DataWorks:Restrict RAM user access by IP address

Create a custom policy

1. Log in to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Manage Permissions > Permission Policy, and then click Create Policy. On the Create Policy page, click the JSON tab.

3. In the policy editor, configure your custom policy.

   This policy denies requests from IP addresses not listed in "acs:SourceIP". You can specify multiple IP addresses. For more information about policy elements, see Policy elements.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Deny",
               "Action": [
                   "dataworks:*"
               ],
               "Resource": [
                   "acs:dataworks:*:*:*"
               ],
               "Condition": {
                   "NotIpAddress": {
                       "acs:SourceIp": [
                           "10.0.0.0",
                           "192.168.0.0"
                       ]
                   }
               }
           }
       ]
   }

   Note

   To restrict access to specific IP addresses, you must use an "Effect": "Deny" statement. For more information about the policy syntax and structure, see Policy syntax and structure.

4. Optional: Use Advanced Policy Optimization.

   You can click Advanced Policy Optimization and then click Execution to optimize the policy content. The advanced policy optimization feature can:

   • Split resources or conditions that are incompatible with actions.

   • Narrow the scope of resources.

   • Deduplicate or merge policy statements.

5. Click Determine. In the dialog box that appears, enter a Name and Remarks for the policy.

6. Click Determine to create the policy.

Grant the custom policy to a RAM user

1. In the left-side navigation pane, choose Identities > User. Find the target RAM user and click Add Permissions in the Operation column.

2. Alternatively, select multiple RAM users and click Add Permissions below the user list to grant permissions in bulk.

3. Select Custom Policy. From the Policy Name list on the left, select the policy.

   Note

   • The system automatically populates the principal.

   • In the section on the right, you can click the × icon next to a policy to remove it.

4. Click Confirm Authorization, and then click Close.