Function Compute:Configure RAM User Permissions

Use the console or OpenAPI

Use an Alibaba Cloud account or RAM user to manage Teams, API Keys, and other resources in the console. Use Alibaba Cloud AK or STS temporary credentials to call FCSandbox OpenAPI. Both methods use RAM policies to control the allowed operations and resources.

Use the E2B SDK, CLI, or compatible APIs

Use an FC Agent Sandbox API Key to create and access sandboxes through the E2B SDK, E2B CLI, or compatible HTTP APIs. FCSandbox RAM permissions are not required. Each API Key is bound to one Team. Use separate Teams and API Keys for different projects and environments, and do not share an API Key between test and production applications. For instructions, see Create an API Key.

Manage all FC Agent Sandbox resources in an account

This scenario applies to a platform administrator who manages all Teams and resources. The following policy grants FCSandbox permissions in all regions of the account. It does not grant permissions on Function Compute or other Alibaba Cloud services. To limit the policy to one region, change Resource to acs:fcsandbox:<region>:<account-id>:*:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": "*"
    }
  ]
}

Manage a specified resource group

This scenario applies to an administrator who manages the test and production Teams of all projects in one department but cannot access other departments. The following example limits permissions to the department's resource group:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:ResourceGroupId": "<department-resource-group-id>"
        }
      }
    }
  ]
}

After logging on to the console, the RAM user must switch to an authorized resource group. When calling list operations, also specify the corresponding resourceGroupID.

Manage a specified Team

This scenario applies to project developers or production operators. The following policy allows management of the specified Team and its child resources, but does not allow the identity to create other Teams:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "fcsandbox:*",
      "Resource": [
        "acs:fcsandbox:<region>:<account-id>:teams/<team-id>",
        "acs:fcsandbox:<region>:<account-id>:teams/<team-id>/*"
      ]
    }
  ]
}

The Team and its child resources use separate ARNs, so both Resource entries are required. This policy does not include account-level Team list permissions. If the user must select a Team in the console, add fcsandbox:ListTeams permission scoped to the resource group. The user can then see the Team list in the same resource group. To strictly limit Team visibility, use a separate resource group for the project.

Action

Action in a permission policy specifies which FC Agent Sandbox OpenAPI operations a RAM identity can call. The format is:

fcsandbox:<action>

For example, CreateTeam corresponds to fcsandbox:CreateTeam, and CreateVolume corresponds to fcsandbox:CreateVolume. Before configuring a policy, find the required operation in the FC Agent Sandbox OpenAPI documentation and configure Action based on its authorization information.

Resource ARN

acs:fcsandbox:<region>:<account-id>:<resource-path>