInstanceAccess, mq:ListMqttInboundRule
    UpdateMqttInboundRulemq:MqttInstanceAccess, mq:UpdateMqttInboundRule
    DeleteMqttInboundRulemq:MqttInstanceAccess, mq:DeleteMqttInboundRule
    CreateMqttOutboundRulemq:MqttInstanceAccess, mq:CreateMqttOutboundRule
    ListMqttOutboundRuleInPagesmq:MqttInstanceAccess, mq:ListMqttOutboundRule
    UpdateMqttOutboundRulemq:MqttInstanceAccess, mq:UpdateMqttOutboundRule
    DeleteMqttOutboundRulemq:MqttInstanceAccess, mq:DeleteMqttOutboundRule
    CreateClientStatusNotifyRulemq:MqttInstanceAccess, mq:CreateClientStatusNotifyRule
    ListClientStatusNotifyRuleInPagesmq:MqttInstanceAccess, mq:ListClientStatusNotifyRule
    UpdateClientStatusNotifyRulemq:MqttInstanceAccess, mq:UpdateClientStatusNotifyRule
    DeleteClientStatusNotifyRulemq:MqttInstanceAccess, mq:DeleteClientStatusNotifyRule

    Disaster recovery operations

    APIRequired actions
    DisasterDowngrademq:MqttInstanceAccess, mq:DisasterDowngrade
    DisasterRecoverymq:MqttInstanceAccess, mq:DisasterRecovery

    For the complete API reference, see List of operations by function.

    See also