Grant RAM permissions to a RAM user or RAM role - Container Compute Service

By default, RAM users and RAM roles cannot call cloud service APIs. To use APIs for Container Service for Kubernetes (ACK) and Container Compute Service (ACS) or view clusters in the ACS console, you must grant the necessary permissions.

Prerequisites

Before creating a custom policy, familiarize yourself with the basic structure and syntax of the policy language. For more information, see Policy elements.

System policies

Use system policies for quick authorization when a RAM user or RAM role needs O&M permissions on all clusters in your Alibaba Cloud account.

Common system policies for ACS

Policy name	Description
AliyunAccFullAccess	Grants full access to all Container Compute Service (ACS) APIs.
AliyunCSFullAccess	Grants full access to all Container Service for Kubernetes (ACK) APIs. Note This system policy includes only RAM permissions for ACK. If you need to manage applications in an ACK cluster, you must also grant RBAC permissions. For more information, see Custom RBAC policies. This policy grants read and write permissions on all ACK clusters, excluding ACS-type clusters. Grant these permissions with caution.
AliyunVPCReadOnlyAccess	Allows selecting a Virtual Private Cloud (VPC) when you create a cluster.
AliyunECSReadOnlyAccess	Allows viewing cluster node details.
AliyunContainerRegistryFullAccess	Grants permissions to manage container images in your Alibaba Cloud account.
AliyunLogReadOnlyAccess	Allows selecting an existing Log Service project to store audit logs or view the configuration inspection of a cluster.
AliyunAHASReadOnlyAccess	Allows viewing the cluster topology by using Application High Availability Service (AHAS).
AliyunRAMFullAccess	Grants permissions to manage authorizations across your Alibaba Cloud account.
AliyunYundunSASReadOnlyAccess	Allows viewing runtime security monitoring for a cluster by using Security Center.
AliyunARMSReadOnlyAccess	Allows viewing the monitoring status of the Prometheus plug-in for a cluster by using Application Real-Time Monitoring Service (ARMS).
AliyunKMSReadOnlyAccess	Allows viewing keys in Key Management Service (KMS) when you create an ACK Pro cluster.
AliyunESSReadOnlyAccess	Allows viewing node pool operations by using Auto Scaling.

Attach a system policy

Note

An Alibaba Cloud account has full permissions on all resources. You can also grant AdministratorAccess to a RAM user to make it an account administrator who manages all resources. See Create a RAM user as an account administrator.

Log on to the RAM console.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the target RAM user and click Actions column > Attach Policy.

You can also select multiple RAM users and click Attach Policy below the user list for batch authorization.
In the Grant Permission panel, select a policy and complete the authorization.
1. Resource scope:
  - Account level: Permissions apply to all resources in your Alibaba Cloud account.
  - Resource group level: Permissions apply only within the specified resource group. After logging on, the RAM user must switch to the authorized resource group in the top navigation bar.
    Note
    
    The system marks high-risk system policies (such as AdministratorAccess and AliyunRAMFullAccess) with a warning indicator. These policies typically grant full control over all cloud resources or full management of RAM. Grant these policies with caution.
    
    For resource group authorization examples, see Control RAM user access to specific ECS instances.
2. Principal:
  
  The principal is the RAM user receiving permissions. From the Users page, the system auto-selects the current user. From the Grants page, you must manually select the user. Batch selection is supported.
3. Select the system policy to attach.
4. Click OK, then click Close to complete the authorization.

Custom policies

ACK provides coarse-grained system policies. If these do not meet your security requirements, create a custom policy. For example, custom policies are required for fine-grained access control, such as managing permissions for a specific cluster.

Step 1: Create a custom policy

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.

On the Create Policy page, click the JSON tab and paste the following policy document.

{
 "Statement": [{
     "Action": [
         "cs:Get*",
         "cs:List*",
         "cs:Describe*",
         "cs:ScaleCluster",
         "cs:DeleteCluster"
     ],
     "Effect": "Allow",
     "Resource": [
         "acs:cs:*:*:cluster/<cluster_id>"
     ]
 }],
 "Version": "1"
}

Parameter

Description

Action

The permissions to grant. All actions support wildcards.

Resource

You can configure this parameter in one of the following ways. Replace <cluster_id> with your cluster ID, for example, cae93341766c843479ae986b3305xxxxx.

Grant permissions on a single cluster

"Resource": [
     "acs:cs:*:*:cluster/<cluster_id>"
 ]

Grant permissions on multiple clusters

"Resource": [
     "acs:cs:*:*:cluster/<cluster_id_1>",
     "acs:cs:*:*:cluster/<cluster_id_2>"
 ]

Grant permissions on all clusters
```
"Resource": [
     "*"
 ]
```

After you paste the policy content, click OK. In the dialog box that appears, enter a policy name and click OK.
Return to the Policies page and search by the policy name or description to verify its creation.

Step 2: Attach the custom policy

The procedure to attach a custom policy is the same as for a system policy. During the selection step, choose the custom policy you created. For more information, see Attach a system policy.

Example

Grant permissions for API operations that do not support cluster-level authorization

Some API operations, such as DescribeEvents, do not support cluster-level authorization. To grant a RAM user or RAM role permissions for these API operations, do not specify a cluster ID in the Resource element.

For example, consider the following RAM policy:

{
    "Statement": [
        {
            "Action": [
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
                "acs:cs:*:*:cluster/<cluster_id>"
            ]
        }
    ],
    "Version": "1"
}

To grant permissions for the DescribeEvents API operation, which does not support cluster-level authorization, add a new statement. This statement must contain the cs:DescribeEvents action and specify a wildcard resource (*). The modified policy is as follows:

{
    "Statement": [
        {
            "Action": [
                "cs:DescribeEvents"
            ],
            "Effect": "Allow",
            "Resource": [
              "*"
            ]
        },
        {
            "Action": [
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
                "acs:cs:*:*:cluster/<cluster_id>"
            ]
        }
    ],
    "Version": "1"
}

Next steps

After granting RAM permissions, you must also configure Role-Based Access Control (RBAC) permissions to manage Kubernetes resources within the cluster. For more information, see Grant RBAC permissions to a RAM user or RAM role.

Before granting RBAC permissions, ensure the RAM user or RAM role has read-only RAM permissions for the target cluster. The following policy is an example:

{
  "Statement": [
    {
      "Action": [
        "cs:Get*",
        "cs:List*",
        "cs:Describe*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:cs:*:*:cluster/<cluster_id>"
      ]
    }
  ],
  "Version": "1"
}