Alibaba Cloud DNS:Reference for Alibaba Cloud DNS custom policies

What are custom policies?

In Resource Access Management (RAM), custom policies are policies that you can create, update, and delete in addition to system policies. You must maintain the versions of your custom policies.

• After you create a custom policy, you can attach it to a RAM user, user group, or RAM role. The RAM identity then gains the permissions specified in the policy.

• You can delete custom policies. Before you delete a policy, make sure it is not referenced. If the policy is referenced, revoke the permissions in its reference records first.

• Custom policies support versioning. You can manage policy versions by using the RAM versioning feature.

Common scenarios and examples for custom policies

Example 1: Manage permissions for authoritative DNS resolution of a domain name

Grant a RAM user permissions to view and edit domain names and manage DNS records on the Authoritative Zone page of the Alibaba Cloud DNS console.

{
    "Version": "1",
    "Statement": [
        {
            "Action": "alidns:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "alidns.aliyuncs.com",
                        "gtm.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Example 2: Grant read-only permissions for authoritative DNS resolution of a domain name

Grant a RAM user read-only permissions to view domain names and DNS records on the Authoritative Zone page of the Alibaba Cloud DNS console. The user cannot modify them.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "alidns:Describe*",
                "alidns:Get*",
                "alidns:List*",
                "alidns:Query*",
                "alidns:Check*",
                "alidns:Search*",
                "alidns:ValidateDomainCanAdd"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Example 3: Grant a RAM user permissions to manage the DNS records of a domain name

1. In the Action field, specify the operations that the RAM user can perform, such as adding, modifying, and deleting DNS records.

2. In the Resource field, specify the domain name that can be managed. This restricts the allowed operations to the specified resource.

3. Attach the policy to the specified RAM user.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "alidns:AddDomainRecord",
        "alidns:DeleteDomainRecord",
        "alidns:DeleteSubDomainRecords",
        "alidns:UpdateDomainRecord",
        "alidns:UpdateDomainRecordsTTL",
        "alidns:CreateAlidnsLineRecordSet"
      ],
      "Resource": [
        "acs:alidns:*:1413397765616316:domain/your-domainname"
      ]
    }
  ]
}

Note: Permissions can be granted only at the domain name granularity. If you want a RAM user to manage DNS records for a specific subdomain, such as demo.example.com, instead of for the entire example.com domain, you must add demo.example.com as an independent subdomain. For more information, see Subdomain management. Then, you can grant permissions using the method described above.

FAQ

RAM users are still denied access in the DNS console after being granted permissions

If a RAM user has been granted DNS permissions but the console still reports that the user is not authorized, troubleshoot as follows:

1. The domain mame list does not support filtering by resource group directly. For RAM users with fine-grained authorization at the resource group level, select the resource group on the top navigation bar of the console.

2. Check whether the RAM user has permissions for alidns:Describe* actions. Viewing the domain name list requires the alidns:DescribeDomains permission. If the permission is not granted, log on to the RAM console as a root account and grant the permission to the RAM user.

Authorization reference

Before you create custom policies, understand your permission control requirements and the authorization information for Alibaba Cloud DNS. For more information, see Authorization information.