Create a custom RAM policy - Container Compute Service - Alibaba Cloud Documentation Center

This topic shows you how to create a custom policy to grant a RAM user or RAM role permissions to query, scale, and delete clusters in Container Compute Service (ACS).

Prerequisites

Before you create a custom policy, you must understand the basic structure and syntax of the policy language. For more information, see Policy elements.

Background

The system policies that ACK provides offer coarse-grained permissions. If these policies do not meet your needs, you can create a custom policy. For example, to control operations on a specific cluster, a custom policy is required to achieve such fine-grained control.

Before you grant cluster RBAC permissions to a RAM user or RAM role, you must grant RAM permissions for cluster management. You can grant the RAM user or RAM role a read or write policy for the target cluster:

Read policy: Lets you view basic information, such as cluster configurations and the kubeconfig file.
Write policy: Grants permissions for cluster management tasks, such as scaling, upgrading, and deleting clusters.

Before you can grant RBAC permissions, the RAM user or RAM role must have at least read-only permissions to the cluster. The following sample policy grants read-only access:

{
  "Statement": [
    {
      "Action": [
        "cs:Describe*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:cs:*:*:cluster/"
      ]
    }
  ],
  "Version": "1"
}

After you grant RAM permissions, you must configure RBAC permissions to allow access to Kubernetes resources within the cluster.

Custom policies

ACK provides coarse-grained system policies. If these do not meet your security requirements, create a custom policy. For example, custom policies are required for fine-grained access control, such as managing permissions for a specific cluster.

Step 1: Create a custom policy

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Permissions > Policies.
On the Policies page, click Create Policy.

On the Create Policy page, click the JSON tab and paste the following policy document.

{
 "Statement": [{
     "Action": [
         "cs:Get*",
         "cs:List*",
         "cs:Describe*",
         "cs:ScaleCluster",
         "cs:DeleteCluster"
     ],
     "Effect": "Allow",
     "Resource": [
         "acs:cs:*:*:cluster/<cluster_id>"
     ]
 }],
 "Version": "1"
}

Parameter

Description

Action

The permissions to grant. All actions support wildcards.

Resource

You can configure this parameter in one of the following ways. Replace <cluster_id> with your cluster ID, for example, cae93341766c843479ae986b3305xxxxx.

Grant permissions on a single cluster

"Resource": [
     "acs:cs:*:*:cluster/<cluster_id>"
 ]

Grant permissions on multiple clusters

"Resource": [
     "acs:cs:*:*:cluster/<cluster_id_1>",
     "acs:cs:*:*:cluster/<cluster_id_2>"
 ]

Grant permissions on all clusters
```
"Resource": [
     "*"
 ]
```

After you paste the policy content, click OK. In the dialog box that appears, enter a policy name and click OK.
Return to the Policies page and search by the policy name or description to verify its creation.

Step 2: Attach the custom policy

The procedure to attach a custom policy is the same as for a system policy. During the selection step, choose the custom policy you created. For more information, see Attach a system policy.

References

Grant permissions for non-cluster-specific ACK API operations

Some ACK API operations, such as DescribeEvents, are not scoped to a specific cluster. To grant permissions for these operations to a RAM user or RAM role, do not specify a cluster ID in the Resource element.

For example, the following policy grants Describe* permissions on all resources, which is required for non-cluster-specific operations:

{
    "Statement": [
        {
            "Action": [
                "cs:Describe*"
            ],
            "Effect": "Allow",
            "Resource": [
                "*"
            ]
        }
    ],
    "Version": "1"
}