ApsaraMQ for RabbitMQ:Open-source authentication and permission management

Limitations

• Only newly purchased exclusive-cluster serverless instances are supported.

• The default guest account cannot be created or managed.

• User tag-based permission management is not supported. For details on managing permissions via the console or OpenAPI, see RAM access control.

• You must choose either open-source authentication or Alibaba Cloud Resource Access Management (RAM) when configuring an instance. This choice is irreversible.

• Enabling open-source authentication on an exclusive-cluster serverless instance prevents downgrading to a shared instance.

How it works

ApsaraMQ for RabbitMQ controls access at the vhost level. You assign configure, write, and read permissions to exchanges and queues using regular expressions:

• .* grants access to all resources.

• ^$ matches the empty string, blocking all access.

• '^(amq\.gen.*|amq\.default)$' allows access to system resources and the default exchange.

The following table describes how typical AMQP 0-9-1 operations map to these permissions:

Access control has two stages:

1. Vhost access: A connecting client specifies a vhost. The server verifies the user has access and rejects the connection otherwise.

2. Resource operations: The server checks whether the user has the required permissions for each exchange or queue operation.

Network security

When using open-source authentication and permission management, ApsaraMQ for RabbitMQ enhances security as follows:

User and permission management

ApsaraMQ for RabbitMQ lets you create users and manage permissions in the console. For step-by-step guidance, see Permissions.