RAM authorization - Cloud Enterprise Network - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Cloud Enterprise Network for RAM permission policies. The RAM code (RamCode) for Cloud Enterprise Network is cen , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Cloud Enterprise Network. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
cen:AssociateTransitRouterAttachmentWithRouteTable	AssociateTransitRouterAttachmentWithRouteTable	create	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:UpdateTransitRouterEcrAttachmentAttribute	UpdateTransitRouterEcrAttachmentAttribute	update	TransitRouterEcrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#TransitRouterAttachmentId}`	None	None
cen:DescribeTransitRouteTableAggregation	DescribeTransitRouteTableAggregation	get	All Resource ``	None	None
cen:PublishRouteEntries	PublishRouteEntries	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}` VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:CreateTransitRouterMulticastDomain	CreateTransitRouterMulticastDomain	create	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}` TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/`	None	None
cen:AssociateCenBandwidthPackage	AssociateCenBandwidthPackage	create	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}` CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:CreateCenChildInstanceRouteEntryToCen	CreateCenChildInstanceRouteEntryToCen	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:CreateCenRouteMap	CreateCenRouteMap	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:CreateTrafficMarkingPolicy	CreateTrafficMarkingPolicy	create	All Resource ``	None	None
cen:DescribeFlowlogs	DescribeFlowlogs	get	Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/` *Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/{#FlowLogId}`	None	None
cen:CreateTransitRouterVbrAttachment	CreateTransitRouterVbrAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/{#TransitRouterId}`	None	None
cen:TagResources	TagResources	update	All Resource ``	None	None
cen:DeleteCenChildInstanceRouteEntryToCen	DeleteCenChildInstanceRouteEntryToCen	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouterPrefixListAssociation	ListTransitRouterPrefixListAssociation	get	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}`	None	None
cen:DescribeCenAttachedChildInstanceAttribute	DescribeCenAttachedChildInstanceAttribute	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:RegisterTransitRouterMulticastGroupSources	RegisterTransitRouterMulticastGroupSources	create	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:DescribeCenAttachedChildInstances	DescribeCenAttachedChildInstances	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:AddTraficMatchRuleToTrafficMarkingPolicy	AddTraficMatchRuleToTrafficMarkingPolicy	create	All Resource ``	None	None
cen:CreateTransitRouterEcrAttachment	CreateTransitRouterEcrAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen:*:{#accountId}:centransitrouter/{#TransitRouterId}`	None	None
cen:DeregisterTransitRouterMulticastGroupSources	DeregisterTransitRouterMulticastGroupSources	delete	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:DeleteTransitRouterRouteEntry	DeleteTransitRouterRouteEntry	delete	TransitRouterRouteEntry `acs:cen::{#accountId}:centransitrouterroutentry/{#centransitrouterroutentryId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutentry/{#transitrouterroutetableId}`	None	None
cen:CreateFlowlog	CreateFlowlog	create	All Resource ``	None	None
cen:DeleteTransitRouterVbrAttachment	DeleteTransitRouterVbrAttachment	delete	TransitRouterVbrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:ListTransitRouterMulticastDomainAssociations	ListTransitRouterMulticastDomainAssociations	get	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:ListGrantVSwitchEnis	ListGrantVSwitchEnis	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:RevokeInstanceFromTransitRouter	RevokeInstanceFromTransitRouter	delete	All Resource ``	None	None
cen:UpdateTransitRouterRouteEntry	UpdateTransitRouterRouteEntry	update	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#TransitRouterRouteTableId}`	None	None
cen:ListCenInterRegionTrafficQosPolicies	ListCenInterRegionTrafficQosPolicies	list	All Resource ``	None	None
cen:DescribeCenVbrHealthCheck	DescribeCenVbrHealthCheck	get	All Resource ``	None	None
cen:DisassociateTransitRouterMulticastDomain	DisassociateTransitRouterMulticastDomain	delete	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:UpdateTransitRouterPeerAttachmentAttribute	UpdateTransitRouterPeerAttachmentAttribute	update	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DescribeCenPrivateZoneRoutes	DescribeCenPrivateZoneRoutes	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeleteCenInterRegionTrafficQosQueue	DeleteCenInterRegionTrafficQosQueue	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#CenId}`	None	None
cen:CreateTransitRouterVpnAttachment	CreateTransitRouterVpnAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/{#TransitRouterId}`	None	None
cen:ListCenChildInstanceRouteEntriesToAttachment	ListCenChildInstanceRouteEntriesToAttachment	get	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:AttachCenChildInstance	AttachCenChildInstance	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}` VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:DisableTransitRouterRouteTablePropagation	DisableTransitRouterRouteTablePropagation	update	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DeleteTransitRouterVpnAttachment	DeleteTransitRouterVpnAttachment	delete	TransitRouterVpnAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DisableCenVbrHealthCheck	DisableCenVbrHealthCheck	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}`	None	None
cen:UpdateTransitRouterRouteTable	UpdateTransitRouterRouteTable	update	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}`	None	None
cen:ListTransitRouterMulticastDomains	ListTransitRouterMulticastDomains	list	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/` TransitRouterMulticastDomain `acs:cen:*:{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:GrantInstanceToTransitRouter	GrantInstanceToTransitRouter	create	All Resource ``	None	None
cen:DeleteTransitRouterEcrAttachment	DeleteTransitRouterEcrAttachment	delete	TransitRouterEcrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#TransitRouterAttachmentId}`	None	None
cen:CreateTransitRouterRouteEntry	CreateTransitRouterRouteEntry	create	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}`	None	None
cen:ListTransitRouterPeerAttachments	ListTransitRouterPeerAttachments	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/` TransitRouterPeerAttachment `acs:cen:*:{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:UpdateCenInterRegionTrafficQosQueueAttribute	UpdateCenInterRegionTrafficQosQueueAttribute	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#CenId}`	None	None
cen:CreateCenChildInstanceRouteEntryToAttachment	CreateCenChildInstanceRouteEntryToAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ModifyTransitRouteTableAggregation	ModifyTransitRouteTableAggregation	create	All Resource ``	None	None
cen:UnassociateCenBandwidthPackage	UnassociateCenBandwidthPackage	delete	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}` CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListGrantVSwitchesToCen	ListGrantVSwitchesToCen	get	All Resource ``	None	None
cen:DissociateTransitRouterAttachmentFromRouteTable	DissociateTransitRouterAttachmentFromRouteTable	delete	TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DescribeCenRegionDomainRouteEntries	DescribeCenRegionDomainRouteEntries	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ReplaceTransitRouterRouteTableAssociation	ReplaceTransitRouterRouteTableAssociation	update	TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:ListTransitRouterEcrAttachments	ListTransitRouterEcrAttachments	list	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouterEcrAttachment `acs:cen::{#accountId}:centransitrouterattachment/` TransitRouterEcrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#TransitRouterAttachmentId}`	None	None
cen:WithdrawPublishedRouteEntries	WithdrawPublishedRouteEntries	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:ListTransitRouterCidrAllocation	ListTransitRouterCidrAllocation	get	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:ListTransitRouterRouteEntries	ListTransitRouterRouteEntries	get	TransitRouterRouteEntry `acs:cen::{#accountId}:centransitrouterroutentry/{#centransitrouterroutentryId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}` TransitRouterRouteEntry `acs:cen::{#accountId}:centransitrouterroutentry/`	None	None
cen:DescribeCens	DescribeCens	get	CenInstance `acs:cen::{#accountId}:ceninstance/*`	None	None
cen:DescribeCenGeographicSpanRemainingBandwidth	DescribeCenGeographicSpanRemainingBandwidth	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:UnroutePrivateZoneInCenToVpc	UnroutePrivateZoneInCenToVpc	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeactiveFlowLog	DeactiveFlowLog	update	*Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/{#flowlogId}`	None	None
cen:DeleteTransitRouteTableAggregation	DeleteTransitRouteTableAggregation	delete	All Resource ``	None	None
cen:ListTagResources	ListTagResources	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:CreateCenInterRegionTrafficQosQueue	CreateCenInterRegionTrafficQosQueue	create	All Resource ``	None	None
cen:RemoveTrafficMatchRuleFromTrafficMarkingPolicy	RemoveTrafficMatchRuleFromTrafficMarkingPolicy	update	All Resource ``	None	None
cen:ModifyCenBandwidthPackageAttribute	ModifyCenBandwidthPackageAttribute	update	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}`	None	None
cen:DeregisterTransitRouterMulticastGroupMembers	DeregisterTransitRouterMulticastGroupMembers	delete	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:AssociateTransitRouterMulticastDomain	AssociateTransitRouterMulticastDomain	update	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:DescribeGrantRulesToCen	DescribeGrantRulesToCen	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:SetCenInterRegionBandwidthLimit	SetCenInterRegionBandwidthLimit	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouterRouteTables	ListTransitRouterRouteTables	get	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/` TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:TempUpgradeCenBandwidthPackageSpec	TempUpgradeCenBandwidthPackageSpec	update	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}`	None	None
cen:CreateCenInterRegionTrafficQosPolicy	CreateCenInterRegionTrafficQosPolicy	create	All Resource ``	None	None
cen:UpdateTransitRouterVpcAttachmentZones	UpdateTransitRouterVpcAttachmentZones	update	TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:ModifyFlowLogAttribute	ModifyFlowLogAttribute	update	*Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/{#flowlogId}`	None	None
cen:UpdateTrafficMarkingPolicyAttribute	UpdateTrafficMarkingPolicyAttribute	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#CenId}`	None	None
cen:ResolveAndRouteServiceInCen	ResolveAndRouteServiceInCen	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:OpenTransitRouterService	OpenTransitRouterService	none	All Resource ``	None	None
cen:CreateCenBandwidthPackage	CreateCenBandwidthPackage	create	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/*`	None	None
cen:CreateTransitRouterCidr	CreateTransitRouterCidr	create	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:CreateTransitRouter	CreateTransitRouter	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/*`	None	None
cen:ListTrafficMarkingPolicies	ListTrafficMarkingPolicies	list	All Resource ``	None	None
cen:CreateTransitRouterRouteTable	CreateTransitRouterRouteTable	create	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/*`	None	None
cen:DeleteTransitRouterMulticastDomain	DeleteTransitRouterMulticastDomain	delete	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:ModifyCenAttribute	ModifyCenAttribute	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeleteTransitRouter	DeleteTransitRouter	delete	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:DescribeRouteServicesInCen	DescribeRouteServicesInCen	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:CreateTransitRouteTableAggregation	CreateTransitRouteTableAggregation	create	All Resource ``	None	None
cen:ListTransitRouterVpnAttachments	ListTransitRouterVpnAttachments	list	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouterVpnAttachment `acs:cen::{#accountId}:centransitrouterattachment/` TransitRouterVpnAttachment `acs:cen:*:{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:ModifyCenRouteMap	ModifyCenRouteMap	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouterVbrAttachments	ListTransitRouterVbrAttachments	list	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouterVbrAttachment `acs:cen::{#accountId}:centransitrouterattachment/` TransitRouterVbrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:CreateTransitRouterVpcAttachment	CreateTransitRouterVpcAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/{#TransitRouterId}`	None	None
cen:ListTransitRouterMulticastDomainVSwitches	ListTransitRouterMulticastDomainVSwitches	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:MoveResourceGroup	MoveResourceGroup	update	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}` CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeleteCen	DeleteCen	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouterRouteTablePropagations	ListTransitRouterRouteTablePropagations	get	TransitRouterPeerAttachment `acs:cen::{#accountid}:centransitrouterattachment/{#TransitRouterAttachmentId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#TransitRouterRouteTableId}`	None	None
cen:DescribeRouteConflict	DescribeRouteConflict	get	VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:DeleteTransitRouterPrefixListAssociation	DeleteTransitRouterPrefixListAssociation	delete	All Resource ``	None	None
cen:DeleteRouteServiceInCen	DeleteRouteServiceInCen	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:RoutePrivateZoneInCenToVpc	RoutePrivateZoneInCenToVpc	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouterCidr	ListTransitRouterCidr	get	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:ModifyCenBandwidthPackageSpec	ModifyCenBandwidthPackageSpec	update	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}`	None	None
cen:DeleteTransitRouterRouteTable	DeleteTransitRouterRouteTable	delete	TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId}`	None	None
cen:ModifyTransitRouterMulticastDomain	ModifyTransitRouterMulticastDomain	update	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#TransitRouterMulticastDomainId}`	None	None
cen:RegisterTransitRouterMulticastGroupMembers	RegisterTransitRouterMulticastGroupMembers	create	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:UpdateTransitRouter	UpdateTransitRouter	update	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:DeleteTransitRouterVpcAttachment	DeleteTransitRouterVpcAttachment	delete	TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DescribeTransitRouteTableAggregationDetail	DescribeTransitRouteTableAggregationDetail	get	All Resource ``	None	None
cen:DescribeCenBandwidthPackages	DescribeCenBandwidthPackages	get	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/*`	None	None
cen:DescribeCenChildInstanceRouteEntries	DescribeCenChildInstanceRouteEntries	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:ListTransitRouters	ListTransitRouters	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/` TransitRouter `acs:cen:*:{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:ListTransitRouterMulticastGroups	ListTransitRouterMulticastGroups	get	TransitRouterMulticastDomain `acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId}`	None	None
cen:UpdateTransitRouterVbrAttachmentAttribute	UpdateTransitRouterVbrAttachmentAttribute	update	TransitRouterVbrAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:CheckTransitRouterService	CheckTransitRouterService	none	All Resource ``	None	None
cen:ListCenInterRegionTrafficQosQueues	ListCenInterRegionTrafficQosQueues	get	All Resource ``	None	None
cen:ModifyTransitRouterCidr	ModifyTransitRouterCidr	update	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:AddTrafficMatchRuleToTrafficMarkingPolicy	AddTrafficMatchRuleToTrafficMarkingPolicy	create	All Resource ``	None	None
cen:DescribePublishedRouteEntries	DescribePublishedRouteEntries	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}` VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:CreateCen	CreateCen	create	CenInstance `acs:cen::{#accountId}:ceninstance/*`	None	None
cen:DescribeGrantRulesToResource	DescribeGrantRulesToResource	get	VPC `acs:vpc::{#accountId}:vpc/{#VpcId}`	None	None
cen:UpdateCenInterRegionTrafficQosPolicyAttribute	UpdateCenInterRegionTrafficQosPolicyAttribute	update	All Resource ``	None	None
cen:ListTransitRouterVpcAttachments	ListTransitRouterVpcAttachments	list	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/` TransitRouterVpcAttachment `acs:cen:*:{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:UpdateTransitRouterVpcAttachmentAttribute	UpdateTransitRouterVpcAttachmentAttribute	update	TransitRouterVpcAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:ListTransitRouterRouteTableAssociations	ListTransitRouterRouteTableAssociations	get	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}` TransitRouterRouteTable `acs:cen::{#accountId}:centransitrouterroutetable/{#TransitRouterRouteTableId}`	None	None
cen:ActiveFlowLog	ActiveFlowLog	update	*Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/{#flowlogId}`	None	None
cen:DeleteTransitRouterPeerAttachment	DeleteTransitRouterPeerAttachment	delete	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:DeleteCenRouteMap	DeleteCenRouteMap	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeleteFlowlog	DeleteFlowlog	delete	*Flowlog `acs:cbn:{#regionId}:{#accountId}:flowlog/{#flowlogId}`	None	None
cen:CreateTransitRouterPeerAttachment	CreateTransitRouterPeerAttachment	create	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` TransitRouter `acs:cen::{#accountId}:centransitrouter/{#TransitRouterId}`	None	None
cen:DetachCenChildInstance	DetachCenChildInstance	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}` VPC `acs:vpc::{#accountId}:vpc/{#vpcId}`	None	None
cen:EnableCenVbrHealthCheck	EnableCenVbrHealthCheck	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}` virtualborderrouter `acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId}`	None	None
cen:RefreshTransitRouteTableAggregation	RefreshTransitRouteTableAggregation	update	All Resource ``	None	None
cen:UntagResources	UntagResources	update	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:RemoveTraficMatchRuleFromTrafficMarkingPolicy	RemoveTraficMatchRuleFromTrafficMarkingPolicy	delete	All Resource ``	None	None
cen:DeleteCenInterRegionTrafficQosPolicy	DeleteCenInterRegionTrafficQosPolicy	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#CenId}`	None	None
cen:DeleteTrafficMarkingPolicy	DeleteTrafficMarkingPolicy	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#CenId}`	None	None
cen:DescribeCenRouteMaps	DescribeCenRouteMaps	get	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DescribeCenInterRegionBandwidthLimits	DescribeCenInterRegionBandwidthLimits	get	CenInstance `acs:cen::{#accountId}:ceninstance/` CenInstance `acs:cen:*:{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:DeleteCenChildInstanceRouteEntryToAttachment	DeleteCenChildInstanceRouteEntryToAttachment	delete	CenInstance `acs:cen::{#accountId}:ceninstance/{#ceninstanceId}`	None	None
cen:EnableTransitRouterRouteTablePropagation	EnableTransitRouterRouteTablePropagation	update	TransitRouterPeerAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:UpdateTransitRouterVpnAttachmentAttribute	UpdateTransitRouterVpnAttachmentAttribute	update	TransitRouterVpnAttachment `acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId}`	None	None
cen:CreateTransitRouterPrefixListAssociation	CreateTransitRouterPrefixListAssociation	create	All Resource ``	None	None
cen:DeleteTransitRouterCidr	DeleteTransitRouterCidr	delete	TransitRouter `acs:cen::{#accountId}:centransitrouter/{#centransitrouterId}`	None	None
cen:DeleteCenBandwidthPackage	DeleteCenBandwidthPackage	delete	CenBandwidthPackage `acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId}`	None	None
cen:ModifyTrafficMatchRuleToTrafficMarkingPolicy	ModifyTrafficMatchRuleToTrafficMarkingPolicy	update	All Resource ``	None	None

Resource

The following table lists the resources defined by Cloud Enterprise Network. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
TransitRouterPeerAttachment	acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId} acs:cen::{#accountId}:centransitrouterattachment/* acs:cen:*:{#accountid}:centransitrouterattachment/{#TransitRouterAttachmentId}
TransitRouterEcrAttachment	acs:cen::{#accountId}:centransitrouterattachment/{#TransitRouterAttachmentId} acs:cen::{#accountId}:centransitrouterattachment/*
TransitRouterRouteEntry	acs:cen::{#accountId}:transitrouterrouteentry/{#TransitRouterRouteEntryId} acs:cen::{#accountId}:centransitrouterroutentry/{#centransitrouterroutentryId} acs:cen::{#accountId}:transitrouterrouteentry/ acs:cen::{#accountId}:centransitrouterroutentry/
TransitRouterRouteTable	acs:cen::{#accountId}:transitrouterroutetable/{#TransitRouterRouteTableId} acs:cen::{#accountId}:centransitrouterroutetable/{#centransitrouterroutetableId} acs:cen::{#accountId}:centransitrouterroutentry/{#transitrouterroutetableId} acs:cen::{#accountId}:centransitrouterroutetable/{#TransitRouterRouteTableId} acs:cen::{#accountId}:transitrouterroutetable/{#TransitRouteTableId} acs:cen::{#accountId}:centransitrouterroutetable/*
CenInstance	acs:cen::{#accountId}:ceninstance/{#ceninstanceId} acs:cen::{#accountId}:ceninstance/* acs:cen:*:{#accountId}:ceninstance/{#CenId}
virtualborderrouter	acs:vpc::{#accountId}:virtualborderrouter/{#virtualborderrouterId} acs:vpc::{#accountId}:virtualborderrouter/*
VPC	acs:vpc:*:{#accountId}:vpc/{#vpcId}
TransitRouter	acs:cen::{#accountId}:centransitrouter/{#centransitrouterId} acs:cen::{#accountId}:centransitrouter/{#TransitRouterId} acs:cen::{#accountId}:centransitrouter/
TransitRouterMulticastDomain	acs:cen::{#accountId}:centransitroutermulticast/ acs:cen::{#accountId}:centransitroutermulticast/{#centransitroutermulticastId} acs:cen::{#accountId}:centransitroutermulticast/{#TransitRouterMulticastDomainId}
CenBandwidthPackage	acs:cen::{#accountId}:cenbandwidthpackage/{#cenbandwidthpackageId} acs:cen::{#accountId}:cenbandwidthpackage/*
Flowlog	acs:cbn:{#regionId}:{#accountId}:flowlog/* acs:cbn:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
TransitRouterVbrAttachment	acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId} acs:cen::{#accountId}:centransitrouterattachment/*
TransitRouterVpnAttachment	acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId} acs:cen::{#accountId}:centransitrouterattachment/*
TransitRouterVpcAttachment	acs:cen::{#accountId}:centransitrouterattachment/{#centransitrouterattachmentId} acs:cen::{#accountId}:centransitrouterattachment/*

Condition

Cloud Enterprise Network does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: