RAM authorization

Authorize a RAM user or RAM role to access cloud resources

By default, a RAM user or RAM role does not have the permissions to create or modify cloud resources by calling Alibaba Cloud APIs. Before you call an API as a RAM user or RAM role, you must authorize the RAM user or RAM role to call the API. This requires you to create and attach a RAM policy to the RAM user or RAM role.

When you create the RAM policy, you can specify the resource that the RAM user or RAM role wants to access by the Alibaba Resource Name (ARN) of the resource. An ARN is a globally unique name that is used to identify a cloud resource in Alibaba Cloud.

An ARN uses the following format:

acs:service-name:region:account-id:resource-relative-id

Where:

• acs: the acronym of Alibaba Cloud Service.
• service-name: the name of an Alibaba Cloud service, such as Elastic Compute Service (ECS), Object Storage Service (OSS), and Server Load Balancer (SLB).

• region: the region where the cloud resource is deployed. If this parameter is not supported by the cloud resource, set the value to an asterisk (*).

• account-id: the ID of the account that owns the cloud resource, for example, 1234567890123456.

• resource-relative-id: the description of the cloud resource. The description varies based on the Alibaba Cloud service. For more information, see the documentation of Alibaba Cloud services.

  For example, acs:oss::1234567890123456:sample_bucket/file1.txt indicates a resource named sample_bucket/file1.txt in OSS. 1234567890123456 is the ID of the account that owns the cloud resource.

Authorize a RAM user or RAM role to manage ACK

"Resource": [
     "acs:cs:*:*:cluster/Cluster ID"
 ]

"Resource": [
     "acs:cs:*:*:cluster/Cluster ID",
     "acs:cs:*:*:cluster/Cluster ID"
 ]

"Resource": [
     "*"
 ]

Mappings between API operations and RAM actions

The following table describes the mappings between the ACK API operations and the RAM actions.