Cloud Monitor:Grant permissions to a RAM user

Procedure

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the target RAM user and click Add Permissions in the Actions column.

   You can also select multiple RAM users and click Add Permissions below the user list to grant permissions in bulk.

4. In the Grant Permission panel, configure the following settings:

   1. For Resource Range, select Account.

      Note

      Cloud Monitor only supports granting permissions at the account level, not to specific resource groups.

   2. Select the principal.

      The principal is the RAM user that you want to grant permissions to. This field is automatically populated with the RAM users you selected.

   3. Select a policy.

      • System Policy: From the Policy Name list, select the required policy.

        Policy	Description
        AliyunCloudMonitorFullAccess	Grants full access to Cloud Monitor.
        AliyunCloudMonitorReadOnlyAccess	Grants read-only access to Cloud Monitor.

      • Custom policy: From the Policy Name list, select the required policy.

        To learn how to create a custom policy, see Create a custom policy.

        For example, to grant a RAM user permissions to export monitoring data, use the following policy:

        {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "cms:BatchGet",
                "cms:Cursor"
              ],
              "Resource": [
                "*"
              ],
              "Condition": {}
            }
          ]
        }

   4. Click Confirm.

5. Click Close.