Alibaba Cloud provides Resource Access Management (RAM) for you to manage permissions on ApsaraMQ for MQTT. If you use RAM, you do not need to share the AccessKey pair of your Alibaba Cloud account with other users. You can grant the users only the required permissions. An AccessKey pair consists of an AccessKey ID and an AccessKey secret. This topic describes the policies provided for ApsaraMQ for MQTT in RAM.
Policy types
In RAM, a policy is a collection of permissions that are described by using syntax. For more information, see Policy structure and syntax. A policy can accurately describe the authorized resource set, action set, and authorization conditions. ApsaraMQ for MQTT provides the following types of RAM policies:
System policies: System policies are created and updated by Alibaba Cloud. You can use system policies but cannot modify them.
Custom policies: You can create, update, and delete custom policies. You need to maintain the versions of custom policies.
System policies
ApsaraMQ for MQTT provides four default system policies.
ApsaraMQ for MQTT does not support independent system policies. When you attach the following system policies to RAM users, the policies take effect in both ApsaraMQ for MQTT and ApsaraMQ for RocketMQ.
Policy | Description |
AliyunMQFullAccess | The permissions to manage ApsaraMQ for MQTT. A RAM user to which this policy is attached can manage all features the same way you use an Alibaba Cloud account to manage resources in the ApsaraMQ for MQTT console. Note After this policy is attached to a RAM user, the RAM user cannot view the list of instances in the ApsaraMQ for MQTT console. To view the list of instances in the ApsaraMQ for MQTT console, the RAM user must be granted the mq:MqttInstanceAccess permission that is used to query the basic information of an instance. For more information, see Permissions to manage instances in the console. |
AliyunMQPubOnlyAccess | The permissions to publish messages in ApsaraMQ for MQTT. A RAM user to which this policy is attached can use all resources of the Alibaba Cloud account to send messages by using SDKs. |
AliyunMQSubOnlyAccess | The permissions to subscribe to messages in ApsaraMQ for MQTT. A RAM user to which this policy is attached can use all resources of the Alibaba Cloud account to subscribe to messages by using SDKs. |
AliyunMQReadOnlyAccess | The read-only permissions on ApsaraMQ for MQTT. A RAM user to which this policy is attached can only read resource information in the ApsaraMQ for MQTT console or by calling API operations. Note After this policy is attached to a RAM user, the RAM user cannot view the list of instances in the ApsaraMQ for MQTT console. To view the list of instances in the ApsaraMQ for MQTT console, the RAM user must be granted the mq:MqttInstanceAccess permission that is used to query the basic information of an instance. For more information, see Permissions to manage instances in the console. |
Custom policies
Custom policies allow you to grant fine-grained permissions to users.
The following section describes the mappings between resources and actions in ApsaraMQ for MQTT.
In ApsaraMQ for MQTT, instances, topics, groups, and rules are different types of resources. Permissions must be granted to perform actions on the resources.
The possible values and corresponding rules of resources and actions in ApsaraMQ for MQTT can be divided into the following categories: console, API operation, and ApsaraMQ for MQTT client. Resource-related operations in the ApsaraMQ for MQTT console are divided into the following categories based on the resource type: instance, topic, group, and rule.
To access the resources of an ApsaraMQ for MQTT instance and call API operations to perform operations on the instance, you must obtain the required permissions on the instance. The corresponding action is mq:MqttInstanceAccess.
For information about sample custom policies, see Sample permission policies.
Permissions to publish and subscribe to messages on an ApsaraMQ for MQTT client
The permissions to publish and subscribe to messages involve the resource naming formats of topics and groups.
Topic: acs:mq:*:*:topic/{mqttInstanceId}/{topic}
Group ID: acs:mq:*:*:groupId/{mqttInstanceId}/{gid}
Action | Description | Remarks |
mq:PUB | Publishes messages. | Before you grant a RAM user permissions on a topic or group, you must grant the user the mq:MqttInstanceAccess permission on the instance to which the topic or group belongs. |
mq:SUB | Subscribes to messages. |
The permissions to publish and subscribe to messages on ApsaraMQ for MQTT clients cannot be granted across Alibaba Cloud accounts.
Permissions to manage an instance in the console
The resource naming format of an ApsaraMQ for MQTT instance is acs:mq:*:*:instance/{mqttInstanceId}.
Action | Description | Remarks |
mq:MqttInstanceAccess | Queries the basic information about an instance. | Before you grant a RAM user permissions on a topic or group, you must grant the user the mq:MqttInstanceAccess permission on the instance to which the topic or group belongs. |
mq:DeleteMqttInstance | Deletes an instance. | None |
mq:UpdateMqttInstance | Modifies instance information. | None |
mq:ListMqttInstance | Queries the list of instances. | None |
mq:UpdateMqttInstanceWarn | Updates the alert information about a specific instance. | None |
Permissions to manage a topic in the console
The resource naming format of a topic is acs:mq:*:*:topic/{mqttInstanceId}/{topic}.
Action | Description | Remarks |
mq:QueryMqttClientByTopic | Queries ApsaraMQ for MQTT clients that subscribe to a specific topic. | Before you grant a RAM user permissions on a topic or group, you must grant the user the mq:MqttInstanceAccess permission on the instance to which the topic or group belongs. |
mq:QueryMqttMsgTransTrend | Queries messaging statistics based on a specific topic. | |
mq:SendMqttMessageByConsole | Tests the message sending feature in the console. | |
mq:CreateMqttTopic | Creates a topic. | |
mq:DeleteMqttTopic | Deletes a topic. | |
mq:ListMqttTopic | Queries a topic. | |
mq:UpdateMqttTopic | Updates the description of a topic. |
Permissions to manage a group in the console
The resource naming format of a group is acs:mq:*:*:groupId/{mqttInstanceId}/{gid}.
Action | Description | Remarks |
mq:CreateMqttGroupId | Creates a group. | Before you grant a RAM user permissions on a topic or group, you must grant the user the mq:MqttInstanceAccess permission on the instance to which the topic or group belongs. |
mq:ListMqttGroupId | Queries the list of groups. | |
mq:QueryMqttClientByClientId | Queries ApsaraMQ for MQTT client information based on a specific client ID. | |
mq:QueryMqttClientByGroupId | Queries ApsaraMQ for MQTT client information based on a specific group ID. | |
mq:QueryMqttHistoryOnline | Queries the information about historical connected ApsaraMQ for MQTT clients based on a specific group ID. | |
mq:DeleteMqttGroupId | Deletes a group. | |
mq:QueryMqttTraceDevice | Queries the trace of an ApsaraMQ for MQTT client. | |
mq:QueryMqttDeviceTrace | Queries the information about a specific ApsaraMQ for MQTT client. |
Permissions to manage a rule in the console
The resource naming format of a rule is acs:mq:*:*:rule/{mqttInstanceId}/{ruleId}.
When you grant permissions on a rule, make sure that the related instances, topics, and groups belong to the same Alibaba Cloud account.
Action | Description | Remarks |
mq:CreateMqttInboundRule | Creates a data inbound rule. | Before you grant a RAM user permissions on a rule, you must grant the user the mq:MqttInstanceAccess permission on the instance with which the rule is associated. |
mq:DeleteMqttInboundRule | Deletes a data inbound rule. | |
mq:ListMqttInboundRule | Queries a data inbound rule. | |
mq:UpdateMqttInboundRule | Updates a data inbound rule. | |
mq:CreateMqttOutboundRule | Creates a data outbound rule. | |
mq:DeleteMqttOutboundRule | Deletes a data outbound rule. | |
mq:ListMqttOutboundRule | Queries a data outbound rule. | |
mq:UpdateMqttOutboundRule | Updates a data outbound rule. | |
mq:CreateClientStatusNotifyRule | Creates a rule for client status notification. | |
mq:DeleteClientStatusNotifyRule | Deletes a rule for client status notification. | |
mq:ListClientStatusNotifyRule | Queries a rule for client status notification. | |
mq:UpdateClientStatusNotifyRule | Updates a rule for client status notification. |
Permissions to call an API operation
Before you grant permissions to perform operations on a rule by calling the corresponding API operation, make sure that the related instances, topics, and groups belong to the same Alibaba Cloud account.
API | Resource naming format | Resource naming example | Action |
* | * |
| |
* | * |
| |
|
|
| |
|
|
| |
| |||
| |||
|
| mq:MqttInstanceAccess | |
mq:MqttInstanceAccess | |||
mq:MqttInstanceAccess | |||
mq:MqttInstanceAccess | |||
mq:MqttInstanceAccess | |||
mq:MqttInstanceAccess | |||
| |||
| |||
Instance: acs:mq:*:*:instance/{mqttInstanceId} | Instance: acs:mq:*:*:instance/post-cn-09k1noy**** | mq:MqttInstanceAccess | |
mq:MqttInstanceAccess |
For more information about API operations, see List of operations by function.