RAM authorization - E-MapReduce - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. Using RAM helps you avoid sharing your Alibaba Cloud account keys with other users and allows you to grant users the least privilege access. RAM uses permission policies to define authorizations. This topic describes the general structure of a RAM policy, and the policy statement elements (Action, Resource, and Condition) defined by E-MapReduce for RAM permission policies. The RAM code (RamCode) for E-MapReduce is emr , and the supported authorization granularity is RESOURCE .

General structure of a policy

Permission policies support JSON format with the following general structure:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Version: Specifies the policy version number. It is fixed at 1.
Statement:
- Effect: Specifies the authorization result. Valid values: Allow and Deny.
- Action: Specifies one or more operations that are allowed or denied.
- Resource: Specifies the specific objects affected by the operations. You can use Alibaba Cloud Resource Names (ARNs) to describe specific resources.
- Condition: Specifies the conditions for the authorization to take effect. This field is optional.
  - Condition operator: Specifies the conditional operators. Different types of conditions support different conditional operators.
  - Condition_key: Specifies the condition keys.
  - Condition_value: Specifies the condition values.

Action

The following table lists the actions defined by E-MapReduce. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that support authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding ARN in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys that are applicable across all RAM-integrated services. For more information, see Common condition keys.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action	API	Access level	Resource type	Condition key	Dependent action
emr:GetApiTemplate	GetApiTemplate	get	All Resource ``	None	None
emr:ListScripts	ListScripts	list	All Resource ``	None	None
emr:ListNodeGroups	ListNodeGroups	list	All Resource ``	None	None
emr:ListDoctorHBaseRegionServers	ListDoctorHBaseRegionServers	list	All Resource ``	None	None
emr:ListDoctorHDFSDirectories	ListDoctorHDFSDirectories	list	All Resource ``	None	None
emr:GetNodeGroup	GetNodeGroup	get	All Resource ``	None	None
emr:GetDoctorHDFSCluster	GetDoctorHDFSCluster	get	All Resource ``	None	None
emr:UpdateScript	UpdateScript	update	All Resource ``	None	None
emr:GetDoctorHBaseRegionServer	GetDoctorHBaseRegionServer	get	All Resource ``	None	None
emr:JoinResourceGroup	JoinResourceGroup	update	All Resource ``	None	None
emr:RunApiTemplate	RunApiTemplate	update	All Resource ``	None	None
emr:GetDoctorHBaseRegion	GetDoctorHBaseRegion	get	All Resource ``	None	None
emr:GetAutoScalingActivity	GetAutoScalingActivity	get	All Resource ``	None	None
emr:GetApplication	GetApplication	get	All Resource ``	None	None
emr:CreateNodeGroup	CreateNodeGroup	create	All Resource ``	None	None
emr:GetDoctorHBaseTable	GetDoctorHBaseTable	get	All Resource ``	None	None
emr:IncreaseNodes	IncreaseNodes	update	All Resource ``	None	None
emr:ListAutoScalingActivities	ListAutoScalingActivities	list	All Resource ``	None	None
emr:UpdateClusterAutoRenew	UpdateClusterAutoRenew	update	All Resource ``	None	None
emr:ListComponentInstances	ListComponentInstances	list	All Resource ``	None	None
emr:ListUsers	ListUsers	list	All Resource ``	None	None
emr:DeleteCluster	DeleteCluster	delete	All Resource ``	None	None
emr:GetOperation	GetOperation	get	All Resource ``	None	None
emr:ListDoctorJobs	ListDoctorJobs	list	All Resource ``	None	None
emr:UpdateApiTemplate	UpdateApiTemplate	update	All Resource ``	None	None
emr:GetDoctorApplication	GetDoctorApplication	get	All Resource ``	None	None
emr:PutManagedScalingPolicy	PutManagedScalingPolicy	get	All Resource ``	None	None
emr:GetDoctorReportComponentSummary	GetDoctorReportComponentSummary	get	All Resource ``	None	None
emr:ListDoctorHiveDatabases	ListDoctorHiveDatabases	list	All Resource ``	None	None
emr:ListDoctorReports	ListDoctorReports	list	All Resource ``	None	None
emr:GetClusterCloneMeta	GetClusterCloneMeta	get	All Resource ``	None	None
emr:RemoveAutoScalingPolicy	RemoveAutoScalingPolicy	delete	All Resource ``	None	None
emr:CreateScript	CreateScript	create	All Resource ``	None	None
emr:GetAutoScalingPolicy	GetAutoScalingPolicy	get	All Resource ``	None	None
emr:CreateCluster	CreateCluster	create	All Resource ``	None	None
emr:RunApplicationAction	RunApplicationAction	update	All Resource ``	None	None
emr:DeleteApiTemplate	DeleteApiTemplate	delete	All Resource ``	None	None
emr:UpdateClusterAttribute	UpdateClusterAttribute	update	All Resource ``	None	None
emr:UpdateApplicationConfigs	UpdateApplicationConfigs	update	All Resource ``	None	None
emr:ListApplicationConfigs	ListApplicationConfigs	list	All Resource ``	None	None
emr:GetDoctorHiveDatabase	GetDoctorHiveDatabase	get	All Resource ``	None	None
emr:GetDoctorHiveTable	GetDoctorHiveTable	get	All Resource ``	None	None
emr:CreateUsers	CreateUsers	create	All Resource ``	None	None
emr:ListApiTemplates	ListApiTemplates	list	All Resource ``	None	None
emr:PutAutoScalingPolicy	PutAutoScalingPolicy	create	All Resource ``	None	None
emr:TagResources	TagResources	update	All Resource ``	None	None
emr:GetManagedScalingPolicy	GetManagedScalingPolicy	get	All Resource ``	None	None
emr:DeleteUsers	DeleteUsers	delete	*Cluster `acs:emr:{#regionId}:{#accountId}:cluster/{#Clusterld}`	None	None
emr:ListDoctorComputeSummary	ListDoctorComputeSummary	list	All Resource ``	None	None
emr:DeleteScript	DeleteScript	delete	All Resource ``	None	None
emr:GetDoctorHiveCluster	GetDoctorHiveCluster	get	All Resource ``	None	None
emr:GetCluster	GetCluster	get	All Resource ``	None	None
emr:ListDoctorHBaseTables	ListDoctorHBaseTables	list	All Resource ``	None	None
emr:GetDoctorHBaseCluster	GetDoctorHBaseCluster	get	All Resource ``	None	None
emr:GetDoctorJob	GetDoctorJob	get	All Resource ``	None	None
emr:GetDoctorComputeSummary	GetDoctorComputeSummary	get	All Resource ``	None	None
emr:ListClusters	ListClusters	list	All Resource ``	None	None
emr:ExportApplicationConfigs	ExportApplicationConfigs	list	All Resource ``	None	None
emr:CreateApiTemplate	CreateApiTemplate	create	All Resource ``	None	None
emr:ListTagResources	ListTagResources	list	All Resource ``	None	None
emr:ListDoctorApplications	ListDoctorApplications	list	All Resource ``	None	None
emr:UpdateUserAttribute	UpdateUserAttribute	update	All Resource ``	None	None
emr:RunCluster	RunCluster	create	All Resource ``	None	None
emr:GetDoctorHDFSDirectory	GetDoctorHDFSDirectory	get	All Resource ``	None	None
emr:ListComponents	ListComponents	list	All Resource ``	None	None
emr:ListDoctorJobsStats	ListDoctorJobsStats	list	All Resource ``	None	None
emr:ListNodes	ListNodes	list	All Resource ``	None	None
emr:ListDoctorHiveTables	ListDoctorHiveTables	list	All Resource ``	None	None
emr:DecreaseNodes	DecreaseNodes	update	All Resource ``	None	None
emr:UntagResources	UntagResources	update	All Resource ``	None	None
emr:ListDoctorHDFSUGI	ListDoctorHDFSUGI	list	All Resource ``	None	None
emr:ListApplications	ListApplications	list	All Resource ``	None	None

Resource

The following table lists the resources defined by E-MapReduce. Specify them in the Resource element of RAM policy statements to grant permissions for specific operations. They are uniquely identified by ARNs. Format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: The initialism of Alibaba Cloud service, which indicates the public cloud of Alibaba Cloud.
{#ramcode}: The code used in RAM to indicate an Alibaba Cloud service.
{#regionId}: The region ID. If the resource covers all regions, set it to an asterisk (*).
{#accountId}: The ID of the Alibaba Cloud account. If the resource covers all Alibaba Cloud accounts, set it to an asterisk (*).
{#resourceType}: The service-defined resource identifier. It supports a hierarchical structure, which is similar to a file path. If the statement covers global resources, set it to an asterisk (*).

Resource type	ARN
Cluster	acs:emr:{#regionId}:{#accountId}:Cluster/* acs:emr:{#regionId}:{#accountId}:cluster/{#Clusterld}

Condition

E-MapReduce does not define product-level condition keys. However, you can use Alibaba Cloud common condition keys for access control. For more information, see Common condition keys.

How to create custom RAM policies?

You can create custom policies and grant them to RAM users, RAM user groups, or RAM roles. For instructions, see: