Supported actions resources and conditions for RAM - Elastic Compute Service - Alibaba Cloud - Elastic Compute Service

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Elastic Compute Service for RAM permission policies. The RAM code (RamCode) for Elastic Compute Service is ecs,vpc , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Elastic Compute Service. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
ecs:ModifyDedicatedHostClusterAttribute	ModifyDedicatedHostClusterAttribute	update	*ddhcluster `acs:ecs:{#regionId}:{#accountId}:ddhcluster/{#ddhclusterId}`	None	None
ecs:DescribeNetworkInterfacePermissions	DescribeNetworkInterfacePermissions	get	NetworkInterface `acs:ecs:{#regionId}:{#accountId}:eni/{#eniId}`	None	None
ecs:ResizeDisk	ResizeDisk	update	Disk `acs:ecs:{#regionId}:{#accountId}:disk/{#diskId}` DedicatedHostCluster `acs:ecs:{#regionId}:{#accountId}:ddhcluster/`	None	None
ecs:ReleaseDedicatedHost	ReleaseDedicatedHost	delete	*DedicatedHost `acs:ecs:{#regionId}:{#accountId}:ddh/{#ddhId}`	None	None
ecs:ModifyInstanceAttachmentAttributes	ModifyInstanceAttachmentAttributes	update	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
ecs:RebootInstance	RebootInstance	update	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
ecs:AllocateDedicatedHosts	AllocateDedicatedHosts	create	DedicatedHost `acs:ecs:{#regionId}:{#accountId}:ddh/` DedicatedHost `acs:ecs:{#regionId}:{#accountId}:ddh/{#ddhId}`	None	None
ecs:AuthorizeSecurityGroup	AuthorizeSecurityGroup	create	All Resource ``	None	None
ecs:ModifyStorageCapacityUnitAttribute	ModifyStorageCapacityUnitAttribute	update	*StorageCapacityUnit `acs:ecs:{#regionId}:{#accountId}:scu/{#scuId}`	None	None
ecs:CreateHpcCluster	CreateHpcCluster	create	HpcCluster `acs:ecs:{#regionId}:{#accountId}:hpc/` DedicatedHostCluster `acs:ecs:{#regionId}:{#accountId}:ddhcluster/{#ddhclusterId}`	None	None
ecs:ListPluginStatus	ListPluginStatus	get	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
ecs:ModifyHpcClusterAttribute	ModifyHpcClusterAttribute	update	All Resource ``	None	None
ecs:CreateImageComponent	CreateImageComponent	create	ImageComponent `acs:ecs:{#regionId}:{#accountId}:imagecomponent/`	None	None
ecs:AddTags	AddTags	create	All Resource ``	None	None
ecs:AllocatePublicIpAddress	AllocatePublicIpAddress	create	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
ecs:DescribeUserBusinessBehavior	DescribeUserBusinessBehavior	get	All Resource ``	None	None
ecs:DescribePrefixLists	DescribePrefixLists	get	*PrefixList `acs:ecs:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}`	None	None
ecs:DeleteHpcCluster	DeleteHpcCluster	delete	All Resource ``	None	None
ecs:GetInstanceScreenshot	GetInstanceScreenshot	get	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None
ecs:ReleasePublicIpAddress	ReleasePublicIpAddress	delete	*Instance `acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId}`	None	None

Resource

The following table lists the resources defined by Elastic Compute Service. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
ddhcluster	acs:ecs:{#regionId}:{#accountId}:ddhcluster/{#ddhclusterId} acs:ecs:{#regionId}:{#accountId}:ddhcluster/*
NetworkInterface	acs:ecs:{#regionId}:{#accountId}:eni/{#eniId} acs:ecs:{#regionId}:{#accountId}:eni/*
Disk	acs:ecs:{#regionId}:{#accountId}:disk/{#diskId} acs:ecs:{#regionId}:{#accountId}:disk/* acs:ecs:{#regionId}:{#accountId}:disk/{#SourceDiskId}
DedicatedHost	acs:ecs:{#regionId}:{#accountId}:ddh/{#ddhId} acs:ecs:{#regionId}:{#accountId}:ddh/*
Instance	acs:ecs:{#regionId}:{#accountId}:instance/{#instanceId} acs:ecs:{#regionId}:{#accountId}:instance/* acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId}
SecurityGroup	acs:ecs:{#regionId}:{#accountId}:securitygroup/{#securitygroupId} acs:ecs:{#regionId}:{#accountId}:securitygroup/*
PortRangeList	acs:ecs:{#regionId}:{#accountId}:portrangelist/* acs:ecs:{#regionId}:{#accountId}:portrangelist/{#portRangeListId}
StorageCapacityUnit	acs:ecs:{#regionId}:{#accountId}:scu/{#scuId} acs:ecs:{#regionId}:{#accountId}:scu/*
HpcCluster	acs:ecs:{#regionId}:{#accountId}:hpc/* acs:ecs:{#regionId}:{#accountId}:hpc/{#hpcClusterId}
ImageComponent	acs:ecs:{#regionId}:{#accountId}:imagecomponent/* acs:ecs:{#regionId}:{#accountId}:imagecomponent/{#imagecomponentId}
Image	acs:ecs:{#regionId}:{#accountId}:image/{#imageId} acs:ecs:{#regionId}:{#accountId}:image/*
KeyPair	acs:ecs:{#regionId}:{#accountId}:keypair/{#keypairId} acs:ecs:{#regionId}:{#accountId}:keypair/{#keypairName} acs:ecs:{#regionId}:{#accountId}:keypair/*
ReservedInstance	acs:ecs:{#regionId}:{#accountId}:reservedinstance/{#reservedinstanceId} acs:ecs:{#regionId}:{#accountId}:reservedinstance/*
Snapshot	acs:ecs:{#regionId}:{#accountId}:snapshot/{#snapshotId} acs:ecs:{#regionId}:{#accountId}:snapshotpolicy/{#autoSnapshotPolicyId} acs:ecs:{#regionId}:{#accountId}:snapshot/* acs:ecs::{#accountId}:snapshot/*
snapshotpolicy	acs:ecs:{#regionId}:{#accountId}:snapshotpolicy/{#snapshotpolicyId}
PrefixList	acs:ecs:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
DedicatedHostCluster	acs:ecs:{#regionId}:{#accountId}:ddhcluster/{#ddhclusterId} acs:ecs:{#regionId}:{#accountId}:ddhcluster/*
SnapshotGroup	acs:ecs:{#regionId}:{#accountId}:snapshotgroup/* acs:ecs:{#regionId}:{#accountId}:snapshotgroup/{#snapshotgroupId}
Vsc	acs:ecs:{#regionId}:{#accountId}:vsc/* acs:ecs:{#regionId}:{#accountId}:vsc/{#VscId}
LaunchTemplate	acs:ecs:{#regionId}:{#accountId}:launchtemplate/{#launchtemplateId} acs:ecs:{#regionId}:{#accountId}:launchtemplate/*
AutoSnapshotPolicy	acs:ecs:{#regionId}:{#accountId}:snapshotpolicy/{#SnapshotPolicyId} acs:ecs:{#regionId}:{#accountId}:snapshotpolicy/*
CapacityReservation	acs:ecs:{#regionId}:{#accountId}:capacityreservation/{#CapacityReservationId} acs:ecs:{#regionId}:{#accountId}:capacityreservation/*
VPC	acs:vpc:{#regionId}:{#accountId}:vpc/{#vpcId} acs:vpc:{#regionId}:{#accountId}:vpc/*
ElasticityAssurance	acs:ecs:{#regionId}:{#accountId}:elasticityassurance/* acs:ecs:{#regionId}:{#accountId}:elasticityassurance/{#ElasticityAssuranceId}
ImagePipeline	acs:ecs:{#regionId}:{#accountId}:imagepipeline/{#imagepipelineId} acs:ecs:{#regionId}:{#accountId}:imagepipeline/*
VSwitch	acs:vpc:{#regionId}:{#accountId}:vswitch/{#vswitchId} acs:vpc:{#regionId}:{#accountId}:vswitch/*
AutoProvisioningGroup	acs:ecs:{#regionId}:{#accountId}:autoprovisioninggroup/* acs:ecs:{#regionId}:{#accountId}:autoprovisioninggroup/{#autoprovisioninggroupId}
Activation	acs:ecs:{#regionId}:{#accountId}:activation/* acs:ecs:{#regionId}:{#accountId}:activation/{#ActivationId}
Role	acs:ram:{#regionId}:{#accountId}:role/{#roleName}
Command	acs:ecs:{#regionId}:{#accountId}:command/{#commandId} acs:ecs:{#regionId}:{#accountId}:command/*
autoprovisioninggroup	acs:ecs:{#regionId}:{#accountId}:autoprovisioninggroup/{#autoprovisioninggroupId}
ServiceSettings	acs:ecs:{#regionId}:{#accountId}:servicesettings/{#servicesettingId}
ImagePipelineExecution	acs:ecs:{#regionId}:{#accountId}:imagepipelineexecution/* acs:ecs:{#regionId}:{#accountId}:imagepipelineexecution/{#ImagePipelineExecutionId}
Fleet	acs:ecs:{#regionId}:{#accountId}:fleet/*
DiskEncryptionDefaultConfig	acs:ecs:{#regionId}:{#accountId}:diskencryptiondefaultconfig/*
DeploymentSet	acs:ecs:{#regionId}:{#accountId}:deploymentset/* acs:ecs:{#regionid}:{#accountId}:deploymentset/{#deploymentSetId}
Invocation	acs:ecs:{#regionId}:{#accountId}:invocation/{#invocationId}
activation	acs:ecs:{#regionId}:{#accountId}:activation/{#activationId}
BandwidthPackage	acs:vpc:{#regionId}:{#accountId}:bandwidthpackage/{#BandwidthPackageId}
NatGateway	acs:vpc:{#regionId}:{#accountId}:natgateway/{#natgatewayid} acs:vpc:{#regionId}:{#accountId}:natgateway/*
RouterInterface	acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId} acs:vpc:{#regionId}:{#accountId}:routerinterface/*
VirtualBorderRouter	acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VirtualBorderRouterId} acs:vpc:{#regionId}:{#AccountId}:virtualborderrouter/* acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}
PhysicalConnection	acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId} acs:vpc:{#regionId}:{#accountId}:physicalconnection/*
Address	acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId} acs:vpc:{#regionId}:{#accountId}:eip/*
HaVip	acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId} acs:vpc:{#regionId}:{#accountId}:havip/*
RouteTable	acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
ForwardTable	acs:vpc:{#regionId}:{#accountId}:forwardtable/{#ForwardTableId}
VRouter	acs:vpc:{#regionId}:{#accountId}:vrouter/{#VRouterId}
Association	acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}

Condition

The following table lists the product-level condition keys defined by Elastic Compute Service. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
ecs:ImagePlatform	The operating system type of the image.	String
ecs:SecurityEnhancementStrategy	Specifies whether security hardening is enabled.	String
vpc:CreateDefaultVpc	Specifies whether a default VPC can be created.	Boolean
ecs:AssociatePublicIpAddress	Specifies whether public IP addresses can be assigned to resources during resource creation or configuration changes. This parameter indicates whether resources can be configured with public bandwidth greater than 0 Mbit/s.	Boolean
ecs:PasswordInherit	Specifies whether to use the password preset in the image.	Boolean
vpc:IsDefaultVSwitch	Specifies whether the vSwitch is the default vSwitch and whether the default vSwitch can be used.	Boolean
ecs:IsSystemDiskEncrypted	Specifies whether the system disk is encrypted.	String
ecs:IsSystemDiskByokEncrypted	Specifies whether to encrypt the system disk by using a master key.	String
ecs:ImageSource	The source of the image.	String
ecs:PasswordCustomized	Specifies whether a custom password is used.	Boolean
ecs:CommandRunAs	The operating system user that runs Cloud Assistant commands.	String
ecs:SecurityHardeningMode	Specifies whether hardened mode (IMDSv2) is required when instance metadata is accessed.	Boolean
ecs:SecurityGroupSourceCidrIps	The source IPv4 CIDR block for which the security group grants access permissions.	Array
vpc:VPC	Description: The ARN of the VPC resource. Example: acs:vpc:cn-shanghai:1234567890:vpc/vpc-abc0123efg4567***	String
ecs:IsDiskEncrypted	Specifies whether the data disk is encrypted.	String
ecs:InstanceTypeFamily	The instance family.	String
ecs:InstanceChargeType	The billing method of the instance.	String
ecs:ImageOwnerId	The UID of the image owner.	String
ecs:SecurityGroupIpProtocols	The transport layer protocol enabled by the security group.	Array
vpc:IsDefaultVpc	Specifies whether the VPC is the default VPC.	Boolean
ecs:LoginAsNonRoot	Specifies whether the instance is logged on to by a non-root user.	Boolean
ecs:IsDiskByokEncrypted	Specifies whether to encrypt the data disk by using a master key.	String
ecs:InstanceType	Instance type	String
ecs:NotSpecifySecurityGroupId	Specifies whether no security group ID is specified.	Boolean

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: