Before you call the BaaS API as a RAM user, you must grant the RAM user corresponding permissions by using your Alibaba Cloud account. In the authorization policy, an Alibaba Cloud Resource Name (ARN) is used as the unique identifier of the resource to authorize.

This topic describes how to use Alibaba Cloud Resource Names (ARN) in BaaS to authenticate users or user groups, grant RAM user accounts access to resources, and implement access authorization across cloud services. Make sure that you have read the RAM documentation and RAM API reference carefully before you use RAM to authorize the access to BaaS.

Hyperledger Fabric API operations

The following table describes the ARN format for different types of Hyperledger Fabric resources.

Resource typeARN format
Consortiumacs:baas:$regionId:$accountId:consortium/$consortiumId
Organizationacs:baas:$regionId:$accountId:organization/$organizationId
Channelacs:baas:*:$accountId:channel/$channelId
Chaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

$regionId indicates the region ID of the resource. $accountId indicates the Alibaba Cloud Account ID of the resource owner. $consortiumId/$organizationId/$channelId/$chaincodeId indicates the of the resource in the blockchain service.

Note The channel and chaincode are global resources, and their regions must be "*".

Hyperledger Fabric API operations

The following table lists the default authorized API operations in the Hyperledger Fabric blockchain (RAM users and STS Token holders have default permissions).

API operation
CheckFabricConsortiumDomain
CheckFabricOrganizationDomain
DescribeTasks
DescribeRootDomain
DescribeFabricConsortiumConfig
DescribeFabricConsortiumSpecs
DescribeFabricOrganizationSpecs
DescribeFabricInviter
DescribeFabricChaincodeUploadPolicy
AcceptFabricInvitation

The following table lists Hyperledger Fabric API operations that can be authorized and the corresponding ARN formats.

API OperationARN format
CreateFabricOrganizationacs:baas:$regionId:$accountId:organization/*
DescribeFabricOrganizationacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationDeletableacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationsacs:baas:*:$accountId:organization/*
DescribeFabricCandidateOrganizationsacs:baas:*:$accountId:organization/*
CreateFabricChannelacs:baas:*:$accountId:channel/*

acs:baas:$regionId:$accountId:consortium/$consortiumId

DescribeFabricOrganizationChannelsacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumChannelsacs:baas:$regionId:$accountId:consortium/$consortiumId
CreateFabricChannelMemberacs:baas:*:$accountId:channel/$channelId
DescribeFabricChannelMembersacs:baas:*:$accountId:channel/$channelId
JoinFabricChannelacs:baas:*:$accountId:channel/$channelId
CreateFabricConsortiumacs:baas:$regionId:$accountId:consortium/*
CreateFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
ConfirmFabricConsortiumMemberacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricOrganizationMembersacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationPeersacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumsacs:baas:*:$accountId:consortium/*
DescribeFabricConsortiumAdminStatusacs:baas:*:$accountId:consortium/*
DescribeFabricConsortiumMembersacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumMemberApprovalacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumOrderersacs:baas:$regionId:$accountId:consortium/$consortiumId
DescribeFabricConsortiumDeletableacs:baas:$regionId:$accountId:consortium/$consortiumId
CreateFabricChaincodeacs:baas:*:$accountId:chaincode/*

acs:baas:*:$accountId:channel/$channelId

acs:baas:$regionId:$accountId:consortium/$consortiumId

acs:baas:$regionId:$accountId:organization/$organizationId

DescribeFabricOrganizationChaincodesacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricConsortiumChaincodesacs:baas:$regionId:$accountId:consortium/$consortiumId
DeleteFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId
InstallFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

InstantiateFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

UpgradeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

SynchronizeFabricChaincodeacs:baas:*:$accountId:chaincode/$chaincodeId

acs:baas:$regionId:$accountId:organization/$organizationId

CreateFabricOrganizationUseracs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricOrganizationUsersacs:baas:$regionId:$accountId:organization/$organizationId
ResetFabricOrganizationUserPasswordacs:baas:$regionId:$accountId:organization/$organizationId
DownloadFabricOrganizationSDKacs:baas:$regionId:$accountId:organization/$organizationId
DescribeFabricInvitationCodeacs:baas:$regionId:$accountId:consortium/$consortiumId

Examples of Hyperledger Fabric RAM authorization rules

Example 1: Authorize BaaS to read-only operations. This type of permission allows the user to view the blockchain status through the console or API and download the SDK.

{
   "Statement": [{ 
       "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
       "Effect": "Allow",
       "Resource": "acs:baas:*:*:*"
   }],
   "Version": "1"
}
Example 2: Authorize BaaS to chaincode management operations, including uploading, installing, and instantiating chaincodes. This type of permission allows the user to manage all chaincodes through the console or API. 
{
  "Statement": [{
     "Action": "baas:*Chaincode",
     "Effect": "Allow",
     "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/*", "acs:baas:*:*:consortium/*","acs:baas:*:*:channel/*"]
  }],
  "Version": "1"
}

Example 3: Chaincode development authorization. This permission usually requires all read-type operations and chaincode management operations of specific organizations. Based on the principle of minimum permission, the user must be restricted only to create chaincodes for specific consortia, organizations, and channels, and install or instantiate chaincodes in specific organizations. Replace $consortiumId/$organizationId/$channelId with the ID of the specific resource in the blockchain service.

{
 "Statement": [{
   "Action": ["baas:Describe*","baas:DownloadFabricOrganizationSDK"],
   "Effect": "Allow",
   "Resource": "acs:baas:*:*:*"
 },
 {
   "Action": "baas:*Chaincode",
   "Effect": "Allow",
   "Resource": ["acs:baas:*:*:chaincode/*","acs:baas:*:*:organization/$organizationId","acs:baas:*:*:consortium/$consortiumId","acs:baas:*:*:channel/$channelId"]
 }],
 "Version": "1"
}