ApsaraMQ for RocketMQ:Policies and examples

Background information

In RAM, a policy is a set of permissions that are described based on the policy syntax and structure. You can use policies to describe the authorized resource sets, authorized action sets, and authorization conditions. For more information, see Policy elements.

ApsaraMQ for RocketMQ provides the following types of RAM policies:

• System policy

  System policies are created and updated by Alibaba Cloud. You can use these policies whereas you cannot modify the policies.

• Custom policies

  You can create, update, and delete custom policies and manage the version updates of these policies. You can modify custom policies and attach the policies to RAM users in the RAM console. For information about sample policies, see Policy examples.

System policy

The following table describes the default system policies that are provided for ApsaraMQ for RocketMQ.

Custom policies

Custom policies allow you to grant fine-grained permissions to users.

In ApsaraMQ for RocketMQ, instances, topics, and groups are used as different types of resources. RAM users can perform actions on these resources only after the RAM users are granted the required permissions on the resources. The naming format of a resource that contains the {groupId} and {topic} parameters varies based on whether the corresponding instance contains a namespace. You can log on to the ApsaraMQ for RocketMQ console. On the Instances page of the instance. You can check the value of the Namespace parameter to determine whether the instance contains a namespace.

The valid values of and the mappings between resources and actions in ApsaraMQ for RocketMQ can be described based on the following dimensions: ApsaraMQ for RocketMQ service, ApsaraMQ for RocketMQ client, console, and API operation. Actions on the console are divided into actions on instances, groups, and tags by resource type.

Permission that is required to activate the ApsaraMQ for RocketMQ service

Permissions that allow ApsaraMQ for RocketMQ clients to send and subscribe to messages

Permissions that are required to manage instances in the ApsaraMQ for RocketMQ console

Permissions that are required to manage groups in the ApsaraMQ for RocketMQ console

Permissions that are required to manage topics in the ApsaraMQ for RocketMQ console

Permissions that are required to manage tags in the ApsaraMQ for RocketMQ console

Permissions that are required to call API operations

The following table describes the API operations provided by ApsaraMQ for RocketMQ and actions that you must authorize a RAM user to perform before the RAM user can call the API operations.

Policy examples

• Example 1: Grant permissions on a topic and a group in an instance.

  You can authorize a RAM user to send messages to a specified topic and subscribe to messages from a specified topic and authorize the RAM user to subscribe to messages from a specified group. To implement the authorization, configure a policy based on the following examples:

  • The following example is used for an instance that contains a namespace:

    {
            "Version":"1",
            "Statement":[
                {    // Grant the following permission on an instance. Before you grant permissions on a topic or a group, you must first grant the following permission on the corresponding instance. This applies to an instance that contains a namespace. 
                    "Effect":"Allow",
                    "Action":[
                        "mq:QueryInstanceBaseInfo"
                    ],
                    "Resource":[
                        "acs:mq:*:*:{instanceId}"
                    ]
                },
                {    // Grant the permissions that are required to send messages to a specified topic and subscribe to messages from a specified topic. 
                    "Effect":"Allow",
                    "Action":[
                        "mq:PUB",    
                        "mq:SUB"
                    ],
                    "Resource":[
                        "acs:mq:*:*:{instanceId}%{topic}"
                    ]
                },
                {    // Grant the required permissions on a specified group. 
                    "Effect":"Allow",
                    "Action":[
                        "mq:SUB"
                    ],
                    "Resource":[
                        "acs:mq:*:*:{instanceId}%{groupId}"
                    ]
                }
            ]
        }                    

  • The following example applies to an instance that does not contain a namespace.

    {
        "Version":"1",
        "Statement":[
            {    // Grant the following permission on an instance. Before you grant permissions on a topic or a group, you must first grant the following permission on the corresponding instance. This applies to an instance that does not contain a namespace. 
                "Effect":"Allow",
                "Action":[
                    "mq:QueryInstanceBaseInfo"
                ],
                "Resource":[
                    "acs:mq:*:*:{instanceId}"
                ]
            },
            {    // Grant the permissions that are required to send messages to a specified topic and subscribe to messages from a specified topic. 
                "Effect":"Allow",
                "Action":[
                    "mq:PUB",    
                    "mq:SUB"
                ],
                "Resource":[
                    "acs:mq:*:*:{topic}"
                ]
            },
            {   // Grant permissions on a specified group. 
                "Effect":"Allow",
                "Action":[
                    "mq:SUB"
                ],
                "Resource":[
                    "acs:mq:*:*:{groupId}"
                ]
            }
        ]
    }                    

• Example 2: Grant all permissions on an instance. This example applies only to an instance that contains a namespace.

  To grant all permissions on all resources in an instance, configure a policy based on the following example:

  {   // This applies only to an instance that contains a namespace. 
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "mq:*"
              ],
              "Resource": [
                  "acs:mq:*:*:{instanceId}*" // Grant all permissions on the instance. Replace {instanceId} with your instance ID. 
              ]
          }
      ]
  }          

References

• Create a custom policy
• Create a RAM user
• Grant permissions to a RAM user
• Use RAM to limit the IP addresses that are allowed to access Alibaba Cloud resources