RAM authorization - Global Accelerator - Alibaba Cloud Documentation Center

Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.

This topic describes the elements, such as Action, Resource, and Condition, which are defined by Ga. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate Ga is ga. You can grant permissions on Ga at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

The following list describes the fields in the policy:

Effect: specifies the authorization effect. Valid values: Allow, Deny.
Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
- Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
- Condition_key: specifies the condition keys.
- Condition_value: specifies the condition values.

Action

Ga defines the values that you can use in the Action element of a policy statement. The following table describes the values.

Operation: the value that you can use in the Action element to specify the operation on a resource.
API operation: the API operation that you can call to perform the operation.
Access level: the access level of each operation. The levels are read, write, and list.
Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
- The required resource types are displayed in bold characters.
- If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.

Actions	API operation	Access level	Resource type	Condition key	Associated operation
ga:AddEntriesToAcl	AddEntriesToAcl	Write	Acl acs:ga:{#regionId}:{#accountId}:acl/{#aclId}	None	None
ga:AssociateAclsWithListener	AssociateAclsWithListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}	None	None
ga:AssociateAdditionalCertificatesWithListener	AssociateAdditionalCertificatesWithListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:AttachLogStoreToEndpointGroup	AttachLogStoreToEndpointGroup	Write	All Resources *	None	None
ga:BandwidthPackageAddAccelerator	BandwidthPackageAddAccelerator	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId} Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:BandwidthPackageRemoveAccelerator	BandwidthPackageRemoveAccelerator	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId} Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:ChangeResourceGroup	ChangeResourceGroup	Write	All Resources *	None	None
ga:CreateAccelerator	CreateAccelerator	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:CreateAcl	CreateAcl	Write	Acl acs:ga:{#regionId}:{#accountId}:acl/*	None	None
ga:CreateApplicationMonitor	CreateApplicationMonitor	Write	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:ga/{#gaId} ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/*	None	None
ga:CreateBandwidthPackage	CreateBandwidthPackage	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*	ga:BandwidthPackageType	None
ga:CreateBasicAccelerateIp	CreateBasicAccelerateIp	Write	BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:ga/{#gaId} BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:ipset/*	None	None
ga:CreateBasicAccelerateIpEndpointRelation	CreateBasicAccelerateIpEndpointRelation	Write	BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:ga/{#gaId} BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:basicgaip/{#basicgaipId} BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:basicendpoint/{#basicendpointId}	None	None
ga:CreateBasicAccelerateIpEndpointRelations	CreateBasicAccelerateIpEndpointRelations	Write	BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:CreateBasicAccelerator	CreateBasicAccelerator	Write	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:CreateBasicEndpoint	CreateBasicEndpoint	Write	BasicEndpoint acs:ga:{#regionId}:{#accountId}:basicendpoint/*	None	None
ga:CreateBasicEndpointGroup	CreateBasicEndpointGroup	Write	BasicEndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/*	None	None
ga:CreateBasicEndpoints	CreateBasicEndpoints	Write	BasicEndpoint acs:ga:{#regionId}:{#accountId}:basicendpoint/*	None	None
ga:CreateBasicIpSet	CreateBasicIpSet	Write	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/{#BasicAcceleratorId} BasicIpSet acs:ga:{#regionId}:{#accountId}:ipset/*	None	None
ga:CreateCustomRoutingEndpointGroupDestinations	CreateCustomRoutingEndpointGroupDestinations	Write	All Resources *	None	None
ga:CreateCustomRoutingEndpointGroups	CreateCustomRoutingEndpointGroups	Write	All Resources *	None	None
ga:CreateCustomRoutingEndpointTrafficPolicies	CreateCustomRoutingEndpointTrafficPolicies	Write	CustomRoutingEndpointTrafficPolicy acs:ga:{#regionId}:{#accountId}:customroutingendpoint/{#CustomRoutingEndpointId}	None	None
ga:CreateCustomRoutingEndpoints	CreateCustomRoutingEndpoints	Write	CustomRoutingEndpointGroup acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#customroutingendpointgroupId}	None	None
ga:CreateDomain	CreateDomain	Write	Domain acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:CreateEndpointGroup	CreateEndpointGroup	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/* Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId} Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	ga:AcceleratorMainland	None
ga:CreateEndpointGroups	CreateEndpointGroups	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/* Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId} Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	ga:AcceleratorMainland	None
ga:CreateForwardingRules	CreateForwardingRules	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId} Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:CreateIpSets	CreateIpSets	Write	IpSet acs:ga:{#regionId}:{#accountId}:ipset/* Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	ga:AcceleratorMainland	None
ga:CreateListener	CreateListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/* Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	ga:TLSVersion	None
ga:CreateSpareIps	CreateSpareIps	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:DeleteAccelerator	DeleteAccelerator	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:DeleteAcl	DeleteAcl	Write	Acl acs:ga:{#regionId}:{#accountId}:acl/{#aclId}	None	None
ga:DeleteBandwidthPackage	DeleteBandwidthPackage	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}	None	None
ga:DeleteBasicAccelerateIp	DeleteBasicAccelerateIp	Write	BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:basicgaip/{#basicgaipId}	None	None
ga:DeleteBasicAccelerateIpEndpointRelation	DeleteBasicAccelerateIpEndpointRelation	Write	BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:ga/{#gaId} BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:basicgaip/{#basicgaipId} BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:basicendpoint/{#basicendpointId}	None	None
ga:DeleteBasicAccelerator	DeleteBasicAccelerator	Write	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/{#BasicAcceleratorId}	None	None
ga:DeleteBasicEndpoint	DeleteBasicEndpoint	Write	BasicEndpoint acs:ga:{#regionId}:{#accountId}:basicendpoint/{#basicendpointId}	None	None
ga:DeleteBasicEndpointGroup	DeleteBasicEndpointGroup	Write	BasicEndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#BasicEndpointGroupId}	None	None
ga:DeleteBasicIpSet	DeleteBasicIpSet	Write	BasicIpSet acs:ga:{#regionId}:{#accountId}:ipset/{#BasicIpSetId}	None	None
ga:DeleteCustomRoutingEndpointGroupDestinations	DeleteCustomRoutingEndpointGroupDestinations	Write	CustomRoutingEndpointGroupDestination acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#EndpointGroupId}	None	None
ga:DeleteCustomRoutingEndpointGroups	DeleteCustomRoutingEndpointGroups	Write	CustomRoutingEndpointGroup acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#EndpointGroupId} CustomRoutingEndpointGroup acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#EndpointGroupId}	None	None
ga:DeleteCustomRoutingEndpointTrafficPolicies	DeleteCustomRoutingEndpointTrafficPolicies	Write	All Resources *	None	None
ga:DeleteCustomRoutingEndpoints	DeleteCustomRoutingEndpoints	Write	All Resources *	None	None
ga:DeleteDomainAcceleratorRelation	DeleteDomainAcceleratorRelation	Write	Domain acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:DeleteEndpointGroup	DeleteEndpointGroup	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}	None	None
ga:DeleteEndpointGroups	DeleteEndpointGroups	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}	None	None
ga:DeleteForwardingRules	DeleteForwardingRules	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:DeleteIpSet	DeleteIpSet	Write	IpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}	None	None
ga:DeleteIpSets	DeleteIpSets	Write	IpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}	None	None
ga:DeleteListener	DeleteListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:DeleteSpareIps	DeleteSpareIps	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:DescribeAccelerator	DescribeAccelerator	Read	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:DescribeAcceleratorAutoRenewAttribute	DescribeAcceleratorAutoRenewAttribute	Read	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:DescribeAcceleratorServiceStatus	DescribeAcceleratorServiceStatus	Write	All Resources *	None	None
ga:DescribeApplicationMonitor	DescribeApplicationMonitor	Read	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/{#TaskId}	None	None
ga:DescribeBandwidthPackage	DescribeBandwidthPackage	Read	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}	None	None
ga:DescribeBandwidthPackageAutoRenewAttribute	DescribeBandwidthPackageAutoRenewAttribute	Read	BandwidthPackage acs:ga:{#regionId}:{#accountId}:ga/{#BandwidthPackageId}	None	None
ga:DescribeCommodity	DescribeCommodity	Read	All Resources *	None	None
ga:DescribeCommodityPrice	DescribeCommodityPrice	Read	All Resources *	None	None
ga:DescribeCustomRoutingEndPointTrafficPolicy	DescribeCustomRoutingEndPointTrafficPolicy	Read	All Resources *	None	None
ga:DescribeCustomRoutingEndpoint	DescribeCustomRoutingEndpoint	Read	CustomRoutingEndpoint acs:ga:{#regionId}:{#accountId}:customroutingendpoint/{#CustomRoutingEndpointId}	None	None
ga:DescribeCustomRoutingEndpointGroup	DescribeCustomRoutingEndpointGroup	Read	CustomRoutingEndpointGroup acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#customroutingendpointgroupId}	None	None
ga:DescribeCustomRoutingEndpointGroupDestinations	DescribeCustomRoutingEndpointGroupDestinations	Read	CustomRoutingEndpointGroupDestination acs:ga:{#regionId}:{#accountId}:destination/{#DestinationId}	None	None
ga:DescribeEndpointGroup	DescribeEndpointGroup	Read	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}	None	None
ga:DescribeIpSet	DescribeIpSet	Read	IpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}	None	None
ga:DescribeListener	DescribeListener	Read	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:DescribeLogStoreOfEndpointGroup	DescribeLogStoreOfEndpointGroup	Read	AccessLog acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}	None	None
ga:DescribeRegions	DescribeRegions	Read	All Resources *	None	None
ga:DetachLogStoreFromEndpointGroup	DetachLogStoreFromEndpointGroup	Write	All Resources *	None	None
ga:DetectApplicationMonitor	DetectApplicationMonitor	Write	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/{#TaskId}	None	None
ga:DisableApplicationMonitor	DisableApplicationMonitor	Write	All Resources *	None	None
ga:DissociateAclsFromListener	DissociateAclsFromListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:DissociateAdditionalCertificatesFromListener	DissociateAdditionalCertificatesFromListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:GetAcl	GetAcl	Read	All Resources *	None	None
ga:GetBasicAccelerateIp	GetBasicAccelerateIp	Read	BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:basicgaip/{#basicgaipId}	None	None
ga:GetBasicAccelerateIpEndpointRelation	GetBasicAccelerateIpEndpointRelation	Read	BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:basicendpoint/{#basicendpointId} BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:basicgaip/{#basicgaipId}	None	None
ga:GetBasicAccelerateIpIdleCount	GetBasicAccelerateIpIdleCount	Read	All Resources *	None	None
ga:GetBasicAccelerator	GetBasicAccelerator	Read	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/{#BasicAcceleratorId}	None	None
ga:GetBasicEndpoint	GetBasicEndpoint	Read	BasicEndpoint acs:ga:{#regionId}:{#accountId}:basicendpoint/{#EndPointId}	None	None
ga:GetBasicEndpointGroup	GetBasicEndpointGroup	Read	BasicEndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#BasicEndpointGroupId}	None	None
ga:GetBasicIpSet	GetBasicIpSet	Read	BasicIpSet acs:ga:{#regionId}:{#accountId}:ipset/{#BasicIpSetId}	None	None
ga:GetHealthStatus	GetHealthStatus	Read	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:GetInvalidDomainCount	GetInvalidDomainCount	Read	Domain acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:GetIpsetsBandwidthLimit	GetIpsetsBandwidthLimit	Read	All Resources *	None	None
ga:GetSpareIp	GetSpareIp	Read	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:ListAccelerateAreas	ListAccelerateAreas	List	All Resources *	None	None
ga:ListAccelerators	ListAccelerators	List	Accelerator acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:ListAcls	ListAcls	List	Acl acs:ga:{#regionId}:{#accountId}:acl/*	None	None
ga:ListApplicationMonitor	ListApplicationMonitor	List	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/*	None	None
ga:ListApplicationMonitorDetectResult	ListApplicationMonitorDetectResult	List	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/*	None	None
ga:ListAvailableAccelerateAreas	ListAvailableAccelerateAreas	List	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:ListAvailableBusiRegions	ListAvailableBusiRegions	List	All Resources *	None	None
ga:ListBandwidthPackages	ListBandwidthPackages	List	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*	None	None
ga:ListBandwidthackages	ListBandwidthackages	List	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*	None	None
ga:ListBasicAccelerateIpEndpointRelations	ListBasicAccelerateIpEndpointRelations	List	BasicAccelerateIpEndpointRelation acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:ListBasicAccelerateIps	ListBasicAccelerateIps	List	BasicAccelerateIp acs:ga:{#regionId}:{#accountId}:ipset/{#IpSetId}	None	None
ga:ListBasicAccelerators	ListBasicAccelerators	List	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:ListBasicEndpoints	ListBasicEndpoints	List	All Resources *	None	None
ga:ListBusiRegions	ListBusiRegions	List	All Resources *	None	None
ga:ListCommonAreas	ListCommonAreas	List	All Resources *	None	None
ga:ListCustomRoutingEndpointGroupDestinations	ListCustomRoutingEndpointGroupDestinations	List	CustomRoutingEndpointGroupDestination acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:ListCustomRoutingEndpointGroups	ListCustomRoutingEndpointGroups	List	CustomRoutingEndpointGroup acs:ga:*:{#accountId}:ga/{#gaId}	None	None
ga:ListCustomRoutingEndpointTrafficPolicies	ListCustomRoutingEndpointTrafficPolicies	List	CustomRoutingEndpointTrafficPolicy acs:ga:*:{#accountId}:ga/{#gaId}	None	None
ga:ListCustomRoutingEndpoints	ListCustomRoutingEndpoints	List	CustomRoutingEndpoint acs:ga:*:{#accountId}:ga/{#gaId}	None	None
ga:ListCustomRoutingPortMappings	ListCustomRoutingPortMappings	List	CustomRoutingPortMapping acs:ga:*:{#accountId}:ga/{#gaId}	None	None
ga:ListCustomRoutingPortMappingsByDestination	ListCustomRoutingPortMappingsByDestination	List	CustomRoutingEndpoint acs:ga:*:{#accountId}:customroutingendpoint/{#customroutingendpointId}	None	None
ga:ListDomains	ListDomains	List	Domain acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:ListEndpointGroupIpAddressCidrBlocks	ListEndpointGroupIpAddressCidrBlocks	Read	All Resources *	None	None
ga:ListEndpointGroups	ListEndpointGroups	List	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/*	None	None
ga:ListForwardingRules	ListForwardingRules	List	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:ListIpSets	ListIpSets	List	IpSet acs:ga:{#regionId}:{#accountId}:ipset/*	None	None
ga:ListIspTypes	ListIspTypes	List	All Resources *	None	None
ga:ListListenerCertificates	ListListenerCertificates	List	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:ListListeners	ListListeners	List	Listener acs:ga:{#regionId}:{#accountId}:listener/*	None	None
ga:ListSpareIps	ListSpareIps	List	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:ListSystemSecurityPolicies	ListSystemSecurityPolicies	List	All Resources *	None	None
ga:ListTagResources	ListTagResources	List	Accelerator acs:ga:{#regionId}:{#accountId}:ga/* Acl acs:ga:{#regionId}:{#accountId}:acl/* BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/* BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/* EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/*	None	None
ga:OpenAcceleratorService	OpenAcceleratorService	Write	All Resources *	None	None
ga:QueryCrossBorderApprovalStatus	QueryCrossBorderApprovalStatus	Read	All Resources *	None	None
ga:RemoveEntriesFromAcl	RemoveEntriesFromAcl	Write	Acl acs:ga:{#regionId}:{#accountId}:acl/{#aclId}	None	None
ga:ReplaceBandwidthPackage	ReplaceBandwidthPackage	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}	None	None
ga:TagResources	TagResources	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#gaId} Acl acs:ga:{#regionId}:{#accountId}:acl/{#aclId} BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthpackageId} BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/{#basicGaId} EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#EndpointGroupId}	None	None
ga:UntagResources	UntagResources	Write	All Resources *	None	None
ga:UpdateAccelerator	UpdateAccelerator	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:UpdateAcceleratorAutoRenewAttribute	UpdateAcceleratorAutoRenewAttribute	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#gaId}	None	None
ga:UpdateAcceleratorConfirm	UpdateAcceleratorConfirm	Write	Accelerator acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}	None	None
ga:UpdateAcceleratorCrossBorderMode	UpdateAcceleratorCrossBorderMode	Write	All Resources *	None	None
ga:UpdateAcceleratorCrossBorderStatus	UpdateAcceleratorCrossBorderStatus	Write	All Resources *	None	None
ga:UpdateAclAttribute	UpdateAclAttribute	Write	Acl acs:ga:{#regionId}:{#accountId}:acl/{#aclId}	None	None
ga:UpdateAdditionalCertificateWithListener	UpdateAdditionalCertificateWithListener	Write	AdditionalCertificate acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}	None	None
ga:UpdateApplicationMonitor	UpdateApplicationMonitor	Write	ApplicationMonitor acs:ga:{#regionId}:{#accountId}:sitemonitor/{#TaskId}	None	None
ga:UpdateBandwidthPackagaAutoRenewAttribute	UpdateBandwidthPackagaAutoRenewAttribute	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:ga/{#BandwidthPackageId}	None	None
ga:UpdateBandwidthPackage	UpdateBandwidthPackage	Write	BandwidthPackage acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}	None	None
ga:UpdateBasicAccelerator	UpdateBasicAccelerator	Write	BasicAccelerator acs:ga:{#regionId}:{#accountId}:ga/{#BasicAcceleratorId}	None	None
ga:UpdateBasicEndpoint	UpdateBasicEndpoint	Write	BasicEndpoint acs:ga:{#regionId}:{#accountId}:basicendpoint/{#EndPointId}	None	None
ga:UpdateBasicEndpointGroup	UpdateBasicEndpointGroup	Write	BasicEndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#BasicEndpointGroupId}	None	None
ga:UpdateBasicIpSet	UpdateBasicIpSet	Write	BasicIpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipsetId}	None	None
ga:UpdateCustomRoutingEndpointGroupAttribute	UpdateCustomRoutingEndpointGroupAttribute	Write	CustomRoutingEndpointGroup acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#EndpointGroupId}	None	None
ga:UpdateCustomRoutingEndpointGroupDestinations	UpdateCustomRoutingEndpointGroupDestinations	Write	CustomRoutingEndpointGroupDestination acs:ga:{#regionId}:{#accountId}:customroutingendpointgroup/{#customroutingendpointgroupId}	None	None
ga:UpdateCustomRoutingEndpointTrafficPolicies	UpdateCustomRoutingEndpointTrafficPolicies	Write	CustomRoutingEndpointTrafficPolicy acs:ga:{#regionId}:{#accountId}:customroutingendpoint/{#CustomRoutingEndpointTrafficPolicyId}	None	None
ga:UpdateCustomRoutingEndpoints	UpdateCustomRoutingEndpoints	Write	All Resources *	None	None
ga:UpdateDomain	UpdateDomain	Write	All Resources *	None	None
ga:UpdateDomainState	UpdateDomainState	Write	Domain acs:ga:{#regionId}:{#accountId}:ga/*	None	None
ga:UpdateEndpointGroup	UpdateEndpointGroup	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}	None	None
ga:UpdateEndpointGroupAttribute	UpdateEndpointGroupAttribute	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}	None	None
ga:UpdateEndpointGroups	UpdateEndpointGroups	Write	EndpointGroup acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}	None	None
ga:UpdateForwardingRules	UpdateForwardingRules	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None
ga:UpdateIpSet	UpdateIpSet	Write	IpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}	None	None
ga:UpdateIpSets	UpdateIpSets	Write	IpSet acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}	None	None
ga:UpdateListener	UpdateListener	Write	Listener acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}	None	None

Resource

Ga defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

{#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
An asterisk (*) is used as a wildcard. Examples:
- {#resourceType} is set to *, all resources are specified.
- {#regionId} is set to *, all regions are specified.
- {#accountId} is set to *, all Alibaba Cloud accounts are specified.

Resource type	ARN
Listener	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}
ApplicationMonitor	acs:ga:{#regionId}:{#accountId}:applicationmonitor/{#TaskId}
CustomRoutingEndpointTrafficPolicy	acs:ga:{#regionId}:{#accountId}:customroutingendpointtrafficpolicy/{#CustomRoutingEndpointTrafficPolicyId}
BandwidthPackage	acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#BandwidthPackageId}
Accelerator	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}
CustomRoutingEndpointGroupDestination	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}/customroutingendpointgroup/{#EndpointGroupId}/customroutingendpointgroupdestination/{#CustomRoutingEndpointGroupDestinationId}
CustomRoutingEndpoint	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}/customroutingendpointgroup/{#EndpointGroupId}/customroutingendpoint/{#CustomRoutingEndpointId}
BasicAccelerateIp	acs:{#ramcode}:{#regionId}:{#accountId}:basicaccelerateip/{#AccelerateIpId}
Acl	acs:ga:{#regionId}:{#accountId}:acl/{#AclId}
BasicAccelerator	acs:ga:{#regionId}:{#accountId}:basicaccelerator/{#BasicAcceleratorId}
BasicIpSet	acs:ga:{#regionId}:{#accountId}:basicaccelerator/{#BasicAcceleratorId}/basicipset/{#BasicIpSetId}
AccessLog	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}/accesslog/{#EndpointGroupId}
BasicAccelerateIpEndpointRelation	acs:{#ramcode}:{#regionId}:{#accountId}:basicaccelerateipendpointrelation/{#AcceleratorId}/{#EndpointId}/{#AccelerateIpId}
EndpointGroup	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/endpointgroup/{#EndpointGroupId}
AccelerateArea	acs:ga:{#regionId}:{#accountId}:acceleratearea/{#AccelerateAreaId}
IpSet	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/ipset/{#IpSetId}
BasicEndpoint	acs:ga:{#regionId}:{#accountId}:basicendpoint/{#EndPointId}
CustomRoutingEndpointGroup	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}/customroutingendpointgroup/{#EndpointGroupId}
AdditionalCertificate	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/listener/{#ListenerId}/certificate/{#CertificateId}
Domain	acs:ga:{#regionId}:{#accountId}:accelerator/{#AcceleratorId}/domain/{#Domain}
BusiRegion	acs:ga:{#regionId}:{#accountId}:busiregion/{#RegionId}
BasicEndpointGroup	acs:ga:{#regionId}:{#accountId}:basicendpointgroup/{#BasicEndpointGroupId}
SystemSecurityPolicy	acs:ga:{#regionId}:{#accountId}:systemsecuritypolicy/{#SystemSecurityPolicyId}
CustomRoutingPortMapping	acs:ga:{#regionId}:{#accountId}:customroutingportmapping/{#EndpointId}

Condition

Ga defines the values that you can use in the Condition element of a policy statement. The following table describes the values. The following table describes the service-specific condition keys. The common condition keys that are defined by Alibaba Cloud also apply to Ga. For more information about the common condition keys, see Generic Condition Keyword.

The data type determines the conditional operators that you can use to compare the value in a request with the value in a policy statement. You must use conditional operators that are supported by the data type. Otherwise, you cannot compare the value in the request with the value in the policy statement. In this case, the authorization is invalid. For more information about the conditional operators that are supported by each data type, see Policy elements.

Condition key	Description	Data type
ga:AcceleratorMainland		String
ga:BandwidthPackageType		String
ga:TLSVersion		String

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: