All Products
Search

This Product

    Cloud Architect Design Tools:Read-only permissions

    Document Center

    Cloud Architect Design Tools:Read-only permissions

    Last Updated:Jun 18, 2026

    Overview

    To grant a RAM user read-only access to CADT applications and Alibaba Cloud resources, you need the following permissions:

    • AliyunCADTReadOnlyAccess

    • Read-only permissions for the required cloud products

    Add permissions

    1. In the RAM console, go to the Users page, find the target user, and click Add Permissions.

    2. On the Add Permissions page, add the following read-only permissions and click OK.

      For example, if a test application named CADT-Test contains VPC, ECS, and EIP resources, you must grant the AliyunCADTReadOnlyAccess policy along with the corresponding read-only policies for these products:

      • AliyunCADTReadOnlyAccess

      • AliyunVPCReadOnlyAccess

      • AliyunECSReadOnlyAccess

      • AliyunEIPReadOnlyAccess. In the Resource Scope setting, select Account Level. After selecting these four system policies, click OK.

    • The user now has the four specified read-only permissions.

    Verify permissions

    A RAM user with read-only permissions can view CADT applications and Alibaba Cloud resources, view application architecture diagrams, and check resource details such as the IP address and hostname of an ECS instance. This is suitable for routine development and testing.

    1. To get the logon URL for your RAM user, go to the RAM console, click Overview in the left-side navigation pane, and copy the User Logon URL from the Account Management section. Open this URL in an incognito browser window and log on as the RAM user (for example, cadt-user). Then, open the CADT console. Click the user avatar in the upper-right corner to confirm that you are logged in as the correct user.

    2. Navigate to Application > My Applications. All applications created by the Alibaba Cloud account are displayed. Find the CADT-Test application and click View Architecture Diagram.

    3. Double-click the ECS and EIP icons and click Go to Console to view the details of each resource.

      • View ECS details: The ECS instance details page displays basic information, including the instance ID, Elastic IP Address, security group, region, and availability zone.

      • View EIP details

        On the CADT deployment results page, you can view the architecture topology and EIP resource details, including attributes such as AllocationId, BusinessStatus (Normal), and bandwidth (1). Click Go to Console to view the resource in the Alibaba Cloud Management Console. The page contains Basic information and Billing sections. The Basic information section displays fields such as instance ID, Instance name, IP address, IP status (Assigned), Bound instance type (ECS Instance), Bound instance ID, resource group, Deletion Protection, and Cloud firewall protection. The Billing section shows the billing method (Pay-by-traffic), bandwidth (1 Mbps), Original EIP billing method (Pay-as-you-go), and creation time.

    4. You can create applications, design architectures, and configure parameters, but you cannot save or deploy applications. If you click the Save button in the upper-right corner of the architecture diagram page, the following error message appears: 4001: You do not have permission to use this feature. Please contact the Alibaba Cloud account owner or a permissions administrator to grant the required permissions. This confirms that the RAM user cadt-user has only read-only permissions.