Message Queue for RabbitMQ:RAM policies

Overview

In RAM, an authorization policy can include a set of permissions that are specified based on the policy structure and syntax. Each policy specifies the resources on which permissions are granted, the operations that can be performed or cannot be performed on specific resources, and the conditions that are required for the policy to take effect. For information about the structure and syntax of authorization policies, see Policy structure and syntax.

In RAM, an authorization policy is a resource entity. Message Queue for RabbitMQ supports the following types of authorization policies:

• System authorization policy: System authorization policies are created and maintained by Alibaba Cloud. You can use system authorization policies to perform coarse-grained permission control on RAM users. You cannot modify system authorization policies.
• Custom authorization policy: You can create, update, and delete custom authorization policies. You can use custom authorization policies to perform fine-grained permission control on RAM users. You need to manage the versions of custom authorization policies.

System authorization policies

The following table describes the system authorization policies supported by Message Queue for RabbitMQ.

Sample system authorization policies

In the following example, the system authorization policy AliyunAMQPFullAccess is described. RAM users who are granted permissions by using this policy can manage all Message Queue for RabbitMQ resources of the Alibaba Cloud account, and publish and receive messages by using SDKs. The following sample code shows the content of the policy:

{
    "Version": "1",
    "Statement": [
        {
            "Action": "amqp:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Custom policies

The following table describes the custom authorization policies supported by Message Queue for RabbitMQ.

Sample custom authorization policies

• Example 1: An authorization policy that can be used to grant message publishing and message subscription permissions on a vhost

  {
      "Version":"1",
      "Statement":[
          {
              "Action":[
                  "amqp:GetInstance",
                  "amqp:GetVhost",
                  "amqp:ListVhost"
              ],
              "Resource":[
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/*"
              ],
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:GetExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:GetQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect":"Allow"
          },
          {
              "Action":[
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource":"acs:amqp:*:*:/instances/$instanceId/staticAccount/*",
              "Effect":"Allow"
          }
      ]
  }

• Example 1: An authorization policy that can be used to grant message publishing permissions

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:GetExchange",
                  "amqp:CreateQueue",
                  "amqp:GetQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicPublish",
                  "amqp:BasicAck",
                  "amqp:BasicNack"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 2: An authorization policy that can be used to grant message subscription permissions

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:GetExchange",
                  "amqp:GetQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 3: An authorization policy that can be used to grant message publishing and message subscription permissions

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/$instanceId",
                  "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:GetExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:GetQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/vhosts/$vhostName/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 4: An authorization policy that can be used to grant username and password management permissions

  {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/$instanceId/staticAccount/*"
          },
          {
              "Effect": "Allow",
              "Action": "amqp:GetInstance",
              "Resource": "acs:amqp:*:*:/instances/$instanceId"
          }
      ],
      "Version": "1"
  }