Function Compute:Policies and sample policies

In RAM, a policy is a set of permissions that are defined based on Policy structure and syntax. A policy accurately defines the authorized resource set, action set, and authorization conditions. Policies for Function Compute include the following types:

• System policies: System policies are created and updated by Alibaba Cloud. You can use system policies but cannot modify them.

• Custom policies: You can create, update, and delete custom policies. You need to maintain versions of custom policies.

The following items list system policies of different types:

• System policies for Function Compute

  Policy name	Description
  AliyunFCReadOnlyAccess	The read-only permissions on all Function Compute resources.
  AliyunFCInvocationAccess	The permissions to invoke functions.
  AliyunFCFullAccess	The permissions to manage all Function Compute resources.

  Note

  The AliyunFCFullAccess policy contains permissions of the AliyunFCInvocationAccess and AliyunFCReadOnlyAccess policies. After you attach the AliyunFCFullAccess policy to a RAM user, you do not need to attach the AliyunFCInvocationAccess or AliyunFCReadOnlyAccess policy to the RAM user.

• System policies for other Alibaba Cloud services

  Alibaba Cloud service	System policy
  Simple Log Service	AliyunLogReadOnlyAccess: the read-only permissions on Simple Log Service resources. AliyunLogFullAccess: the permissions to manage Simple Log Service resources. Note To access Simple Log Service as a RAM user, you need to attach only the AliyunLogReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Object Storage Service (OSS)	AliyunOSSReadOnlyAccess: the read-only permissions on OSS resources. AliyunOSSFullAccess: the permissions to manage OSS resources.
  CloudMonitor	AliyunCloudMonitorReadOnlyAccess: the read-only permissions on CloudMonitor resources.
  Certificate Management Service	AliyunYundunCertReadOnlyAccess: the read-only permissions on Certificate Management Service resources.
  Virtual Private Cloud (VPC)	AliyunVPCReadOnlyAccess: the read-only permissions on VPC resources.
  Elastic Compute Service (ECS)	AliyunECSReadOnlyAccess: the read-only permissions on ECS resources.
  RAM	AliyunRAMReadOnlyAccess: the read-only permissions on RAM resources, including the permissions to view users, groups, and authorization information. AliyunRAMFullAccess: the permissions to manage RAM resources, including the permissions to manage users and grant permissions. Note If you attach only the AliyunRAMReadOnlyAccess policy to a RAM user, you can only obtain the list of roles in the console as the RAM user. If you need to perform other operations as the RAM user, you need to attach the AliyunRAMFullAccess policy to the RAM user.
  Application Real-Time Monitoring Service (ARMS)	AliyunARMSReadOnlyAccess: the read-only permissions on ARMS resources. AliyunARMSFullAccess: the permissions to manage ARMS resources. Note To access ARMS as a RAM user, you need to attach only the AliyunARMSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Simple Message Queue (formerly MNS)	AliyunMNSReadOnlyAccess: the read-only permissions on Simple Message Queue (formerly MNS) resources. AliyunMNSFullAccess: the permissions to manage Simple Message Queue (formerly MNS) resources. Note To access Simple Message Queue (formerly MNS) as a RAM user, you need to attach only the AliyunMNSReadOnlyAccess policy to the RAM user based on the principle of least privilege.Simple Message Queue (formerly MNS)
  EventBridge	AliyunEventBridgeReadOnlyAccess: the read-only permissions on EventBridge resources. AliyunEventBridgeFullAccess: the permissions to manage EventBridge resources. Note To access EventBridge as a RAM user, you need to attach only the AliyunEventBridgeReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  ApsaraMQ for RocketMQ	AliyunMQReadOnlyAccess: the read-only permissions on ApsaraMQ for RocketMQ resources. AliyunMQFullAccess: the permissions to manage ApsaraMQ for RocketMQ resources. Note To access ApsaraMQ for RocketMQ as a RAM user, you need to attach only the AliyunMQReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Container Registry	AliyunContainerRegistryReadOnlyAccess: the read-only permissions on Container Registry resources. AliyunContainerRegistryFullAccess: the permissions to manage Container Registry resources. Note To access Container Registry as a RAM user, you need to attach only the AliyunContainerRegistryReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  File Storage NAS (NAS)	AliyunNASReadOnlyAccess: the read-only permissions on NAS resources. AliyunNASFullAccess: the permissions to manage NAS resources. Note To access NAS as a RAM user, you need to attach only the AliyunNASReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  ApsaraDB RDS	AliyunRDSReadOnlyAccess: the read-only permissions on ApsaraDB RDS resources. AliyunRDSFullAccess: the permissions to manage ApsaraDB RDS resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDSReadOnlyAccess policy to the RAM user based on the principle of least privilege.
  Apsara Devops	AliyunRDCReadOnlyAccess: the read-only permissions on Apsara DevOps RDC resources. AliyunRDCFullAccess: the permissions to manage Apsara DevOps RDC resources. Note To access ApsaraDB RDS as a RAM user, you need to attach only the AliyunRDCReadOnlyAccesss policy to the RAM user based on the principle of least privilege.

 {
        "Statement": [
            {
                "Action": [
                    "ram:PassRole"
                ],
                "Effect": "Allow",
                "Resource": "*"
            }
        ],
        "Version": "1"
    }

You can use the preceding custom policy to configure the permissions to invoke the demo function in the China (Hangzhou) region. The following code snippet shows the details:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "fc:InvokeFunction"
            ],
            "Resource": "acs:fc:cn-hangzhou:*:functions/demo",
            "Effect": "Allow"
        }
    ]
}