RAM authorization - Application Real-Time Monitoring Service

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by ARMS. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate ARMS is arms,xtrace. You can grant permissions on ARMS at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

ARMS defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
arms:GetOnCallSchedulesDetail	GetOnCallSchedulesDetail	none	All Resources *	None	None
arms:DeleteContact	DeleteIMRobot	none	All Resources *	None	None
arms:CreateAlertRules	CreateOrUpdateAlertRule	create	AlertRule acs:arms:{#regionId}:{#AccountId}:alertrule/{#AlertRuled}	None	None
arms:CreateContact	CreateOrUpdateWebhookContact	none	All Resources *	None	None
arms:CreateDispatchRule	CreateOrUpdateNotificationPolicy	none	All Resources *	None	None
arms:ListEventBridgeIntegrations	ListEventBridgeIntegrations	none	All Resources *	None	None
arms:CreateContact	CreateOrUpdateContact	none	All Resources *	None	None
arms:CreateContactGroup	CreateOrUpdateContactGroup	none	All Resources *	None	None
arms:SearchContact	DescribeContacts	none	All Resources *	None	None
arms:ListDispatchRule	ListEscalationPolicies	none	All Resources *	None	None
arms:GetAlertRules	GetAlertRules	get	All Resources *	None	None
arms:GetAlarmHistories	ListAlerts	none	All Resources *	None	None
arms:CreateDispatchRule	CreateOrUpdateSilencePolicy	none	All Resources *	None	None
arms:SearchContact	DescribeIMRobots	none	All Resources *	None	None
arms:CreateIntegration	CreateIntegration	none	All Resources *	None	None
arms:DeleteDispatchRule	DeleteNotificationPolicy	none	All Resources *	None	None
arms:ListIntegration	ListIntegration	none	All Resources *	None	None
arms:OpenArmsDefaultSLR	OpenArmsDefaultSLR	none	All Resources *	None	None
arms:BlockAlarmNotification	BlockAlarmNotification	create	All Resources *	None	None
arms:DeleteEventBridgeIntegration	DeleteEventBridgeIntegration	none	All Resources *	None	None
arms:ClaimAlarm	ClaimAlarm	create	All Resources *	None	None
arms:DeleteContactGroup	DeleteContactGroup	none	All Resources *	None	None
arms:OpenXtraceDefaultSLR	OpenXtraceDefaultSLR	none	All Resources *	None	None
arms:UpdateContact	SendTTSVerifyLink	none	All Resources *	None	None
arms:UntagResources	UntagResources	update	All Resources *	None	None
arms:DeleteSilencePolicy	DeleteSilencePolicy	none	All Resources *	None	None
arms:ListAlertEvents	ListAlertEvents	none	All Resources *	None	None
arms:DeleteContact	DeleteWebhookContact	none	All Resources *	None	None
arms:ChangeAlarmSeverity	ChangeAlarmSeverity	create	All Resources *	None	None
arms:OpenArmsService	OpenArmsServiceSecondVersion	none	All Resources *	None	None
arms:ChangeResourceGroup	ChangeResourceGroup	update	Prometheus acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId} RetcodeApp acs:arms:{#regionId}:{#accountId}:retcodeapp/{#Pid} TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid} Environment acs:arms:{#regionId}:{#accountId}:environment/{#EnvironmentId} GrafanaWorkspace acs:arms:{#regionId}:{#accountId}:grafanaworkspace/{#GrafanaWorkspaceId} XTraceApp acs:arms:{#regionId}:{#accountId}:xtraceapp/{#Pid}	None	None
arms:CreateOrUpdateEventBridgeIntegration	CreateOrUpdateEventBridgeIntegration	none	All Resources *	None	None
arms:DeleteAlertRules	DeleteAlertRule	delete	AlertRule acs:arms:{#regionId}:{#accountId}:AlertRule/{#AlertRuled}	None	None
arms:SearchContactGroup	DescribeContactGroups	none	All Resources *	None	None
arms:CreateContact	CreateOrUpdateIMRobot	none	All Resources *	None	None
arms:DeleteContact	DeleteContact	none	All Resources *	None	None
arms:CloseAlarm	CloseAlarm	create	All Resources *	None	None
arms:ListDispatchRule	ListNotificationPolicies	none	All Resources *	None	None
arms:UpdateIntegration	UpdateIntegration	none	All Resources *	None	None
arms:TagResources	TagResources	update	Prometheus acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId} RetcodeApp acs:arms:{#regionId}:{#accountId}:retcodeapp/{#Pid} TraceApp acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid} Environment acs:arms:{#regionId}:{#accountId}:environment/{#EnvironmentId} GrafanaWorkspace acs:arms:{#regionId}:{#accountId}:grafanaworkspace/{#GrafanaWorkspaceId}	None	None
arms:SearchContact	DescribeWebhookContacts	none	All Resources *	None	None
arms:ListDispatchRule	ListOnCallSchedules	none	All Resources *	None	None
arms:ListDispatchRule	ListSilencePolicies	none	All Resources *	None	None

Resource

ARMS defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}
Environment	acs:arms:{#regionId}:{#accountId}:environment/{#environmentId}
XTraceApp	acs:arms:{#regionId}:{#accountId}:xtraceapp/*
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/*
AlertRule	acs:arms:{#regionId}:{#AccountId}:alertrule/{#AlertRuled}
TraceApp	acs:arms:{#regionId}:{#accountId}:traceapp/{#Pid}
Environment	acs:arms:{#regionId}:{#accountId}:environment/*
GrafanaWorkspace	acs:arms:{#regionId}:{#accountId}:grafanaworkspace/{#GrafanaWorkspaceId}
GrafanaWorkspace	acs:arms:{#regionId}:{#accountId}:grafanaworkspace/*
XTraceApp	acs:arms:{#regionId}:{#accountId}:xtraceapp/{#Pid}
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/{#Pid}
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/{#ClusterId}
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/*
TraceApp	acs:arms:{#regionId}:{#accountId}:traceapp/*
PrometheusAlertRule	acs:arms:{#regionId}:{#accountId}:prometheusalertrule/{#ClusterId}/{#PrometheusAlertRuleId}
Prometheus	acs:arms:{#regionId}:{#accountId}:prometheus/{#prometheusId}
PrometheusAlertRule	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/*
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/*
PrometheusAlertRule	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/${PrometheusAlertRuleId}
SyntheticTask	acs:arms:{#regionId}:{#accountId}:synthetictask/{#TaskId}
AlertRule	acs:arms:{#regionId}:{#AccountId}:AlertRule/*
SyntheticTask	acs:arms:{#regionId}:{#accountId}:*
AgentInfo	acs:arms:{#regionId}:{#accountId}:
TraceApp	acs:arms:{#regionId}:{#AccountId}:traceapp/{#Pid}
IntegrationExporter	acs:arms:${Region}:${AccountId}:prometheus/${ClusterId}/integrationexporter/*
RetcodeApp	acs:arms:{#regionId}:{#AccountId}:retcodeapp/{#Pid}
Prometheus	acs:arms:{#regionId}:{#AccountId}:prometheus/{#ClusterId}
GrafanaWorkspace	acs:arms:{#regionId}:{#AccountId}:grafanaworkspace/{#GrafanaWorkspaceId}
SyntheticTask	acs:arms:{#regionId}:{#AccountId}:synthetictask/{#TaskId}
GrafanaWorkspace	acs:arms:{#regionId}:{#AccountId}:grafanaworkspace/*
SyntheticTask	acs:arms:{#regionId}:{#accountId}:synthetictask/*
IntegrationExporter	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}
Rum	acs:arms:{#regionId}:{#accountId}:rum/*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/{#monitoringName}/*
Environment	acs:arms:{#regionId}:{#accountId}:environment/{#EnvironmentId}
RetcodeApp	acs:arms:{#regionId}:{#accountId}:retcodeapp/{#RetcodeAppId}
Prometheus	acs:arms:{#regionId}:{#accountId}:Prometheus/#{ClusterId}
IntegrationExporter	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/{#type}/{#monitoringName}
AlertRule	acs:arms:{#regionId}:{#accountId}:AlertRule/{#AlertRuled}
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#clusterId}/monitoring/*
PrometheusMonitoring	acs:arms:{#regionId}:{#accountId}:prometheus/{#ClusterId}
PrometheusAlertRule	acs:arms:{#regionId}:${AccountId}:prometheus/${ClusterId}/prometheusalertrule/*

Condition

ARMS does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: