ApsaraMQ for RabbitMQ:Creating custom policies for RAM identities

Related operations

• Create a custom policy

• Modify the document and description of a custom policy

• Delete a custom policy

• Manage access policy authorizations

• Manage custom policy versions

Resource hierarchy

instances/
├── $instanceId/
│   ├── vhosts/
│   │   └── $vhostName/
│   │       ├── exchanges/
│   │       │   └── $exchangeName/
│   │       │       └── messages/*
│   │       └── queues/
│   │           └── $queueName/
│   │               └── messages/*
│   └── staticAccount/*

For supported regions, see Endpoints.

Client API actions

RAM wildcard matching rules

Wildcards (*) in RAM policies match by Action name prefix. amqp:Get* matches any Action that starts with Get (such as amqp:GetInstance or amqp:GetQueue), and does not match Actions that start with other words. amqp:BasicGet starts with Basic, so it is not matched by amqp:Get*. To call BasicGet to consume messages, you must explicitly add amqp:BasicGet to the Action list.

Common permission errors and required Actions

If an API call returns UnauthorizedOperation and the AccessDeniedDetail shows NoPermissionType=ImplicitDeny, the policy is missing the required Action. A common scenario is configuring amqp:Get* without adding amqp:BasicGet. In this case, explicitly add amqp:BasicGet.

Policy example:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "amqp:Get*",
                "amqp:List*",
                "amqp:BasicGet"
            ],
            "Resource": "*"
        }
    ]
}

Console and OpenAPI actions

Condition keys for CreateInstance

The CreateInstance action supports the following condition keys to restrict instance creation. For more information, see Condition.

Example 1: Full messaging access to a vhost

Grants permissions to publish, consume, and manage exchanges, queues, and static account credentials within a specific vhost.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "amqp:GetInstance",
                "amqp:ListVhost",
                "amqp:GetVhost"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:ListExchange",
                "amqp:CreateExchange",
                "amqp:DeleteExchange",
                "amqp:ListQueue",
                "amqp:DeleteQueue",
                "amqp:CreateQueue",
                "amqp:BasicRecover",
                "amqp:BasicCancel",
                "amqp:BasicPublish",
                "amqp:BasicConsume",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:BasicReject",
                "amqp:QueuePurge",
                "amqp:BasicGet",
                "amqp:GetExchange",
                "amqp:GetQueue"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:ListStaticAccounts",
                "amqp:FetchStaticAccount",
                "amqp:DeleteStaticAccount"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
            "Effect": "Allow"
        }
    ]
}

Example 2: Publish messages

Grants the minimum permissions for a producer client to publish messages to exchanges within a specific vhost: declare exchanges and queues, publish messages, and acknowledge delivery.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "amqp:GetInstance"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:CreateExchange",
                "amqp:CreateQueue",
                "amqp:BasicRecover",
                "amqp:BasicPublish",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:GetExchange",
                "amqp:GetQueue"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
            "Effect": "Allow"
        }
    ]
}

Example 3: Consume messages

Grants the minimum permissions for a consumer client to consume messages from queues within a specific vhost: declare exchanges and queues, consume messages, and manage acknowledgments.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "amqp:GetInstance",
                "amqp:GetVhost"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:CreateExchange",
                "amqp:CreateQueue",
                "amqp:BasicRecover",
                "amqp:BasicCancel",
                "amqp:BasicConsume",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:BasicReject",
                "amqp:QueuePurge",
                "amqp:BasicGet",
                "amqp:GetExchange",
                "amqp:GetQueue"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
            "Effect": "Allow"
        }
    ]
}

Example 4: Publish and consume messages

Grants permissions to both publish and consume messages within a specific vhost. Combines the actions from Example 2 and Example 3.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "amqp:GetInstance",
                "amqp:GetVhost"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:ListExchange",
                "amqp:CreateExchange",
                "amqp:DeleteExchange",
                "amqp:ListQueue",
                "amqp:DeleteQueue",
                "amqp:CreateQueue",
                "amqp:BasicRecover",
                "amqp:BasicCancel",
                "amqp:BasicPublish",
                "amqp:BasicConsume",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:BasicReject",
                "amqp:QueuePurge",
                "amqp:BasicGet",
                "amqp:GetExchange",
                "amqp:GetQueue"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
            "Effect": "Allow"
        }
    ]
}

Example 5: Manage static account credentials

Grants permissions to list, create, and delete static account credentials (username and password pairs) for a specific instance.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "amqp:ListStaticAccounts",
                "amqp:FetchStaticAccount",
                "amqp:DeleteStaticAccount"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*"
        },
        {
            "Effect": "Allow",
            "Action": "amqp:GetInstance",
            "Resource": "acs:amqp:*:*:/instances/$instanceId"
        }
    ]
}

Example 6: Create instances

Grants permissions to create ApsaraMQ for RabbitMQ instances of any edition in any region.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "amqp:CreateInstance",
            "Resource": "acs:amqp:*:$accountid:/instances/*"
        }
    ]
}

Example 7: Create Platinum Edition instances without internet access

Uses condition keys to restrict instance creation to Platinum Edition (vip) instances that do not support internet access (SupportEIP: false).

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "amqp:CreateInstance",
            "Resource": "acs:amqp:*:$accountid:/instances/*",
            "Condition": {
                "StringEquals": {
                    "amqp:InstanceType": [
                        "vip"
                    ],
                    "amqp:SupportEIP": [
                        "false"
                    ]
                }
            }
        }
    ]
}

Example 8: Full access to a single instance

Grants all ApsaraMQ for RabbitMQ permissions on a single instance, including vhost management, messaging operations, and static account management. The amqp:ListInstance action is scoped to all instances so the target instance appears in the console instance list.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "amqp:ListInstance",
            "Resource": "acs:amqp:*:*:/instances/*",
            "Effect": "Allow"
        },
        {
            "Action": "amqp:*",
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId",
                "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "amqp:ListStaticAccounts",
                "amqp:FetchStaticAccount",
                "amqp:DeleteStaticAccount"
            ],
            "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
            "Effect": "Allow"
        }
    ]
}

Example 9: Grant different RAM users access to different queues

To let RAM user A access only Queue A and RAM user B access only Queue B, create two separate custom policies and attach each one to the corresponding RAM user. Each RAM user can then perform only the permitted actions on the queue specified in its own policy.

Policy for RAM user A (grants access to queueA):

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "amqp:BasicConsume",
                "amqp:BasicPublish",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:GetQueue"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/queues/queueA"
            ]
        }
    ]
}

For RAM user B, create a second policy that is identical except that the Resource value points to queueB, and then attach it to RAM user B:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "amqp:BasicConsume",
                "amqp:BasicPublish",
                "amqp:BasicAck",
                "amqp:BasicNack",
                "amqp:GetQueue"
            ],
            "Resource": [
                "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/queues/queueB"
            ]
        }
    ]
}