Application Real-Time Monitoring Service:Attach custom policies to RAM users for Application Monitoring

When to use custom policies

ARMS provides two levels of access control:

If a system policy meets your needs, attach it directly. For fine-grained control -- such as granting read-only access to a single application -- create a custom policy.

Custom policy basics

A custom policy is a JSON document that defines which actions are allowed or denied on which resources, with optional conditions. After you create a custom policy, attach it to a RAM user, user group, or role to grant the specified permissions.

Key behaviors:

• A custom policy has no effect until it is attached to a principal (user, user group, or role).

• To delete a custom policy, first detach it from all principals.

• Custom policies support version control through the RAM version management mechanism.

Step 1: Create a custom policy

1. Log on to the RAM console as a RAM user with administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

   

4. On the Create Policy page, click the JSON tab. Enter your policy in the editor.

   See Policy elements reference for a breakdown of each element.

   The following example grants read-only access to applications in the China (Hangzhou) region that are tagged with key0: value01 or key0: value02:

   {
     "Version": "1",
     "Statement": [
       {
         "Action": [
           "arms:ReadTraceApp"
         ],
         "Resource": "acs:arms:cn-hangzhou:*:armsapp/*",
         "Effect": "Allow",
         "Condition": {
           "StringEquals": {
             "arms:tag/key0": [
               "value01",
               "value02"
             ]
           }
         }
       }
     ]
   }

5. Click Optional advanced optimize, then click Perform to let RAM optimize the policy. This step splits incompatible resources or conditions, narrows resource scope, and deduplicates or merges statements.

6. Click OK.

7. In the Create Policy dialog box, enter a Name and Description, then click OK.

Step 2: Attach the custom policy

Attach the custom policy to a RAM user or a RAM role, depending on how you manage access in your organization.

Attach to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

   To grant permissions to multiple users at once, select the users and click Add Permissions at the bottom of the page.

   

4. In the Grant Permission panel, configure the following parameters:

   1. Resource Scope: Select the scope for this authorization.

      • Account: Permissions apply to all resources in the current Alibaba Cloud account.

      • ResourceGroup: Permissions apply only to resources in a specific resource group.

      Important

      If you select ResourceGroup, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Principal: The RAM user to receive permissions. The current user is selected by default.

   3. Policy: Select the custom policy you created. You can select multiple policies at once.

      Note

      The system flags high-risk system policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching these unless specifically required.

   4. Click Grant permissions.

5. Click Close.

Attach to a RAM role

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, find the target RAM role and click Grant Permission in the Actions column.

   To grant permissions to multiple roles at once, select the roles and click Grant Permission at the bottom of the list.

   

4. In the Grant Permission panel, configure the following parameters:

   1. Resource Scope: Select the scope for this authorization.

      • Account: Permissions apply to all resources in the current Alibaba Cloud account.

      • Resource Group: Permissions apply only to resources in a specific resource group.

      Note

      If you select Resource Group, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group.

   2. Principal: The RAM role to receive permissions. The current role is selected by default.

   3. Policy: Select the custom policy you created. You can select multiple policies at once.

      Note

      The system flags high-risk system policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid attaching these unless specifically required.

   4. Click Grant permissions.

5. Click Close.

After attaching the policy, the RAM role can access ARMS with the granted permissions. For more information, see Assume a RAM role.

Policy elements reference

Effect

Specifies whether the statement result is an explicit allow or an explicit deny. Valid values: Allow, Deny.

Action

The following table lists the ARMS Application Monitoring actions available for custom policies:

Resource

Specifies the target resources using an Alibaba Cloud Resource Name (ARN):

acs:arms:<region-id>:*:armsapp/<app-name>

Replace the placeholders with actual values:

Condition

Conditions filter resources by tag key-value pairs. A condition block contains one or more conditions, each composed of an operator, a key, and one or more values.

Evaluation rules:

• If multiple values are specified for a condition key, the condition is met when the request matches any value.

• If multiple keys are attached to a single operator, the condition is met only when all key requirements are satisfied.

• If multiple conditions exist in a condition block, all conditions must be met.

Supported operators:

Condition key: arms:tag

The following example matches applications tagged with key0: value01 or key0: value02:

"Condition": {
  "StringEquals": {
    "arms:tag/key0": [
      "value01",
      "value02"
    ]
  }
}

For more information about tagging applications, see Manage tags.

Related topics

• Create a custom policy

• Modify the document and description of a custom policy

• Delete a custom policy

• Manage policy references

• Manage custom policy versions

• RAM authorization for ARMS