Container Service for Kubernetes:Create a custom RAM policy

Create a custom policy

1. Log on to the RAM console by using your Alibaba Cloud account or as an authorized RAM user or RAM role.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the Create Policy Page, click JSON. Then, enter the policy content in the Policy Document code editor.

   {
    "Statement": [{
        "Action": [
            "cs:Get*",
            "cs:List*",
            "cs:Describe*",
            "cs:ScaleCluster",
            "cs:DeleteCluster"
        ],
        "Effect": "Allow",
        "Resource": [
            "acs:cs:*:*:cluster/Cluster ID"
        ]
    }],
    "Version": "1"
   }

   Configure the policy based on the following description:

   • Enter the permissions that you want to grant in the Action field.
     Note You can use wildcard characters in the Action field.
   • Set the Resource field based on your requirements:
     • Grant permissions on one cluster

       "Resource": [
            "acs:cs:*:*:cluster/Cluster ID"
        ]

     • Grant permissions on multiple clusters

       "Resource": [
            "acs:cs:*:*:cluster/Cluster ID",
            "acs:cs:*:*:cluster/Cluster ID"
        ]

     • Grant permissions on all clusters

       "Resource": [
            "*"
        ]

       Replace Cluster ID with the ID of your cluster.
5. After editing the policy, click Next Step, enter the Name and then click OK.
6. Return to the Policies page. You can enter the policy name or note in the search box and click the search icon to find the newly created policy.

References

Mappings between RAM actions and API operations

Authorize a RAM user or RAM role to call non-cluster-specific API operations

If you want to authorize a RAM user or RAM role to call non-cluster-specific API operations, such as DescribeEvents, do not specify cluster IDs in the Resource field of the policy content.

{
    "Statement": [
        {
            "Action": [
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
                "acs:cs:*:*:cluster/c2e63856bcd714197****"
            ]
        }
    ],
    "Version": "1"
}

{
    "Statement": [
        {
            "Action": [
                "cs:DescribeEvents"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ]
        },
        {
            "Action": [
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
                "acs:cs:*:*:cluster/c2e63856bcd714197****"
            ]
        }
    ],
    "Version": "1"
}