RAM permissions

The Hologres Console uses RAM (Resource Access Management) for authentication and instance permission management. This topic covers common permission errors that RAM users encounter in the console and explains how to resolve them.

All solutions in this topic require the Alibaba Cloud account holder to perform the authorization steps in the RAM console. RAM users cannot grant permissions to themselves.

RAM user cannot purchase instance

To purchase a Hologres instance, a RAM user must first be granted purchase permissions by the Alibaba Cloud account. See Grant access to Hologres for RAM users.

After the RAM user purchases an instance, the Alibaba Cloud account must also grant development permissions for that instance to the RAM user. See Grant development permissions.

RAM user cannot view the instance list

Error: You are not authorized to view the purchased instances. Contact the relevant Alibaba Cloud account to grant the hologram:ListInstances permission to you in the RAM console.

The RAM user is missing the hologram:ListInstances permission.

Performed by the Alibaba Cloud account owner: Log on to the RAM console and grant the RAM user the AliyunHologresReadOnlyAccess policy.

RAM user with superuser priviledge cannot list or add users in HoloWeb

Error

You are unauthorized to view all the RAM users. Contact the relevant Alibaba Cloud account to grant the ram:ListUsers permission to you through a permission policy, such as AliyunRAMReadOnlyAccess, in the RAM console.

Cause

The RAM user doesn't have the permission to list users in HoloWeb.

Solution

Performed by the Alibaba Cloud account owner: Log on to the RAM console and grant the RAM user the ram:ListUsers permission (or AliyunRAMReadOnlyAccess policy).

RAM user have no access to Account Management and Database Management

Error

You are not authorized to perform this operation. Contact the superuser to add your account to the current instance.

Cause

The RAM user doesn't have development permissions on the instance.

Solution

Performed by the Alibaba Cloud account owner: Grant the user the development permissions. See Grant development permissions.

RAM user cannot manage instances

Symptom

A RAM user with superuser permissions on an instance still cannot perform any of the following operations:

Purchase an instance
Upgrade or downgrade an instance
Change the billing method from pay-as-you-go to subscription

The following error appears:

An error occurred while performing RAM authorization.

Cause

Billing-related operations — purchasing, upgrading, downgrading, and changing the billing method — are controlled by the Alibaba Cloud account, not by Hologres instance-level permissions. Superuser permissions granted within Hologres do not cover these operations. The error indicates that the RAM user lacks the required account-level billing permissions, not that the Hologres superuser role was misconfigured.

Solution

The Alibaba Cloud account must log on to the RAM console and grant both of the following policies to the RAM user:

Policy	Purpose
AliyunHologresFullAccess	Grants full access to Hologres resources
AliyunBSSOrderAccess	Grants permissions to perform billing and order operations