ApsaraMQ for RocketMQ:Custom policies for ApsaraMQ for RocketMQ

When to use custom policies

System policies grant predefined sets of permissions. Use a custom policy when you need to:

• Restrict access to a specific instance, topic, or consumer group

• Allow only certain actions, such as creating instances or deleting topics

• Combine multiple permission scopes in a single policy

How custom policies work

After you create a custom policy, attach it to a RAM user, RAM user group, or RAM role to grant the specified permissions.

Keep these rules in mind:

• Detach before deleting. You can delete a policy that is not attached to a principal. If the policy is attached to a principal, detach it first.

• Use version control. Custom policies support versioning. You can manage custom policy versions based on the version management mechanism provided by RAM.

Resource ARN format

Each Resource field in a policy uses an Alibaba Cloud Resource Name (ARN) to identify the target. The ARN format for ApsaraMQ for RocketMQ is:

acs:rocketmq:{regionId}:{accountId}:instance/{InstanceId}/topic/{TopicName}

Use wildcards to broaden the scope:

Policy examples

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:ListInstances"
            ],
            "Resource": [
                "acs:rocketmq:{regionId}:{accountId}:instance/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:*"
            ],
            "Resource": [
                "acs:rocketmq:{regionId}:{accountId}:instance/{InstanceId}*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:ListAnalyticsQuery"
            ],
            "Resource": [
                "acs:rocketmq:*:{#accountId}:*/*"
            ]
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:CreateInstance"
            ],
            "Resource": [
                "acs:rocketmq:{regionId}:{accountId}:instance/*"
            ]
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:DeleteTopic"
            ],
            "Resource": [
                "acs:rocketmq:{regionId}:{accountId}:instance/{InstanceId}/topic/{TopicName}"
            ]
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:GetAnalyticsQuery",
                "rocketmq:SubmitAnalyticsQuery",
                "rocketmq:ListAnalyticsQuery"
            ],
            "Resource": [
                "acs:rocketmq:*:{#accountId}:*/*"
            ]
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:ListInstances",
                "rocketmq:GetUserTags"
            ],
            "Resource": [
                "acs:rocketmq:*:*:instance/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rocketmq:*"
            ],
            "Resource": [
                "acs:rocketmq:{regionId}:{accountId}:instance/{InstanceId}*"
            ]
        }
    ]
}

What's next

• Create a custom policy

• Modify the document and description of a custom policy

• Delete a custom policy

• Manage policy references

• Manage custom policy versions

• RAM authorization for ApsaraMQ for RocketMQ

FAQ

Q: Why do I receive a "valid resource owner failed" or "AccessDenied (OwnerId forbidden)" error when accessing ApsaraMQ for RocketMQ over HTTP?

Cause: This error typically occurs due to one of the following reasons:

• Signature construction error: The HTTP request signature does not comply with the HMAC-SHA256 V4 specification. Common issues include an incorrectly constructed Canonical String or a malformed Authorization header.

• Resource mismatch in RAM policy: The Resource field in your RAM policy does not exactly match the target topic or instance. Topic names in ApsaraMQ for RocketMQ are case-sensitive. The correct Resource format for HTTP protocol message publishing is acs:mq:*:*:instance/{InstanceId}/topic/{TopicName}.

• Insufficient permissions: The AccessKey pair or STS credentials used for the request do not have the required permissions, such as mq:PUB for publishing messages.

Resolution:

1. Verify that your HTTP request signature strictly follows the HMAC-SHA256 V4 specification, including the correct format for the Canonical String, signed headers, and the Authorization header.

2. Check that the Resource field in your RAM policy matches the actual topic and instance names exactly. Pay close attention to case sensitivity.

3. Confirm that the AccessKey pair or STS credentials have the necessary permissions for the operation you are performing (for example, mq:PUB for publishing messages).

Recommendation: To avoid HTTP authentication complexity and potential signature errors, use the official RocketMQ SDK, which handles request signing automatically.

Q: Can I use a RequestId to query the specific reason why an ApsaraMQ for RocketMQ permission verification failed?

No. Currently, Alibaba Cloud does not support querying granular IAM (Identity and Access Management) authentication decision details by using a RequestId. When a permission verification fails, the backend returns only a generic AccessDenied error without exposing specific policy evaluation details, such as which policy denied the request or which condition was not met.

To troubleshoot permission verification failures, use the following self-service approaches:

• Check your permission policies: Review the RAM user or role's attached policies and verify that all required actions are explicitly allowed.

• Verify Resource ARN matching: Confirm that the Resource field in your policies matches the actual resource ARNs, including the correct region ID, account ID, instance ID, and topic or consumer group name.

• Check your signature logic: If you are using the HTTP protocol to access ApsaraMQ for RocketMQ, verify that your request signing logic is correct.

• Review permission boundaries and trust policies: If the RAM user or role is subject to a permission boundary or trust policy, verify that these configurations are not restricting the required actions.

Q: How do I grant a RAM user the Cloud Monitor permissions required to configure ApsaraMQ for RocketMQ alerts?

ApsaraMQ for RocketMQ custom permission policies control access to ApsaraMQ for RocketMQ resources only and do not include Cloud Monitor permissions. To allow a RAM user to configure ApsaraMQ for RocketMQ alerts in Cloud Monitor, you must grant Cloud Monitor permissions to the RAM user separately.

To grant the required Cloud Monitor read-only permissions:

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM administrator account.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

4. In the Add Permissions panel, configure the following settings:

   • Set Authorization Scope based on your requirements.

   • Set Policy Type to System Policy.

5. In the search box, enter AliyunCloudMonitorReadOnlyAccess and select the policy from the search results.

6. Click OK to save the permission grant.

After the permission is granted, the RAM user can view Cloud Monitor metrics and configure alert rules for ApsaraMQ for RocketMQ instances.

Q: Should I use RAM custom policies or ACL to control message sending permissions in an ApsaraMQ for RocketMQ 5.0 development environment?

To control message send and receive permissions in a development or testing environment, use ACL (Access Control List) rather than RAM custom policies.

• ACL: Designed for application-level message send and receive permission control. ACL lets you grant specific users or applications permissions to publish to or subscribe from specific topics within an instance. This makes ACL well-suited for development and testing scenarios where you need to simulate message flows or control which applications can interact with specific topics.

• RAM custom policies: Designed for Alibaba Cloud account-level resource management. RAM policies control operations on cloud resources, such as creating, modifying, or deleting ApsaraMQ for RocketMQ instances, topics, and consumer groups. RAM policies govern who can manage ApsaraMQ for RocketMQ resources, not who can send or receive messages through those resources.

In summary: