Alibaba Cloud DNS:Reference for Alibaba Cloud DNS custom policies

What are custom policies?

In Resource Access Management (RAM), custom policies are policies that you can create, update, and delete in addition to system policies. You must maintain the versions of your custom policies.

• After you create a custom policy, you can attach it to a RAM user, user group, or RAM role. The RAM identity then gains the permissions specified in the policy.

• You can delete custom policies. Before you delete a policy, make sure it is not referenced. If the policy is referenced, revoke the permissions in its reference records first.

• Custom policies support versioning. You can manage policy versions by using the RAM versioning feature.

Common scenarios and examples for custom policies

Example 1: Manage permissions for authoritative DNS resolution of a domain name

Grant a RAM user permissions to view and edit domain names and manage DNS records on the Authoritative Zone page of the Alibaba Cloud DNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "alidns:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "alidns.aliyuncs.com",
                        "gtm.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Example 2: Grant read-only permissions for authoritative DNS resolution of a domain name

Grant a RAM user read-only permissions to view domain names and DNS records on the Authoritative Zone page of the Alibaba Cloud DNS console. The user cannot modify them.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "alidns:Describe*",
                "alidns:Get*",
                "alidns:List*",
                "alidns:Query*",
                "alidns:Check*",
                "alidns:Search*",
                "alidns:ValidateDomainCanAdd"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Example 3: Grant a RAM user permissions to manage the DNS records of a domain name

1. In the Action field, specify the operations that the RAM user can perform, such as adding, modifying, and deleting DNS records.

2. In the Resource field, specify the domain name that can be managed. This restricts the allowed operations to the specified resource.

3. Attach the policy to the specified RAM user.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "alidns:AddDomainRecord",
        "alidns:DeleteDomainRecord",
        "alidns:DeleteSubDomainRecords",
        "alidns:UpdateDomainRecord",
        "alidns:UpdateDomainRecordsTTL",
        "alidns:CreateAlidnsLineRecordSet"
      ],
      "Resource": [
        "acs:alidns:*:1413397765616316:domain/your-domainname"
      ]
    }
  ]
}

Note: Permissions can be granted only at the domain name granularity. If you want a RAM user to manage DNS records for a specific subdomain, such as demo.example.com, instead of for the entire example.com domain, you must add demo.example.com as an independent subdomain. For more information, see Subdomain management. Then, you can grant permissions using the method described above.

Authorization reference

Before you create custom policies, understand your permission control requirements and the authorization information for Alibaba Cloud DNS. For more information, see Authorization information.