Grant permissions to RAM users and RAM roles - Alibaba Cloud Service Mesh

You can grant different permissions to RAM users and RAM roles as needed. Only authorized RAM users and RAM roles can perform operations in the ASM console, such as creating mesh instances or updating Service Mesh feature configurations. This practice prevents security risks caused by exposing your Alibaba Cloud account's AccessKey pair. This topic uses a RAM user as an example to describe how to grant permissions.

Prerequisites

You have created a RAM user and a RAM role. For more information, see Create a RAM user and Create a RAM role with an Alibaba Cloud account as the trusted entity.
You have a basic understanding of the structure and syntax of the permission policy language. For more information, see Policy structure and syntax.

Background information

Because RAM users and RAM roles have different use cases, their permission requirements vary:

If a RAM user or RAM role requires permissions only for Service Mesh operations and does not need to perform cluster operations, you only need to grant Service Mesh permissions. For more information, see Grant system policies to RAM users and RAM roles and Grant custom policies to RAM users and RAM roles.
If a RAM user or RAM role requires permissions for both Service Mesh and cluster operations, such as adding or removing an ACK cluster within a mesh, you must grant permissions for both the Service Mesh and the corresponding clusters. For more information, see Grant system policies to RAM users and RAM roles, Grant custom policies to RAM users and RAM roles, and Grant cluster permissions to a RAM user.

Grant system policies to RAM users and roles

ASM provides the AliyunASMReadOnlyAccess and AliyunASMFullAccess system policies by default. You can grant these policies directly. These policies are described as follows:

AliyunASMReadOnlyAccess
Grants read-only permissions to manage Alibaba Cloud Service Mesh (ASM). With this policy, you can only view the status of a Service Mesh and perform other read-only operations. You cannot make changes to the Service Mesh.
AliyunASMFullAccess
Grants full permissions to manage Alibaba Cloud Service Mesh (ASM). A RAM user with this policy has permissions on mesh resources equivalent to those of an Alibaba Cloud account and can perform any operation.

The following steps describe how to grant the AliyunASMReadOnlyAccess policy to a RAM user. For more information about how to grant permissions to a RAM user and a RAM role, see Manage permissions for RAM users and Manage permissions for RAM roles.

Log on to the RAM console.
In the left navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.
In the Grant Permission panel, add permissions to the RAM user.
1. Resource scope:
  - Account level: Permissions apply to all resources in your Alibaba Cloud account.
  - Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
    Note
    
    The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
    
    For resource group authorization examples, see Control RAM user access to specific ECS instances.
2. Principal:
  
  The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.
3. Under All Types, click System Policy. In the search box, enter AliyunASMReadOnlyAccess, and then click AliyunASMReadOnlyAccess.
  Note
  You can attach up to five policies at a time. To attach more policies, repeat this procedure.
4. Click OK.
Review the authorization result and click Close.

Grant custom policies to RAM users and roles

If you need fine-grained access control, create a custom policy and then grant it to a RAM user or RAM role.

Create an access policy for a mesh instance

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON Editor tab.
The page displays a JSON editor. The default policy template includes a Version element (set to "1") and a Statement array. Each statement includes Effect (defaults to "Allow"), Action, Resource, and Condition elements. You must populate the Action and Resource elements.

Enter the policy content and click Next to edit policy information.

You can implement fine-grained authorization for API operations by changing the Action field in the Statement. This topic uses a restricted access policy as an example. This policy grants all RAM permissions for a Service Mesh except for RBAC authorization. A RAM user with this policy can perform all operations except for granting RBAC permissions to other users. For more information about the policy syntax and structure, see Policy structure and syntax.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:Add*",
                "servicemesh:CRBatchDeletion",
                "servicemesh:Create*",
                "servicemesh:Delete*",
                "servicemesh:Describe*",
                "servicemesh:Enable*",
                "servicemesh:Disable*",
                "servicemesh:Get*",
                "servicemesh:InvokeApiServer",
                "servicemesh:List*",
                "servicemesh:Modify*",
                "servicemesh:Re*",
                "servicemesh:Run*",
                "servicemesh:Set*",
                "servicemesh:Sync*",
                "servicemesh:Update*",
                "servicemesh:Upgrade*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:ListLogStores",
                "log:ListDashboard",
                "log:GetDashboard",
                "log:ListSavedSearch",  
                "log:ListProject"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/audit-*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/istio-*"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "servicemesh.aliyuncs.com"
                }
            }
        }
    ],
    "Version": "1"
}

In the Basic Information section, enter a policy name. In this example, enter ASMPolicy1, and then click OK.

Grant a custom policy to RAM users and roles

This section describes how to grant the custom policy to a RAM user. For more information about how to grant permissions to a RAM role, see Manage permissions for RAM roles.

Log on to the RAM console as a RAM administrator.
In the left navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.
In the Grant Permission panel, add permissions to the RAM user.
1. Resource scope:
  - Account level: Permissions apply to all resources in your Alibaba Cloud account.
  - Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
    Note
    
    The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
    
    For resource group authorization examples, see Control RAM user access to specific ECS instances.
2. Principal:
  
  The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.
3. Under All Types, click Custom Policy. In the search box, enter ASMPolicy1, and then click ASMPolicy1.
  Note
  You can attach up to five policies at a time. To attach more policies, repeat this procedure.
4. Click OK.
Review the authorization result and click Close.

Custom policy examples

Scenario 1: Grant permissions for a single mesh

You can use the following policy to grant permissions to manage a single mesh instance. After this policy is granted, the RAM user or RAM role can manage only the specified mesh instance.

Note

When you create the policy, replace <ServicemeshId> in the policy with the ID of the target mesh instance.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "servicemesh:*",
      "Resource": "acs:servicemesh:*:*:servicemesh/<ServicemeshId>"
    },
    {
      "Effect": "Allow",
      "Action": "servicemesh:DescribeServiceMeshes",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "log:GetLogStoreLogs",
      "Resource": "acs:log:*:*:project/*/logstore/audit-<ServicemeshId>"
    },
    {
      "Effect": "Allow",
      "Action": "log:GetLogStoreLogs",
      "Resource": "acs:log:*:*:project/*/logstore/istio-<ServicemeshId>"
    }
  ],
  "Version": "1"
}

Scenario 2: Grant read/write access to Istio resources

The built-in AliyunASMReadOnlyAccess system policy grants a RAM user or RAM role read-only permissions on Alibaba Cloud Service Mesh (ASM). However, a RAM user or role with this policy cannot manage Istio resources in the mesh.

You can use the following policy to grant read and write permissions for Istio resources. After this policy is granted to a RAM user or RAM role, the RAM user or RAM role can use the ASM console to manage Istio resources in the mesh, but cannot make changes to other parts of the mesh, such as feature settings.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:List*",
                "servicemesh:Describe*",
                "servicemesh:Get*",
                "servicemesh:InvokeApiServer"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:ListLogStores",
                "log:ListDashboard",
                "log:GetDashboard",
                "log:ListSavedSearch"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "log:GetLogStoreLogs",
            "Resource": "acs:log:*:*:project/*/logstore/audit-*"
        }
    ],
    "Version": "1"
}

Scenario 3: Grant RBAC authorization permissions

You can use the following policy to grant permissions to perform RBAC authorization for other users or roles. After this policy is granted to a RAM user or RAM role, the RAM user or RAM role can use the ASM console to manage the RBAC permissions of other RAM roles or RAM users, but cannot view or operate any mesh instances.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "servicemesh:DescribeUserPermissions",
                "servicemesh:GrantUserPermissions",
                "servicemesh:DescribeServiceMeshes",
                "servicemesh:DescribeUsersWithPermissions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ims:ListUserBasicInfos",
            "Resource": "*"
        }
    ],
    "Version": "1"
}