Cloud Shell:Authorization information

General structure of a policy

Policies are stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

• Effect: specifies the authorization result. Valid values: Allow and Deny.

• Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.

• Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource.

• Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.

  • Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.

  • Condition_key: specifies the condition keys.

  • Condition_value: specifies the condition values.

Action

The following table describes the values that you can use in the Action element of a policy statement. The values are defined by Cloud Shell. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform an operation. The following list describes the columns in the table:

• Operation: the value that you can use in the Action element to specify the operation on a resource.

• Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.

Condition

Cloud Shell does not define service-specific condition keys. For information about common condition keys that are defined by Alibaba Cloud, see Policy elements.

Related operations

You can attach a custom policy to a RAM user, RAM user group, or RAM role. Perform the following operations:

• Grant permissions to a RAM user

• Grant permissions to a RAM user group

• Grant permissions to a RAM role