Alibaba Cloud DNS:Reference for Alibaba Cloud DNS custom policies

What are custom policies?

In Resource Access Management (RAM), custom policies are policies that you can create, update, and delete in addition to system policies. You must maintain the versions of your custom policies.

• After you create a custom policy, you can attach it to a RAM user, user group, or RAM role. The RAM identity then gains the permissions specified in the policy.

• You can delete custom policies. Before you delete a policy, make sure it is not referenced. If the policy is referenced, revoke the permissions in its reference records first.

• Custom policies support versioning. You can manage policy versions by using the RAM versioning feature.

Common scenarios and examples for custom policies

Example 1: Manage permissions for authoritative DNS resolution of a domain name

Grant a RAM user permissions to view and edit domain names and manage DNS records for authoritative DNS resolution services.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "alidns:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "alidns.aliyuncs.com",
                        "gtm.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Example 2: Grant read-only permissions for authoritative DNS resolution of a domain name

Grant a RAM user read-only permissions to view domain names and DNS records on the Alibaba Cloud DNS console. The user cannot modify them.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "alidns:Describe*",
                "alidns:Get*",
                "alidns:List*",
                "alidns:Query*",
                "alidns:Check*",
                "alidns:Search*",
                "alidns:ValidateDomainCanAdd"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Example 3: Grant a RAM user permissions to manage the DNS records of a domain name

1. In the Action field, specify the operations that the RAM user can perform, such as adding, modifying, and deleting DNS records.

2. In the Resource field, specify the domain name that can be managed. This restricts the allowed operations to the specified resource.

3. Attach the policy to the specified RAM user.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "alidns:AddDomainRecord",
        "alidns:DeleteDomainRecord",
        "alidns:DeleteSubDomainRecords",
        "alidns:UpdateDomainRecord",
        "alidns:UpdateDomainRecordsTTL",
        "alidns:CreateAlidnsLineRecordSet"
      ],
      "Resource": [
        "acs:alidns:*:1413397765616316:domain/your-domainname"
      ]
    }
  ]
}

Note: Permissions can be granted only at the domain name granularity. If you want a RAM user to manage DNS records for a specific subdomain, such as demo.example.com, instead of for the entire example.com domain, you must add demo.example.com as an independent subdomain. For more information, see Subdomain management. Then, you can grant permissions using the method described above.

Note for console operations

The preceding policy grants permissions only for write operations on DNS records. As a result, a RAM user may receive a Permission Denied message after logging in to the console. If the RAM user needs to view and perform operations in the console, you must also grant the user a global read-only policy. This is because query-related API operations, such as DescribeDomains, do not support resource-level authorization. In this policy, Resource must be set to *. Then, the RAM user can view all domains and records in the console, but manage only authorized ones.

FAQ

RAM users are still denied access in the DNS console after being granted permissions

If a RAM user has been granted DNS permissions but the console still reports that the user is not authorized, troubleshoot as follows:

1. The domain mame list does not support filtering by resource group directly. For RAM users with fine-grained authorization at the resource group level, select the resource group on the top navigation bar of the console.

2. Check whether the RAM user has permissions for alidns:Describe* actions. Viewing the domain name list requires the alidns:DescribeDomains permission. If the permission is not granted, log on to the RAM console as a root account and grant the permission to the RAM user.

Authorization reference

Before you create custom policies, understand your permission control requirements and the authorization information for Alibaba Cloud DNS. For more information, see Authorization information.