RAM policies

RAM policies

In RAM, policies are a set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. For more information, see Policy structure and syntax.

In RAM, a policy is a resource entity. Message Queue for RabbitMQ supports the following types of policies:

• System policies: System policies are created and updated by Alibaba Cloud. You cannot modify the system policies. These policies apply to coarse-grained control of RAM user permissions.
• Custom policies: You can create, update, and delete custom policies and maintain policy versions. These policies apply to fine-grained control of RAM user permissions.

System policies

The following table describes the system policies supported by Message Queue for RabbitMQ.

Examples of system policies

The system policy AliyunAMQPFullAccess is used as an example. The RAM user who has been attached with this policy has the permissions equivalent to those of the Alibaba Cloud account. This means that the RAM user has all permissions to manage resources and receive and send messages by using an SDK. Policy content:

{
    "Version": "1",
    "Statement": [
        {
            "Action": "amqp:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Custom policies

This section describes the custom policies supported by Message Queue for RabbitMQ.

Examples of custom policies

• Example 1: Message publishing

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***",
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:GetExchange",
                  "amqp:CreateQueue",
                  "amqp:GetQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicPublish",
                  "amqp:BasicAck",
                  "amqp:BasicNack"
              ],
              "Resource": "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 2: Message subscription

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***",
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:CreateExchange",
                  "amqp:GetExchange",
                  "amqp:GetQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 3: Message publishing and subscription

  {
      "Version": "1",
      "Statement": [
          {
              "Action": [
                  "amqp:GetInstance",
                  "amqp:GetVhost"
              ],
              "Resource": [
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***",
                  "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "amqp:ListExchange",
                  "amqp:CreateExchange",
                  "amqp:DeleteExchange",
                  "amqp:GetExchange",
                  "amqp:ListQueue",
                  "amqp:DeleteQueue",
                  "amqp:GetQueue",
                  "amqp:CreateQueue",
                  "amqp:BasicRecover",
                  "amqp:BasicCancel",
                  "amqp:BasicPublish",
                  "amqp:BasicConsume",
                  "amqp:BasicAck",
                  "amqp:BasicNack",
                  "amqp:BasicReject",
                  "amqp:QueuePurge",
                  "amqp:BasicGet"
              ],
              "Resource": "acs:amqp:*:*:/instances/amqp-cn-09k1o***/vhosts/testVhost/*",
              "Effect": "Allow"
          }
      ]
  }

• Example 4: Management of usernames and passwords

  {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "amqp:ListStaticAccounts",
                  "amqp:FetchStaticAccount",
                  "amqp:DeleteStaticAccount"
              ],
              "Resource": "acs:amqp:*:*:/instances/amqp-cn-09k1o***/staticAccount/*"
          },
          {
              "Effect": "Allow",
              "Action": "amqp:GetInstance",
              "Resource": "acs:amqp:*:*:/instances/amqp-cn-09k1o***"
          }
      ],
      "Version": "1"
  }