Domain Names:Authorize a RAM user to manage domain names

Grant the read and write permissions to a RAM user by attaching a system policy

You can attach the AliyunDomainFullAccess system policy to a RAM user in the RAM console to authorize the RAM user to manage domain names. This system policy grants the highest-level permissions. The authorized RAM user can manage all domain names within the Alibaba Cloud account.

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane of the RAM console, choose Identities > Users.

3. On the Users page, find the RAM user to which you want to grant permissions in the User Logon Name/Display Name column. Click Add Permissions in the Actions column.

4. In the Grant Permission panel, configure the parameters.

   Set the Resource Scope parameter to Account. Note The system automatically enters the authorized principal in the Principal field. Select System Policy. Enter domain in the search box. The system policies related to domain names are displayed in the list. Click AliyunDomainFullAccess to add the policy to the Selected Policy section. Click Grant permissions.

Grant the read-only permissions to a RAM user by creating a custom policy

You can create a custom policy in the RAM console to grant the read-only permissions to a RAM user. The authorized RAM user can view domain names within the Alibaba Cloud account but cannot manage these domain names.

1. In the left-side navigation pane, choose Permissions > Policies.

2. On the Policies page, click Create Policy.

3. On the Create Policy page, click the JSON tab.

4. Enter the following script in the code editor. Click OK.

   {
      "Version": "1",
      "Statement": [
        {
          "Action": [
            "domain:Query*"
          ],
          "Resource": "acs:domain:*:*:*",
          "Effect": "Allow"
        }
       ]
   }

   

5. In the dialog box that appears, set Policy Name and Description (optional).

   

   For more information, see the Create a custom policy on the JSON tab section of the "Create custom policies" topic.

6. Click OK.

   You can use one of the following methods to view the created custom policy:

   • Method 1: On the Policies page, select Custom Policy from the Policy Type drop-down list and find the created custom policy.

   • Method 2: In the Grant Permission panel, select Custom Policy from the drop-down list in the Policy section and find the created custom policy.

     

Authorize a RAM user to manage a single domain name by creating a custom policy

1. In the left-side navigation pane, choose Permissions > Policies.

2. On the Policies page, click Create Policy.

3. On the Create Policy page, click the JSON tab.

4. Enter the following script in the code editor and replace example.com with the domain name that you want to authorize the RAM user to manage. Then, click OK.

   {
     "Version": "1",
     "Statement": [
       {
         "Action": [
         "domain:DnsModification",
         "domain:SecuritySetting",
         "domain:RealNameVerificationOperation",
         "domain:DnsHostModification",
         "domain:CreateOrderActivate",
         "domain:CreateOrderRenew",
         "domain:CreateOrderRedeem",
         "domain:CreateOrderTransfer",
         "domain:DomainTransferInOperation",
         "domain:DomainTransferOutOperation",
         "domain:QualificationAuditOperation",
         "domain:EnsSetting",
         "domain:DnsSecSetting",
         "domain:SaveArtExtension",
         "domain:CreateOrderPendingDelete"
         ],
         "Resource": "acs:domain:*:*:domain/example.com",
         "Effect": "Allow"
       },
       {
         "Action": [
         "domain:Query*"
         ],
         "Resource": "acs:domain:*:*:*",
         "Effect": "Allow"
       }
     ]
   }

   

5. In the dialog box that appears, set Policy Name and Description (optional).

   

   For more information, see the Create a custom policy on the JSON tab section of the "Create custom policies" topic.

6. Click OK.

   You can use one of the following methods to view the created custom policy:

   • Method 1: On the Policies page, select Custom Policy from the Policy Type drop-down list and find the created custom policy.

   • Method 2: In the Grant Permission panel, select Custom Policy from the drop-down list in the Policy section and find the created custom policy.