RAM authorization - Data Management - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by DMSEnterprise. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate DMSEnterprise is dms, dms-console. You can grant permissions on DMSEnterprise at the OPERATION.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

DMSEnterprise defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- For mandatory resource types, indicate with a prefix of * .
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
dms:AddDesensitizationRule	AddDesensitizationRule	create	All Resources ``	None	None
dms:AddLhMembers	AddLhMembers	update	All Resources ``	None	None
dms:AddLogicTableRouteConfig	AddLogicTableRouteConfig	create	All Resources ``	None	None
dms:AddTaskFlowEdges	AddTaskFlowEdges	create	All Resources ``	None	None
dms:ApproveOrder	ApproveOrder	update	All Resources ``	None	None
dms:BackFill	BackFill	none	All Resources ``	None	None
dms:ChangeColumnSecLevel	ChangeColumnSecLevel	update	All Resources ``	None	None
dms:ChangeLhDagOwner	ChangeLhDagOwner	update	All Resources ``	None	None
dms:CloseOrder	CloseOrder	update	All Resources ``	None	None
dms:CreateAuthorityTemplate	CreateAuthorityTemplate	create	All Resources ``	None	None
dms:CreateDataArchiveOrder	CreateDataArchiveOrder	create	All Resources ``	None	None
dms:CreateDataCorrectOrder	CreateDataCorrectOrder	create	All Resources ``	None	None
dms:CreateDataCronClearOrder	CreateDataCronClearOrder	create	All Resources ``	None	None
dms:CreateDataExportOrder	CreateDataExportOrder	create	All Resources ``	None	None
dms:CreateDataImportOrder	CreateDataImportOrder	create	All Resources ``	None	None
dms:CreateDataTrackOrder	CreateDataTrackOrder	none	All Resources ``	None	None
dms:CreateDatabaseExportOrder	CreateDatabaseExportOrder	Write	All Resources ``	None	None
dms:CreateFreeLockCorrectOrder	CreateFreeLockCorrectOrder	create	All Resources ``	None	None
dms:CreateLakeHouseSpace	CreateLakeHouseSpace	create	All Resources ``	None	None
dms:CreateLogicDatabase	CreateLogicDatabase	create	All Resources ``	None	None
dms:CreateOrder	CreateOrder	create	All Resources ``	None	None
dms:CreateProxy	CreateProxy	create	All Resources ``	None	None
dms:CreateProxyAccess	CreateProxyAccess	create	All Resources ``	None	None
dms:CreatePublishGroupTask	CreatePublishGroupTask	create	All Resources ``	None	None
dms:CreateSQLReviewOrder	CreateSQLReviewOrder	create	All Resources ``	None	None
dms:CreateScenario	CreateScenario	create	All Resources ``	None	None
dms:CreateStandardGroup	CreateStandardGroup	create	All Resources ``	None	None
dms:CreateStructSyncOrder	CreateStructSyncOrder	create	All Resources ``	None	None
dms:CreateTask	CreateTask	create	All Resources ``	None	None
dms:CreateTaskFlow	CreateTaskFlow	create	All Resources ``	None	None
dms:CreateUploadFileJob	CreateUploadFileJob	create	All Resources ``	None	None
dms:CreateUploadOSSFileJob	CreateUploadOSSFileJob	create	All Resources ``	None	None
dms:DeleteInstance	DeleteInstance	delete	All Resources ``	None	None
dms:DeleteLakeHouseSpace	DeleteLakeHouseSpace	delete	All Resources ``	None	None
dms:DeleteLhMembers	DeleteLhMembers	delete	All Resources ``	None	None
dms:DeleteLogicDatabase	DeleteLogicDatabase	delete	All Resources ``	None	None
dms:DeleteLogicTableRouteConfig	DeleteLogicTableRouteConfig	delete	All Resources ``	None	None
dms:DeleteProxy	DeleteProxy	get	All Resources ``	None	None
dms:DeleteProxyAccess	DeleteProxyAccess	delete	All Resources ``	None	None
dms:DeleteScenario	DeleteScenario	delete	All Resources ``	None	None
dms:DeleteTask	DeleteTask	delete	All Resources ``	None	None
dms:DeleteTaskFlow	DeleteTaskFlow	delete	All Resources ``	None	None
dms:DeleteTaskFlowEdgesByCondition	DeleteTaskFlowEdgesByCondition	delete	All Resources ``	None	None
dms:DeleteUser	DeleteUser	delete	All Resources ``	None	None
dms:DisableUser	DisableUser	update	All Resources ``	None	None
dms:DownloadDataTrackResult	DownloadDataTrackResult	none	All Resources ``	None	None
dms:EditLogicDatabase	EditLogicDatabase	update	All Resources ``	None	None
dms:EnableUser	EnableUser	update	All Resources ``	None	None
dms:ExecuteDataCorrect	ExecuteDataCorrect	update	All Resources ``	None	None
dms:ExecuteDataExport	ExecuteDataExport	update	All Resources ``	None	None
dms:ExecuteScript	ExecuteScript	update	All Resources ``	None	None
dms:ExecuteStructSync	ExecuteStructSync	update	All Resources ``	None	None
dms:GetApprovalDetail	GetApprovalDetail	get	All Resources ``	None	None
dms:GetAuthorityTemplate	GetAuthorityTemplate	get	All Resources ``	None	None
dms:GetAuthorityTemplateItem	GetAuthorityTemplateItem	list	All Resources ``	None	None
dms:GetDBTaskSQLJobLog	GetDBTaskSQLJobLog	get	All Resources ``	None	None
dms:GetDBTopology	GetDBTopology	get	All Resources ``	None	None
dms:GetDataArchiveCount	GetDataArchiveCount	none	All Resources ``	None	None
dms:GetDataArchiveOrderDetail	GetDataArchiveOrderDetail	get	All Resources ``	None	None
dms:GetDataCorrectBackupFiles	GetDataCorrectBackupFiles	get	All Resources ``	None	None
dms:GetDataCorrectOrderDetail	GetDataCorrectOrderDetail	get	All Resources ``	None	None
dms:GetDataCorrectRollbackFile	GetDataCorrectRollbackFile	get	All Resources ``	None	None
dms:GetDataCorrectSQLFile	GetDataCorrectSQLFile	get	All Resources ``	None	None
dms:GetDataCorrectTaskDetail	GetDataCorrectTaskDetail	get	All Resources ``	None	None
dms:GetDataCronClearConfig	GetDataCronClearConfig	get	All Resources ``	None	None
dms:GetDataCronClearTaskDetailList	GetDataCronClearTaskDetailList	get	All Resources ``	None	None
dms:GetDataExportDownloadURL	GetDataExportDownloadURL	get	All Resources ``	None	None
dms:GetDataExportOrderDetail	GetDataExportOrderDetail	get	All Resources ``	None	None
dms:GetDataExportPreCheckDetail	GetDataExportPreCheckDetail	get	All Resources ``	None	None
dms:GetDataImportSQL	GetDataImportSQL	none	All Resources ``	None	None
dms:GetDataTrackJobDegree	GetDataTrackJobDegree	none	All Resources ``	None	None
dms:GetDataTrackJobTableMeta	GetDataTrackJobTableMeta	none	All Resources ``	None	None
dms:GetDataTrackOrderDetail	GetDataTrackOrderDetail	none	All Resources ``	None	None
dms:GetDatabase	GetDatabase	get	All Resources ``	None	None
dms:GetDatabaseExportOrderDetail	GetDatabaseExportOrderDetail	get	All Resources ``	None	None
dms:GetInstance	GetInstance	get	All Resources ``	None	None
dms:GetIntervalLimitOfSLA	GetIntervalLimitOfSLA	get	All Resources ``	None	None
dms:GetLhSpaceByName	GetLhSpaceByName	get	All Resources ``	None	None
dms:GetLogicDatabase	GetLogicDatabase	get	All Resources ``	None	None
dms:GetMetaTableColumn	GetMetaTableColumn	get	All Resources ``	None	None
dms:GetMetaTableDetailInfo	GetMetaTableDetailInfo	get	All Resources ``	None	None
dms:GetOnlineDDLProgress	GetOnlineDDLProgress	get	All Resources ``	None	None
dms:GetOpLog	GetOpLog	get	All Resources ``	None	None
dms:GetOrderAttachmentFile	GetOrderAttachmentFile	get	All Resources ``	None	None
dms:GetOrderBaseInfo	GetOrderBaseInfo	get	All Resources ``	None	None
dms:GetOwnerApplyOrderDetail	GetOwnerApplyOrderDetail	get	All Resources ``	None	None
dms:GetPermApplyOrderDetail	GetPermApplyOrderDetail	get	All Resources ``	None	None
dms:GetPhysicalDatabase	GetPhysicalDatabase	get	All Resources ``	None	None
dms:GetProxy	GetProxy	get	All Resources ``	None	None
dms:GetProxyAccess	GetProxyAccess	get	All Resources ``	None	None
dms:GetRuleNumLimitOfSLA	GetRuleNumLimitOfSLA	get	All Resources ``	None	None
dms:GetSQLReviewCheckResultStatus	GetSQLReviewCheckResultStatus	get	All Resources ``	None	None
dms:GetSQLReviewOptimizeDetail	GetSQLReviewOptimizeDetail	get	All Resources ``	None	None
dms:GetStructSyncExecSqlDetail	GetStructSyncExecSqlDetail	get	All Resources ``	None	None
dms:GetStructSyncJobAnalyzeResult	GetStructSyncJobAnalyzeResult	get	All Resources ``	None	None
dms:GetStructSyncJobDetail	GetStructSyncJobDetail	get	All Resources ``	None	None
dms:GetStructSyncOrderDetail	GetStructSyncOrderDetail	get	All Resources ``	None	None
dms:GetTableDBTopology	GetTableDBTopology	get	All Resources ``	None	None
dms:GetTableDesignProjectFlow	GetTableDesignProjectFlow	get	All Resources ``	None	None
dms:GetTableDesignProjectInfo	GetTableDesignProjectInfo	get	All Resources ``	None	None
dms:GetTableTopology	GetTableTopology	get	All Resources ``	None	None
dms:GetTask	GetTask	get	All Resources ``	None	None
dms:GetTaskFlowGraph	GetTaskFlowGraph	get	All Resources ``	None	None
dms:GetTaskFlowNotification	GetTaskFlowNotification	get	All Resources ``	None	None
dms:GetTaskInstanceRelation	GetTaskInstanceRelation	get	All Resources ``	None	None
dms:GetUser	GetUser	get	All Resources ``	None	None
dms:GetUserActiveTenant	GetUserActiveTenant	get	All Resources ``	None	None
dms:GetUserUploadFileJob	GetUserUploadFileJob	get	All Resources ``	None	None
dms:GrantTemplateAuthority	GrantTemplateAuthority	none	All Resources ``	None	None
dms:GrantUserPermission	GrantUserPermission	create	All Resources ``	None	None
dms:InspectProxyAccessSecret	InspectProxyAccessSecret	get	All Resources ``	None	None
dms:ListClassificationTemplates	ListClassificationTemplates	list	All Resources ``	None	None
dms:ListColumns	ListColumns	list	All Resources ``	None	None
dms:ListDAGVersions	ListDAGVersions	list	All Resources ``	None	None
dms:ListDBTaskSQLJob	ListDBTaskSQLJob	list	All Resources ``	None	None
dms:ListDBTaskSQLJobDetail	ListDBTaskSQLJobDetail	list	All Resources ``	None	None
dms:ListDDLPublishRecords	ListDDLPublishRecords	list	All Resources ``	None	None
dms:ListDataCorrectPreCheckDB	ListDataCorrectPreCheckDB	list	All Resources ``	None	None
dms:ListDataCorrectPreCheckSQL	ListDataCorrectPreCheckSQL	list	All Resources ``	None	None
dms:ListDataImportSQLPreCheckDetail	ListDataImportSQLPreCheckDetail	list	All Resources ``	None	None
dms:ListDataImportSQLType	ListDataImportSQLType	list	All Resources ``	None	None
dms:ListDatabaseUserPermssions	ListDatabaseUserPermssions	list	All Resources ``	None	None
dms:ListDatabases	ListDatabases	list	All Resources ``	None	None
dms:ListDefaultSLARules	ListDefaultSLARules	list	All Resources ``	None	None
dms:ListDesensitizationRule	ListDesensitizationRule	list	All Resources ``	None	None
dms:ListEffectiveOrders	ListEffectiveOrders	list	All Resources ``	None	None
dms:ListIndexes	ListIndexes	list	All Resources ``	None	None
dms:ListInstanceLoginAuditLog	ListInstanceLoginAuditLog	list	All Resources ``	None	None
dms:ListInstanceUserPermissions	ListInstanceUserPermissions	list	All Resources ``	None	None
dms:ListInstances	ListInstances	list	All Resources ``	None	None
dms:ListLhTaskFlowAndScenario	ListLhTaskFlowAndScenario	list	All Resources ``	None	None
dms:ListLogicDatabases	ListLogicDatabases	list	All Resources ``	None	None
dms:ListLogicTableRouteConfig	ListLogicTableRouteConfig	list	All Resources ``	None	None
dms:ListLogicTables	ListLogicTables	list	All Resources ``	None	None
dms:ListOrders	ListOrders	list	All Resources ``	None	None
dms:ListProxies	ListProxies	get	All Resources ``	None	None
dms:ListProxyAccesses	ListProxyAccesses	get	All Resources ``	None	None
dms:ListProxySQLExecAuditLog	ListProxySQLExecAuditLog	list	All Resources ``	None	None
dms:ListSLARules	ListSLARules	list	All Resources ``	None	None
dms:ListSQLExecAuditLog	ListSQLExecAuditLog	list	All Resources ``	None	None
dms:ListSQLReviewOriginSQL	ListSQLReviewOriginSQL	list	All Resources ``	None	None
dms:ListScenarios	ListScenarios	list	All Resources ``	None	None
dms:ListSensitiveColumns	ListSensitiveColumns	list	All Resources ``	None	None
dms:ListSensitiveColumnsDetail	ListSensitiveColumnsDetail	list	All Resources ``	None	None
dms:ListSensitiveDataAuditLog	ListSensitiveDataAuditLog	list	All Resources ``	None	None
dms:ListSensitivityLevel	ListSensitivityLevel	list	All Resources ``	None	None
dms:ListStandardGroups	ListStandardGroups	list	All Resources ``	None	None
dms:ListTables	ListTables	list	All Resources ``	None	None
dms:ListTaskFlow	ListTaskFlow	list	All Resources ``	None	None
dms:ListTaskFlowConstants	ListTaskFlowConstants	list	All Resources ``	None	None
dms:ListTaskFlowCooperators	ListTaskFlowCooperators	list	All Resources ``	None	None
dms:ListTaskFlowEdgesByCondition	ListTaskFlowEdgesByCondition	list	All Resources ``	None	None
dms:ListTaskFlowInstance	ListTaskFlowInstance	list	All Resources ``	None	None
dms:ListTaskFlowTimeVariables	ListTaskFlowTimeVariables	list	All Resources ``	None	None
dms:ListTaskFlowsByPage	ListTaskFlowsByPage	list	All Resources ``	None	None
dms:ListTasksInTaskFlow	ListTasksInTaskFlow	list	All Resources ``	None	None
dms:ListUserPermissions	ListUserPermissions	list	All Resources ``	None	None
dms:ListUserTenants	ListUserTenants	list	All Resources ``	None	None
dms:ListUsers	ListUsers	list	All Resources ``	None	None
dms:ListWorkFlowNodes	ListWorkFlowNodes	list	All Resources ``	None	None
dms:ListWorkFlowTemplates	ListWorkFlowTemplates	list	All Resources ``	None	None
dms:MakeTaskFlowInstanceSuccess	MakeTaskFlowInstanceSuccess	update	All Resources ``	None	None
dms:ModifyDataCorrectExecSQL	ModifyDataCorrectExecSQL	update	All Resources ``	None	None
dms:ModifyDesensitizationStrategy	ModifyDesensitizationStrategy	update	All Resources ``	None	None
dms:MoveTaskFlowToScenario	MoveTaskFlowToScenario	update	All Resources ``	None	None
dms:OfflineTaskFlow	OfflineTaskFlow	none	All Resources ``	None	None
dms:PauseDataCorrectSQLJob	PauseDataCorrectSQLJob	update	All Resources ``	None	None
dms:PublishAndDeployTaskFlow	PublishAndDeployTaskFlow	none	All Resources ``	None	None
dms:QueryDataTrackResultDownloadStatus	QueryDataTrackResultDownloadStatus	none	All Resources ``	None	None
dms:ReDeployLhDagVersion	ReDeployLhDagVersion	none	All Resources ``	None	None
dms:ReRunTaskFlowInstance	ReRunTaskFlowInstance	none	All Resources ``	None	None
dms:RefundPayAsYouGoOrder	RefundPayAsYouGoOrder	update	All Resources ``	None	None
dms:RegisterInstance	RegisterInstance	create	All Resources ``	None	None
dms:RegisterUser	RegisterUser	create	All Resources ``	None	None
dms:RestartDataCorrectSQLJob	RestartDataCorrectSQLJob	update	All Resources ``	None	None
dms:ResumeTaskFlowInstance	ResumeTaskFlowInstance	none	All Resources ``	None	None
dms:RetryDataCorrectPreCheck	RetryDataCorrectPreCheck	update	All Resources ``	None	None
dms:RevokeTemplateAuthority	RevokeTemplateAuthority	none	All Resources ``	None	None
dms:RevokeUserPermission	RevokeUserPermission	delete	All Resources ``	None	None
dms:SearchDataTrackResult	SearchDataTrackResult	none	All Resources ``	None	None
dms:SearchDatabase	SearchDatabase	list	All Resources ``	None	None
dms:SearchTable	SearchTable	get	All Resources ``	None	None
dms:SetOwners	SetOwners	update	All Resources ``	None	None
dms:SkipDataCorrectRowCheck	SkipDataCorrectRowCheck	none	All Resources ``	None	None
dms:StopTaskFlowInstance	StopTaskFlowInstance	none	All Resources ``	None	None
dms:SubmitOrderApproval	SubmitOrderApproval	update	All Resources ``	None	None
dms:SubmitStructSyncOrderApproval	SubmitStructSyncOrderApproval	update	All Resources ``	None	None
dms:SuspendTaskFlowInstance	SuspendTaskFlowInstance	none	All Resources ``	None	None
dms:SyncDatabaseMeta	SyncDatabaseMeta	update	All Resources ``	None	None
dms:SyncInstanceMeta	SyncInstanceMeta	update	All Resources ``	None	None
dms:UpdateAuthorityTemplate	UpdateAuthorityTemplate	update	All Resources ``	None	None
dms:UpdateInstance	UpdateInstance	update	All Resources ``	None	None
dms:UpdateSLARules	UpdateSLARules	update	All Resources ``	None	None
dms:UpdateScenario	UpdateScenario	update	All Resources ``	None	None
dms:UpdateStandardGroup	UpdateStandardGroup	update	All Resources ``	None	None
dms:UpdateTaskConfig	UpdateTaskConfig	update	All Resources ``	None	None
dms:UpdateTaskContent	UpdateTaskContent	update	All Resources ``	None	None
dms:UpdateTaskFlowConstants	UpdateTaskFlowConstants	update	All Resources ``	None	None
dms:UpdateTaskFlowCooperators	UpdateTaskFlowCooperators	update	All Resources ``	None	None
dms:UpdateTaskFlowEdges	UpdateTaskFlowEdges	update	All Resources ``	None	None
dms:UpdateTaskFlowNameAndDesc	UpdateTaskFlowNameAndDesc	update	All Resources ``	None	None
dms:UpdateTaskFlowNotification	UpdateTaskFlowNotification	update	All Resources ``	None	None
dms:UpdateTaskFlowOwner	UpdateTaskFlowOwner	update	All Resources ``	None	None
dms:UpdateTaskFlowRelations	UpdateTaskFlowRelations	update	All Resources ``	None	None
dms:UpdateTaskFlowSchedule	UpdateTaskFlowSchedule	update	All Resources ``	None	None
dms:UpdateTaskFlowTimeVariables	UpdateTaskFlowTimeVariables	update	All Resources ``	None	None
dms:UpdateTaskName	UpdateTaskName	update	All Resources ``	None	None
dms:UpdateTaskOutput	UpdateTaskOutput	update	All Resources ``	None	None
dms:UpdateTaskTimeVariables	UpdateTaskTimeVariables	update	All Resources ``	None	None
dms:UpdateUser	UpdateUser	update	All Resources ``	None	None

Resource

In DMSEnterprise, you cannot specify an ARN in the Resource element in a policy statement. If you want to authorize a RAM user or a RAM role to access DMSEnterprise, you cannot specify an ARN in the

"Resource":
                  "*"

Condition

DMSEnterprise does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Generic Condition Keyword.

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: