Hologres:Grant access to Hologres for RAM users

Two permission layers

Hologres uses two separate permission layers. Understanding the distinction upfront prevents most authorization errors:

This topic covers console permissions. To grant development permissions, see Grant a RAM user development permissions on an instance.

Prerequisites

Before you begin, ensure that you have:

• An Alibaba Cloud account with RAM administrator permissions

• At least one RAM user or RAM user group to grant permissions to

Grant permissions to a RAM user

1. Log on to the RAM console as a RAM administrator.

2. In the left navigation pane, choose Identities > Groups.

3. On the Groups page, find the RAM user group you want to manage, then click Attach Policy in the Actions column. To grant permissions to multiple groups at once, select multiple RAM user groups and click Attach Policy at the bottom of the page.

   

4. In the Add Permissions dialog box, configure the following parameters:

   1. Select a resource scope: > Important: Resource group-level permissions are only available when the corresponding Alibaba Cloud service and resource type support resource groups. See Alibaba Cloud services that support resource groups. For an authorization example, see Use a resource group to control the permissions of a RAM user on specified ECS instances.

      • Account Level: permissions take effect across the current Alibaba Cloud account.

      • Resource Group Level: permissions take effect within the specified resource group.

        Important

        You can grant permissions based on a resource group only if the corresponding Alibaba Cloud service and resource type support resource groups. For more information, see Alibaba Cloud services that support resource groups. For an example of resource group authorization, see Use a resource group to control the permissions of a RAM user on specified ECS instances.

   2. Select an authorization entity: the system auto-selects the current RAM user.

   3. Select access policies: select one or more policies. Access policies fall into two types: system policies and custom policies.

   HoloWeb cannot belong to a resource group. If permissions are granted at the resource group level, RAM users cannot log on to or use HoloWeb. The access policies below control whether a RAM user can log on to and use HoloWeb — not whether the user can connect to a Hologres instance. For instance-level access, grant development permissions from the instance details page.

5. Click Confirm Authorization Policy, then click Disable.

System policies

System policies are created and maintained by Alibaba Cloud. You can use them but cannot modify them. See Alibaba Cloud services that support RAM for the full list.

The system automatically flags high-risk policies such as AdministratorAccess and AliyunRAMFullAccess. Avoid granting these unless explicitly required.

Custom policies

Custom policies are managed by you. You can create, update, delete, and version them. See Create a custom policy for general instructions. To write policies directly in JSON, see the script mode guide.

The following custom actions are supported for Hologres:

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "hologram:*",
            "Resource": "acs:hologram:*:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:*",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:DeleteInstance",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "bss:PayOrder",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:GetInstance",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:ListInstances",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:StopInstance",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:ResumeInstance",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:UpdateInstanceNetworkType",
            "Resource": "acs:hologram:cn-<region>:<AccountID>:instance/*"
        },
        {
            "Effect": "Allow",
            "Action": "hologram:HoloWebAccess",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

Replace the placeholders with your actual values:

Example resource string:

acs:hologram:cn-beijing:4322xxxxx:instance/hhhgggxxxx

FAQ: Console permissions {#faq-console}

FAQ: Instance usage permissions {#faq-instance-usage}

What's next

• Grant a RAM user development permissions on an instance

• Hologres permission model

• Manage users