RAM authorization - Edge Security Acceleration - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by Edge Security Acceleration for RAM permission policies. The RAM code (RamCode) for Edge Security Acceleration is dcdn , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by Edge Security Acceleration. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
dcdn:DeleteDcdnDomain	DeleteDcdnDomain	delete	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafGeoInfo	DescribeDcdnWafGeoInfo	get	All Resource ``	None	None
dcdn:DescribeDcdnL2Ips	DescribeDcdnL2Ips	get	All Resource ``	None	None
dcdn:BatchSetDcdnDomainConfigs	BatchSetDcdnDomainConfigs	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DeleteDcdnIpaSpecificConfig	DeleteDcdnIpaSpecificConfig	delete	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:StartDcdnDomain	StartDcdnDomain	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeRoutineRelatedDomains	DescribeRoutineRelatedDomains	get	All Resource ``	None	None
dcdn:BatchStopDcdnDomain	BatchStopDcdnDomain	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnIpaUserDomains	DescribeDcdnIpaUserDomains	get	IpaDomain `acs:dcdn::{#accountId}:domain/*`	None	None
dcdn:DescribeDcdnRefreshQuota	DescribeDcdnRefreshQuota	get	All Resource ``	None	None
dcdn:DescribeDcdnWafPolicy	DescribeDcdnWafPolicy	get	All Resource ``	None	None
dcdn:StopDcdnIpaDomain	StopDcdnIpaDomain	update	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:CreateDcdnSLSRealTimeLogDelivery	CreateDcdnSLSRealTimeLogDelivery	create	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:BatchDeleteDcdnKvWithHighCapacity	BatchDeleteDcdnKvWithHighCapacity	none	All Resource ``	None	None
dcdn:DescribeDcdnIpInfo	DescribeDcdnIpInfo	get	All Resource ``	None	None
dcdn:DescribeDcdnUserResourcePackage	DescribeDcdnUserResourcePackage	get	All Resource ``	None	None
dcdn:BatchDeleteDcdnWafRules	BatchDeleteDcdnWafRules	delete	All Resource ``	None	None
dcdn:DescribeDcdnDdosService	DescribeDcdnDdosService	none	All Resource ``	None	None
dcdn:DescribeDcdnKvNamespace	DescribeDcdnKvNamespace	get	All Resource ``	None	None
dcdn:DeleteDcdnWafGroup	DeleteDcdnWafGroup	delete	All Resource ``	None	None
dcdn:DescribeDcdnDomainMultiUsageData	DescribeDcdnDomainMultiUsageData	none	All Resource ``	None	None
dcdn:DescribeDcdnWafScenes	DescribeDcdnWafScenes	get	All Resource ``	None	None
dcdn:DescribeDcdnRealTimeDeliveryField	DescribeDcdnRealTimeDeliveryField	get	All Resource ``	None	None
dcdn:DescribeDcdnIpaDomainCidr	DescribeDcdnIpaDomainCidr	none	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:PreloadDcdnObjectCaches	PreloadDcdnObjectCaches	none	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:PutDcdnKv	PutDcdnKv	update	All Resource ``	None	None
dcdn:DescribeDcdnDomainStagingConfig	DescribeDcdnDomainStagingConfig	get	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDeletedDomains	DescribeDcdnDeletedDomains	get	All Resource ``	None	None
dcdn:DeleteDcdnUserConfig	DeleteDcdnUserConfig	delete	All Resource ``	None	None
dcdn:DescribeRDDomainConfig	DescribeRDDomainConfig	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainHttpCodeDataByLayer	DescribeDcdnDomainHttpCodeDataByLayer	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafDomains	DescribeDcdnWafDomains	get	All Resource ``	None	None
dcdn:DescribeDcdnStagingIp	DescribeDcdnStagingIp	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeReqHitRateData	DescribeDcdnDomainRealTimeReqHitRateData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeKvUsageData	DescribeKvUsageData	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainBpsDataByLayer	DescribeDcdnDomainBpsDataByLayer	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainCcActivityLog	DescribeDcdnDomainCcActivityLog	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainTopUrlVisit	DescribeDcdnDomainTopUrlVisit	get	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchModifyDcdnWafRules	BatchModifyDcdnWafRules	update	All Resource ``	None	None
dcdn:DescribeDcdnBlockedRegions	DescribeDcdnBlockedRegions	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeHttpCodeData	DescribeDcdnDomainRealTimeHttpCodeData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDdosAllEventList	DescribeDdosAllEventList	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:CreateSlrAndSlsProject	CreateSlrAndSlsProject	create	All Resource ``	None	None
dcdn:DescribeDcdnWafGroup	DescribeDcdnWafGroup	get	All Resource ``	None	None
dcdn:DescribeDcdnBgpTrafficData	DescribeDcdnBgpTrafficData	get	All Resource ``	None	None
dcdn:BatchAddDcdnDomain	BatchAddDcdnDomain	create	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:ModifyDcdnWafPolicyDomains	ModifyDcdnWafPolicyDomains	update	All Resource ``	None	None
dcdn:CheckDcdnProjectExist	CheckDcdnProjectExist	none	All Resource ``	None	None
dcdn:SetDcdnDomainStagingConfig	SetDcdnDomainStagingConfig	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:PublishDcdnStagingConfigToProduction	PublishDcdnStagingConfigToProduction	none	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchPutDcdnKvWithHighCapacity	BatchPutDcdnKvWithHighCapacity	none	All Resource ``	None	None
dcdn:VerifyDcdnDomainOwner	VerifyDcdnDomainOwner	get	All Resource ``	None	None
dcdn:AddDcdnDomain	AddDcdnDomain	create	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:UpdateDcdnIpaDomain	UpdateDcdnIpaDomain	update	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:StartDcdnIpaDomain	StartDcdnIpaDomain	update	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchPutDcdnKv	BatchPutDcdnKv	none	All Resource ``	None	None
dcdn:DeleteDcdnIpaDomain	DeleteDcdnIpaDomain	delete	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainUsageData	DescribeDcdnDomainUsageData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnUserBillHistory	DescribeDcdnUserBillHistory	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeSrcHttpCodeData	DescribeDcdnDomainRealTimeSrcHttpCodeData	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnUserRealTimeDeliveryField	DescribeDcdnUserRealTimeDeliveryField	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainCname	DescribeDcdnDomainCname	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainPvData	DescribeDcdnDomainPvData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:SetDcdnFullDomainsBlockIP	SetDcdnFullDomainsBlockIP	update	All Resource ``	None	None
dcdn:DescribeDcdnSecSpecInfo	DescribeDcdnSecSpecInfo	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainWebsocketTrafficData	DescribeDcdnDomainWebsocketTrafficData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnIpaDomainDetail	DescribeDcdnIpaDomainDetail	get	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchStartDcdnDomain	BatchStartDcdnDomain	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchDeleteDcdnKv	BatchDeleteDcdnKv	delete	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeSrcTrafficData	DescribeDcdnDomainRealTimeSrcTrafficData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:UpdateDcdnUserRealTimeDeliveryField	UpdateDcdnUserRealTimeDeliveryField	update	All Resource ``	None	None
dcdn:DescribeDcdnUserSecDrop	DescribeDcdnUserSecDrop	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainOriginTrafficData	DescribeDcdnDomainOriginTrafficData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnKvAccountStatus	DescribeDcdnKvAccountStatus	get	All Resource ``	None	None
dcdn:DescribeUserLogserviceStatus	DescribeUserLogserviceStatus	get	All Resource ``	None	None
dcdn:CreateRoutine	CreateRoutine	update	All Resource ``	None	None
dcdn:DescribeEncryptRoutineUid	DescribeEncryptRoutineUid	get	All Resource ``	None	None
dcdn:DescribeDcdnTagResources	DescribeDcdnTagResources	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnErUsageData	DescribeDcdnErUsageData	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainProperty	DescribeDcdnDomainProperty	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnUserDomainsByFunc	DescribeDcdnUserDomainsByFunc	get	Domain `acs:dcdn:*:{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnVerifyContent	DescribeDcdnVerifyContent	get	All Resource ``	None	None
dcdn:DescribeHighlightInfo	DescribeHighlightInfo	get	All Resource ``	None	None
dcdn:DescribeDcdnUserQuota	DescribeDcdnUserQuota	get	All Resource ``	None	None
dcdn:DeleteDcdnKvNamespace	DeleteDcdnKvNamespace	delete	All Resource ``	None	None
dcdn:ModifyDcdnWafPolicy	ModifyDcdnWafPolicy	update	All Resource ``	None	None
dcdn:RefreshDcdnObjectCaches	RefreshDcdnObjectCaches	none	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafLogs	DescribeDcdnWafLogs	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeRoutine	DescribeRoutine	get	All Resource ``	None	None
dcdn:DescribeKvRealTimeQpsData	DescribeKvRealTimeQpsData	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainHttpCodeData	DescribeDcdnDomainHttpCodeData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnUserVipsByDomain	DescribeDcdnUserVipsByDomain	none	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnDomainOriginBpsData	DescribeDcdnDomainOriginBpsData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnSecFuncInfo	DescribeDcdnSecFuncInfo	get	All Resource ``	None	None
dcdn:GetDcdnKvStatus	GetDcdnKvStatus	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainCertificateInfo	DescribeDcdnDomainCertificateInfo	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnBgpBpsData	DescribeDcdnBgpBpsData	get	All Resource ``	None	None
dcdn:DescribeRoutineSpec	DescribeRoutineSpec	get	All Resource ``	None	None
dcdn:SetDcdnDomainCSRCertificate	SetDcdnDomainCSRCertificate	update	All Resource ``	None	None
dcdn:DescribeDcdnWafRule	DescribeDcdnWafRule	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainByCertificate	DescribeDcdnDomainByCertificate	get	All Resource ``	None	None
dcdn:DescribeDcdnHttpsDomainList	DescribeDcdnHttpsDomainList	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainHitRateData	DescribeDcdnDomainHitRateData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeRoutineCodeRevision	DescribeRoutineCodeRevision	get	All Resource ``	None	None
dcdn:StopDcdnDomain	StopDcdnDomain	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainQpsData	DescribeDcdnDomainQpsData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnsecService	DescribeDcdnsecService	get	All Resource ``	None	None
dcdn:PutDcdnKvWithHighCapacity	PutDcdnKvWithHighCapacity	get	All Resource ``	None	None
dcdn:DeleteDcdnRealTimeLogProject	DeleteDcdnRealTimeLogProject	delete	All Resource ``	None	None
dcdn:DescribeDcdnWafDomain	DescribeDcdnWafDomain	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchDeleteDcdnDomainConfigs	BatchDeleteDcdnDomainConfigs	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDeliverList	DescribeDcdnDeliverList	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeQpsData	DescribeDcdnDomainRealTimeQpsData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:RollbackDcdnStagingConfig	RollbackDcdnStagingConfig	update	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnDomainIspData	DescribeDcdnDomainIspData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnCertificateDetail	DescribeDcdnCertificateDetail	get	All Resource ``	None	None
dcdn:DescribeDcdnWafService	DescribeDcdnWafService	get	All Resource ``	None	None
dcdn:DescribeDcdnFullDomainsBlockIPConfig	DescribeDcdnFullDomainsBlockIPConfig	none	All Resource ``	None	None
dcdn:DescribeDcdnAclFields	DescribeDcdnAclFields	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainUvData	DescribeDcdnDomainUvData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainRealTimeDetailData	DescribeDcdnDomainRealTimeDetailData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UploadRoutineCode	UploadRoutineCode	update	All Resource ``	None	None
dcdn:DescribeDcdnSMCertificateDetail	DescribeDcdnSMCertificateDetail	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainIpaTrafficData	DescribeDcdnDomainIpaTrafficData	get	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:GetDcdnKvDetail	GetDcdnKvDetail	get	All Resource ``	None	None
dcdn:GetDcdnKv	GetDcdnKv	get	All Resource ``	None	None
dcdn:AddDcdnIpaDomain	AddDcdnIpaDomain	create	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeUserDcdnIpaStatus	DescribeUserDcdnIpaStatus	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeByteHitRateData	DescribeDcdnDomainRealTimeByteHitRateData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainTrafficData	DescribeDcdnDomainTrafficData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:CreateDcdnSubTask	CreateDcdnSubTask	create	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnSubList	DescribeDcdnSubList	get	All Resource ``	None	None
dcdn:DescribeDcdnCertificateList	DescribeDcdnCertificateList	get	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnSSLCertificateList	DescribeDcdnSSLCertificateList	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UpdateDcdnDeliverTask	UpdateDcdnDeliverTask	update	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainWebsocketHttpCodeData	DescribeDcdnDomainWebsocketHttpCodeData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UpdateDcdnSubTask	UpdateDcdnSubTask	update	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafPolicyValidDomains	DescribeDcdnWafPolicyValidDomains	get	All Resource ``	None	None
dcdn:DeleteRoutineCodeRevision	DeleteRoutineCodeRevision	update	All Resource ``	None	None
dcdn:BatchSetDcdnIpaDomainConfigs	BatchSetDcdnIpaDomainConfigs	update	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnService	DescribeDcdnService	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainIpaConnData	DescribeDcdnDomainIpaConnData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnReportList	DescribeDcdnReportList	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainBpsData	DescribeDcdnDomainBpsData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnUserBillType	DescribeDcdnUserBillType	get	All Resource ``	None	None
dcdn:DescribeDcdnSLSRealtimeLogDelivery	DescribeDcdnSLSRealtimeLogDelivery	get	All Resource ``	None	None
dcdn:PublishRoutineCodeRevision	PublishRoutineCodeRevision	update	All Resource ``	None	None
dcdn:DescribeDcdnWafDomainDetail	DescribeDcdnWafDomainDetail	get	WafDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UpdateDcdnDomain	UpdateDcdnDomain	update	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:RefreshErObjectCaches	RefreshErObjectCaches	none	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnWafRules	DescribeDcdnWafRules	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRegionData	DescribeDcdnDomainRegionData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:CreateDcdnWafGroup	CreateDcdnWafGroup	get	All Resource ``	None	None
dcdn:DeleteDcdnSpecificConfig	DeleteDcdnSpecificConfig	delete	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnTopDomainsByFlow	DescribeDcdnTopDomainsByFlow	none	All Resource ``	None	None
dcdn:DescribeRoutineUserInfo	DescribeRoutineUserInfo	get	All Resource ``	None	None
dcdn:SetDcdnUserConfig	SetDcdnUserConfig	update	All Resource ``	None	None
dcdn:DeleteDcdnSubTask	DeleteDcdnSubTask	delete	All Resource ``	None	None
dcdn:DeleteDcdnWafPolicy	DeleteDcdnWafPolicy	delete	All Resource ``	None	None
dcdn:DescribeDcdnRegionAndIsp	DescribeDcdnRegionAndIsp	get	All Resource ``	None	None
dcdn:DescribeDcdnWafSpecInfo	DescribeDcdnWafSpecInfo	get	All Resource ``	None	None
dcdn:CreateDcdnCertificateSigningRequest	CreateDcdnCertificateSigningRequest	create	All Resource ``	None	None
dcdn:DeleteDcdnDeliverTask	DeleteDcdnDeliverTask	delete	All Resource ``	None	None
dcdn:OpenDcdnService	OpenDcdnService	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainLog	DescribeDcdnDomainLog	get	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafBotAppKey	DescribeDcdnWafBotAppKey	get	All Resource ``	None	None
dcdn:DescribeRoutineCanaryEnvs	DescribeRoutineCanaryEnvs	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainsBySource	DescribeDcdnDomainsBySource	none	All Resource ``	None	None
dcdn:SetRoutineSubdomain	SetRoutineSubdomain	update	All Resource ``	None	None
dcdn:DescribeDcdnSLSRealTimeLogType	DescribeDcdnSLSRealTimeLogType	get	All Resource ``	None	None
dcdn:ModifyDcdnWafRule	ModifyDcdnWafRule	update	All Resource ``	None	None
dcdn:ListDcdnRealTimeDeliveryProject	ListDcdnRealTimeDeliveryProject	list	Domain `acs:dcdn::{#accountId}:domain/{#domainName}` RealTimeLogDelivery `acs:dcdn::{#accountId}:domain/*`	None	None
dcdn:RefreshDcdnObjectCacheByCacheTag	RefreshDcdnObjectCacheByCacheTag	none	All Resource ``	None	None
dcdn:DescribeDcdnIpaDomainConfigs	DescribeDcdnIpaDomainConfigs	get	IpaDomain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:ModifyDCdnDomainSchdmByProperty	ModifyDCdnDomainSchdmByProperty	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeUserDcdnStatus	DescribeUserDcdnStatus	get	All Resource ``	None	None
dcdn:EditRoutineConf	EditRoutineConf	update	All Resource ``	None	None
dcdn:DescribeDcdnUserDomains	DescribeDcdnUserDomains	list	Domain `acs:dcdn::{#accountId}:domain/*`	None	None
dcdn:DescribeDcdnWafPolicyDomains	DescribeDcdnWafPolicyDomains	get	All Resource ``	None	None
dcdn:DescribeDcdnWafUsageData	DescribeDcdnWafUsageData	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnDomainRealTimeBpsData	DescribeDcdnDomainRealTimeBpsData	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnDomainTopReferVisit	DescribeDcdnDomainTopReferVisit	get	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:SetDcdnDomainSMCertificate	SetDcdnDomainSMCertificate	update	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DeleteDcdnSpecificStagingConfig	DeleteDcdnSpecificStagingConfig	delete	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:BatchCreateDcdnWafRules	BatchCreateDcdnWafRules	create	All Resource ``	None	None
dcdn:DescribeDcdnWafGroups	DescribeDcdnWafGroups	get	All Resource ``	None	None
dcdn:ModifyDcdnWafGroup	ModifyDcdnWafGroup	update	All Resource ``	None	None
dcdn:DeleteRoutineConfEnvs	DeleteRoutineConfEnvs	update	All Resource ``	None	None
dcdn:DescribeDcdnRefreshTasks	DescribeDcdnRefreshTasks	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnUserConfigs	DescribeDcdnUserConfigs	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainWebsocketBpsData	DescribeDcdnDomainWebsocketBpsData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UpdateDcdnSLSRealtimeLogDelivery	UpdateDcdnSLSRealtimeLogDelivery	update	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnRefreshTaskById	DescribeDcdnRefreshTaskById	get	All Resource ``	None	None
dcdn:DescribeDcdnUserSecDropByMinute	DescribeDcdnUserSecDropByMinute	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnUserTags	DescribeDcdnUserTags	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainDetail	DescribeDcdnDomainDetail	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnDomainConfigs	DescribeDcdnDomainConfigs	get	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnFullDomainsBlockIPHistory	DescribeDcdnFullDomainsBlockIPHistory	none	All Resource ``	None	None
dcdn:CreateDcdnDeliverTask	CreateDcdnDeliverTask	create	DeliverTask `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnOriginSiteHealthStatus	DescribeDcdnOriginSiteHealthStatus	none	All Resource ``	None	None
dcdn:DescribeDcdnDdosSpecInfo	DescribeDcdnDdosSpecInfo	get	All Resource ``	None	None
dcdn:DescribeDcdnL2Vips	DescribeDcdnL2Vips	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:UploadStagingRoutineCode	UploadStagingRoutineCode	update	All Resource ``	None	None
dcdn:SetDcdnDomainSSLCertificate	SetDcdnDomainSSLCertificate	none	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafFilterInfo	DescribeDcdnWafFilterInfo	get	All Resource ``	None	None
dcdn:UntagDcdnResources	UntagDcdnResources	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:PutDcdnKvNamespace	PutDcdnKvNamespace	update	All Resource ``	None	None
dcdn:DeleteRoutine	DeleteRoutine	update	All Resource ``	None	None
dcdn:DescribeDcdnDomainIpaBpsData	DescribeDcdnDomainIpaBpsData	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnUserCertificateExpireCount	DescribeDcdnUserCertificateExpireCount	get	All Resource ``	None	None
dcdn:ListDcdnKv	ListDcdnKv	get	All Resource ``	None	None
dcdn:CreateDcdnWafPolicy	CreateDcdnWafPolicy	create	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeSrcBpsData	DescribeDcdnDomainRealTimeSrcBpsData	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnReport	DescribeDcdnReport	get	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DescribeDcdnSMCertificateList	DescribeDcdnSMCertificateList	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeUserErStatus	DescribeUserErStatus	get	All Resource ``	None	None
dcdn:DescribeDcdnKvAccount	DescribeDcdnKvAccount	get	All Resource ``	None	None
dcdn:BatchSetDcdnWafDomainConfigs	BatchSetDcdnWafDomainConfigs	create	Domain `acs:dcdn::{#accountId}:domain/{#DomainName}`	None	None
dcdn:DeleteDcdnKv	DeleteDcdnKv	delete	All Resource ``	None	None
dcdn:DescribeDcdnWafPolicies	DescribeDcdnWafPolicies	get	All Resource ``	None	None
dcdn:DescribeDcdnDomainRealTimeTrafficData	DescribeDcdnDomainRealTimeTrafficData	none	domain `acs:dcdn:*:{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnWafDefaultRules	DescribeDcdnWafDefaultRules	get	All Resource ``	None	None
dcdn:TagDcdnResources	TagDcdnResources	update	domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:CommitStagingRoutineCode	CommitStagingRoutineCode	update	All Resource ``	None	None
dcdn:DescribeDcdnDomainQpsDataByLayer	DescribeDcdnDomainQpsDataByLayer	get	Domain `acs:dcdn::{#accountId}:domain/{#domainName}`	None	None
dcdn:DescribeDcdnIpaService	DescribeDcdnIpaService	get	All Resource ``	None	None

Resource

The following table lists the resources defined by Edge Security Acceleration. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
domain	acs:dcdn::{#accountId}:domain/{#domainName} acs:dcdn::{#accountId}:domain/*
Domain	acs:dcdn::{#accountId}:domain/{#domainName} acs:dcdn::{#accountId}:domain/{#DomainName} acs:dcdn::{#accountId}:domain/*
IpaDomain	acs:dcdn::{#accountId}:domain/ acs:dcdn:*:{#accountId}:domain/{#domainName}
WafDomain	acs:dcdn:*:{#accountId}:domain/{#domainName}
RealTimeLogDelivery	acs:dcdn::{#accountId}:domain/
DeliverTask	acs:dcdn:*:{#accountId}:domain/{#domainName}

Condition

The following table lists the product-level condition keys defined by Edge Security Acceleration. You can also use Alibaba Cloud's Common condition keys. Specify these keys in the Condition element of RAM policy statements to define granular authorization rules. In the condition key, specify the condition values in the Condition_value element of the policy.

Each condition key has a specific data type, such as string, number, Boolean, or IP address. The data type determines which conditional operators can be used to compare the request values against policy values. You must specify the conditional operators compatible with the data type of the condition key. Mismatched operators will invalidate the policy. See Condition operator for valid combinations.

Condition key	Description	Data type
dcdn:tag	dcdn标签授权	STRING

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: