Understand RAM Policy Structure for Auto Scaling Access Control - Auto Scaling - Alibaba Cloud - Auto Scaling

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by 弹性伸缩 for RAM permission policies. The RAM code (RamCode) for 弹性伸缩 is ess , and the supported authorization granularity is 资源级 .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by 弹性伸缩. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
ess:ListTagKeys	ListTagKeys	get	All resources. ``	None	None
ess:CreateEciScalingConfiguration	CreateEciScalingConfiguration	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateAlarm	CreateAlarm	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:UntagResources	UntagResources	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:QueryPredictiveMetric	QueryPredictiveMetric	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateNotificationConfiguration	CreateNotificationConfiguration	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeEciScalingConfigurationDetail	DescribeEciScalingConfigurationDetail	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ResumeInstanceRefresh	ResumeInstanceRefresh	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:EnableAlarm	EnableAlarm	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:SuspendInstanceRefresh	SuspendInstanceRefresh	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeRegions	DescribeRegions	get	All resources. ``	None	None
ess:DescribeLimitation	DescribeLimitation	get	All resources. ``	None	None
ess:DescribeScalingActivityDetail	DescribeScalingActivityDetail	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:QueryPredictiveTaskInfo	QueryPredictiveTaskInfo	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ApplyScalingGroup	ApplyScalingGroup	create	All resources. ``	None	None
ess:RollbackInstanceRefresh	RollbackInstanceRefresh	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeNotificationConfigurations	DescribeNotificationConfigurations	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingInstances	DescribeScalingInstances	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachDBInstances	AttachDBInstances	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingConfigurations	DescribeScalingConfigurations	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteScalingGroup	DeleteScalingGroup	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:TagResources	TagResources	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:SetInstancesProtection	SetInstancesProtection	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyAlertConfiguration	ModifyAlertConfiguration	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteScalingRule	DeleteScalingRule	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:RecordLifecycleActionHeartbeat	RecordLifecycleActionHeartbeat	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeDiagnoseReports	DescribeDiagnoseReports	get	All resources. ``	None	None
ess:ModifyInstanceAttribute	ModifyInstanceAttribute	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateLifecycleHook	CreateLifecycleHook	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ListTagValues	ListTagValues	get	All resources. ``	None	None
ess:DescribeScalingActivityStatistics	DescribeScalingActivityStatistics	get	All resources. ``	None	None
ess:ModifyAlarm	ModifyAlarm	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:SetGroupDeletionProtection	SetGroupDeletionProtection	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeAlertConfiguration	DescribeAlertConfiguration	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CancelInstanceRefresh	CancelInstanceRefresh	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeInstanceRefreshes	DescribeInstanceRefreshes	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:EnterStandby	EnterStandby	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteDiagnoseReport	DeleteDiagnoseReport	delete	All resources. ``	None	None
ess:RebalanceInstances	RebalanceInstances	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachInstances	DetachInstances	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:QueryHistoricalMetric	QueryHistoricalMetric	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyNotificationConfiguration	ModifyNotificationConfiguration	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeEciScalingConfigurations	DescribeEciScalingConfigurations	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DisableScalingGroup	DisableScalingGroup	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteAlarm	DeleteAlarm	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingActivities	DescribeScalingActivities	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteLifecycleHook	DeleteLifecycleHook	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateScalingRule	CreateScalingRule	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachServerGroups	AttachServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingGroups	DescribeScalingGroups	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeElasticStrength	DescribeElasticStrength	get	All resources. ``	None	None
ess:DescribeNotificationTypes	DescribeNotificationTypes	get	All resources. ``	None	None
ess:CreateScalingGroup	CreateScalingGroup	create	ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/`	None	None
ess:ModifyScheduledTask	ModifyScheduledTask	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeLifecycleHooks	DescribeLifecycleHooks	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeAlarms	DescribeAlarms	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachAlbServerGroups	DetachAlbServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyLifecycleHook	ModifyLifecycleHook	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachAlbServerGroups	AttachAlbServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeLifecycleActions	DescribeLifecycleActions	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:SuspendProcesses	SuspendProcesses	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ScaleWithAdjustment	ScaleWithAdjustment	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ChangeResourceGroup	ChangeResourceGroup	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachInstances	AttachInstances	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeInstanceCreateAndDeleteStatistics	DescribeInstanceCreateAndDeleteStatistics	get	All resources. ``	None	None
ess:ListTagResources	ListTagResources	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteEciScalingConfiguration	DeleteEciScalingConfiguration	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachServerGroups	DetachServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ApplyEciScalingConfiguration	ApplyEciScalingConfiguration	create	All resources. ``	None	None
ess:StartInstanceRefresh	StartInstanceRefresh	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateScalingConfiguration	CreateScalingConfiguration	create	All resources. ``	None	None
ess:ModifyEciScalingConfiguration	ModifyEciScalingConfiguration	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteScalingConfiguration	DeleteScalingConfiguration	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DisableAlarm	DisableAlarm	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachLoadBalancers	AttachLoadBalancers	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachLoadBalancers	DetachLoadBalancers	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyScalingGroup	ModifyScalingGroup	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyScalingRule	ModifyScalingRule	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribePatternTypes	DescribePatternTypes	list	All resources. ``	None	None
ess:ExecuteScalingRule	ExecuteScalingRule	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachDBInstances	DetachDBInstances	none	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteNotificationConfiguration	DeleteNotificationConfiguration	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeRegions	VerifyAuthentication		All resources. ``	None	None
ess:SetInstanceHealth	SetInstanceHealth	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ResumeProcesses	ResumeProcesses	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ModifyScalingConfiguration	ModifyScalingConfiguration	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateScheduledTask	CreateScheduledTask	create	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:QueryPredictiveValue	QueryPredictiveValue	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingGroupDiagnoseDetails	DescribeScalingGroupDiagnoseDetails	get	All resources. ``	None	None
ess:DescribeRegions	VerifyUser	get	All resources. ``	None	None
ess:EnableScalingGroup	EnableScalingGroup	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:ExitStandby	ExitStandby	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:AttachVServerGroups	AttachVServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingGroupDetail	DescribeScalingGroupDetail	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScalingRules	DescribeScalingRules	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CreateDiagnoseReport	CreateDiagnoseReport	create	All resources. ``	None	None
ess:DetachVServerGroups	DetachVServerGroups	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DescribeScheduledTasks	DescribeScheduledTasks	get	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:CompleteLifecycleAction	CompleteLifecycleAction	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DeleteScheduledTask	DeleteScheduledTask	delete	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None
ess:DetachInstances	RemoveInstances	update	*ScalingGroup `acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId}`	None	None

Resource

The following table lists the resources defined by 弹性伸缩. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
ScalingGroup	acs:ess:{#regionId}:{#accountId}:scalinggroup/{#ScalingGroupId} acs:ess:{#regionId}:{#accountId}:scalinggroup/*

Condition

弹性伸缩 does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: