RAM authorization - Cloud Backup - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by HBR. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate HBR is [{"popCode":"hbr-inner","ramCodes":["hbr-inner"]},{"popCode":"hbr","ramCodes":["hbr"]}]. You can grant permissions on HBR at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

HBR defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
hbr:GenerateRamPolicy	GenerateRamPolicy	none	All Resources *	None	None
hbr:UpdateVault	UpdateVault	update	All Resources *	None	None
hbr:CreatePolicyV2	CreatePolicyV2	create	All Resources *	None	None
hbr:StopHanaDatabaseAsync	StopHanaDatabaseAsync	update	All Resources *	None	None
hbr:DescribePoliciesV2	DescribePoliciesV2	list	All Resources *	None	None
hbr:UpdatePolicyBinding	UpdatePolicyBinding	update	All Resources *	None	None
hbr:DescribeBackupPlans	DescribeBackupPlans	get	All Resources *	None	None
hbr:UpgradeBackupClients	UpgradeBackupClients		All Resources *	None	None
hbr:DescribeHanaRetentionSetting	DescribeHanaRetentionSetting	get	All Resources *	None	None
hbr:CreateClients	CreateClients	create	All Resources *	None	None
hbr:DeleteBackupClientResource	DeleteBackupClientResource	delete	All Resources *	None	None
hbr:CreateHanaInstance	CreateHanaInstance	create	All Resources *	None	None
hbr:UpdateClientSettings	UpdateClientSettings	update	All Resources *	None	None
hbr:CreateRestoreJob	CreateRestoreJob	create	All Resources *	None	None
hbr:UninstallBackupClients	UninstallBackupClients		All Resources *	None	None
hbr:DescribeHanaInstances	DescribeHanaInstances	get	All Resources *	None	None
hbr:CreateHanaBackupPlan	CreateHanaBackupPlan	create	All Resources *	None	None
hbr:DescribeHanaBackupPlans	DescribeHanaBackupPlans	get	All Resources *	None	None
hbr:SearchHistoricalSnapshots	SearchHistoricalSnapshots	get	All Resources *	None	None
hbr:EnableHanaBackupPlan	EnableHanaBackupPlan	update	All Resources *	None	None
hbr:UpdateHanaBackupSetting	UpdateHanaBackupSetting	update	All Resources *	None	None
hbr:CreateReplicationVault	CreateReplicationVault	create	All Resources *	None	None
hbr:DeletePolicyBinding	DeletePolicyBinding		All Resources *	None	None
hbr:DeletePolicyV2	DeletePolicyV2		All Resources *	None	None
hbr:CreateHanaRestore	CreateHanaRestore	create	All Resources *	None	None
hbr:DescribeUdmSnapshots	DescribeUdmSnapshots	list	All Resources *	None	None
hbr:DescribeCrossAccounts	DescribeCrossAccounts		All Resources *	None	None
hbr:DeleteHanaInstance	DeleteHanaInstance	delete	All Resources *	None	None
hbr:DeleteAirEcsInstance	DeleteAirEcsInstance	delete	All Resources *	None	None
hbr:CreateVault	CreateVault	create	All Resources *	None	None
hbr:DescribeHanaDatabases	DescribeHanaDatabases	get	All Resources *	None	None
hbr:DescribeBackupJobs2	DescribeBackupJobs2	get	All Resources *	None	None
hbr:UpgradeClient	UpgradeClient	update	All Resources *	None	None
hbr:UpdatePolicyV2	UpdatePolicyV2	update	All Resources *	None	None
hbr:DeleteUdmDisk	DeleteUdmDisk	delete	All Resources *	None	None
hbr:DescribeVaults	DescribeVaults	get	All Resources *	None	None
hbr:CreatePolicyBindings	CreatePolicyBindings	create	All Resources *	None	None
hbr:UpdateHanaBackupPlan	UpdateHanaBackupPlan	update	All Resources *	None	None
hbr:DetachNasFileSystem	DetachNasFileSystem		All Resources *	None	None
hbr:DescribeContainerCluster	DescribeContainerCluster	get	All Resources *	None	None
hbr:UpdateContainerCluster	UpdateContainerCluster	update	All Resources *	None	None
hbr:DisableHanaBackupPlan	DisableHanaBackupPlan	update	All Resources *	None	None
hbr:DescribeRestoreJobs2	DescribeRestoreJobs2	get	All Resources *	None	None
hbr:DeleteSnapshot	DeleteSnapshot	delete	All Resources *	None	None
hbr:ExecuteBackupPlan	ExecuteBackupPlan	create	All Resources *	None	None
hbr:UpdateHanaInstance	UpdateHanaInstance	update	All Resources *	None	None
hbr:UpdateHanaRetentionSetting	UpdateHanaRetentionSetting	update	All Resources *	None	None
hbr:DescribePolicyBindings	DescribePolicyBindings	list	All Resources *	None	None
hbr:ChangeResourceGroup	ChangeResourceGroup		All Resources *	None	None
hbr:CreateBackupPlan	CreateBackupPlan	create	All Resources *	None	None
hbr:GetTempFileDownloadLink	GetTempFileDownloadLink	get	All Resources *	None	None
hbr:DescribeBackupClients	DescribeBackupClients	get	All Resources *	None	None
hbr:CreateBackupJob	CreateBackupJob	create	All Resources *	None	None
hbr:DeleteClient	DeleteClient	delete	All Resources *	None	None
hbr:DeleteVault	DeleteVault	delete	All Resources *	None	None
hbr:CheckRole	CheckRole	none	All Resources *	None	None
hbr:DeleteBackupPlan	DeleteBackupPlan	delete	All Resources *	None	None
hbr:DeleteHanaBackupPlan	DeleteHanaBackupPlan	delete	All Resources *	None	None
hbr:UpdateBackupPlan	UpdateBackupPlan	update	All Resources *	None	None
hbr:DeleteBackupClient	DeleteBackupClient	delete	All Resources *	None	None
hbr:ExecutePolicyV2	ExecutePolicyV2		All Resources *	None	None
hbr:StartHanaDatabaseAsync	StartHanaDatabaseAsync	update	All Resources *	None	None
hbr:UninstallClient	UninstallClient	delete	All Resources *	None	None
hbr:DescribeHanaRestores	DescribeHanaRestores	get	All Resources *	None	None
hbr:CancelRestoreJob	CancelRestoreJob	update	All Resources *	None	None
hbr:DescribeClients	DescribeClients	get	All Resources *	None	None
hbr:DescribeOtsTableSnapshots	DescribeOtsTableSnapshots	get	All Resources *	None	None
hbr:DescribeHanaBackupSetting	DescribeHanaBackupSetting	get	All Resources *	None	None
hbr:AddContainerCluster	AddContainerCluster	create	All Resources *	None	None
hbr:DeleteUdmEcsInstance	DeleteUdmEcsInstance		All Resources *	None	None
hbr:DescribeHanaBackupsAsync	DescribeHanaBackupsAsync	get	All Resources *	None	None
hbr:DisableBackupPlan	DisableBackupPlan	update	All Resources *	None	None
hbr:EnableBackupPlan	EnableBackupPlan	update	All Resources *	None	None
hbr:DescribeTask	DescribeTask	get	All Resources *	None	None
hbr:CreateTempFileUploadUrl	CreateTempFileUploadUrl		All Resources *	None	None
hbr:CancelBackupJob	CancelBackupJob	delete	All Resources *	None	None
hbr:DescribeRecoverableOtsInstances	DescribeRecoverableOtsInstances	get	All Resources *	None	None
hbr:OpenHbrService	OpenHbrService	create	All Resources *	None	None
hbr:InstallBackupClients	InstallBackupClients		All Resources *	None	None

Resource

HBR defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN

No data

Condition

HBR does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: