:RAM policies

RAM policies

In RAM, a policy includes a set of permissions that are specified based on the policy structure and syntax. Each policy specifies the resources on which permissions are granted, the operations that can be performed or cannot be performed on specific resources, and the conditions that are required for the policy to take effect. For information about the structure and syntax of policies, see Policy structure and syntax.

In RAM, a policy is a resource entity. ApsaraMQ for Kafka supports the following types of policies:

• System policy: System policies are created and maintained by Alibaba Cloud. You can use system policies to perform coarse-grained permission control on RAM users. You cannot modify system policies.

• Custom policy: You can create, update, and delete custom policies. You can use custom policies to perform fine-grained permission control on RAM users. You need to manage the versions of custom policies.

System policies

The following table describes system policies that are supported by ApsaraMQ for Kafka.

Sample system policy

In this example, the AliyunKafkaFullAccess system policy is attached to a RAM user. After the policy is attached, the RAM user is granted the permissions to perform all operations on the ApsaraMQ for Kafka console and call all API operations of ApsaraMQ for Kafka. The granted permissions are equivalent to the permissions of the corresponding Alibaba Cloud account on ApsaraMQ for Kafka. The following code shows the content of the policy:

{
    "Version": "1",
    "Statement": [
        {
            "Action": "alikafka:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": [
                        "connector.alikafka.aliyuncs.com",
                        "instanceencryption.alikafka.aliyuncs.com",
                        "alikafka.aliyuncs.com",
                        "etl.alikafka.aliyuncs.com"
                    ]
                }
            }
        }
    ]
}

Custom policies

The following table describes custom policies that are supported by ApsaraMQ for Kafka.

Sample custom policy

In this example, the AliyunKafkaCustomAccess policy is attached to a RAM user. After the policy is attached, the RAM user is granted only the permissions to view the alikafka_post-cn-xxx instance and the topics and groups on the instance, query messages, and download messages in the ApsaraMQ for Kafka console or by calling API operations. The following code shows the content of the policy:

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
              "alikafka:ListInstance",
              "alikafka:ListTopic",
              "alikafka:ListGroup",
              "alikafka:QueryMessage",
              "alikafka:DownloadMessage"
                       ],
            "Resource": "acs:alikafka:*:*:alikafka_post-cn-xxx",
            "Effect": "Allow"
        }
    ]
}

References

For information about how to grant permissions to a RAM user, see Grant permissions to RAM users and Grant permissions across Alibaba Cloud accounts.