Microservices Engine:Grant permissions on Microservices Registry resources

Scenarios

The MSE service is activated for an enterprise. The resource permissions that are required for employees vary based on their roles. The enterprise has the following requirements:

• The AccessKey pair of the Alibaba Cloud account of the enterprise must be kept confidential to ensure security. The enterprise wants to grant different permissions to users.

• Only users who are granted permissions can manage resources. Resource usage and costs are not calculated separately for each user. Bills are generated on the Alibaba Cloud account of the enterprise.

• The enterprise can revoke the permissions that are granted to RAM users and delete RAM users.

• MSE is a managed service that provides two roles: developer and O&M. Developers are responsible for configuration and service management. O&M personnel are responsible for instance, namespace, and permission management.

Usage notes

In this topic, permissions on the engine access control link shown in the following figure are configured and used. After you grant the required permissions on this link to a RAM user by using your Alibaba Cloud account, you can access MSE in Console Access mode or OpenAPI Access mode as the RAM user.

Step 1: Create a RAM user

Log on to the Resource Access Management (RAM) console and create a RAM user by using your Alibaba Cloud account.

1. Log on to the Resource Access Management (RAM) console with an Alibaba Cloud account.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. In the User Account Information section of the Create User page, configure the following parameters:

   • Logon Name: The logon name can be up to 64 characters in length, and can contain letters, digits, periods (.), hyphens (-), and underscores (_).

   • Display Name: The display name can be up to 128 characters in length.

   • (Optional) Tag: You can click the icon. In the dialog box that appears, specify the Tag Key and Tag Value parameters. You can add one or more tags to the RAM user. This way, you can manage the RAM user based on the tags.

   Note

   You can click Add User to create multiple RAM users at a time.

5. In the Access Mode section, select Console Access or OpenAPI Access.

   • Console Access: If you select Console Access, you must configure the basic settings for logon security. These settings specify whether to use a system-generated logon password or a custom logon password, whether to reset the password at the next logon, and whether to enable multi-factor authentication (MFA).

     Note

     If you select Custom Logon Password in the Console Password section, you must specify a password. The password must meet the complexity requirements that you specified on the Identities > Settings page. For more information about the password complexity requirements, see Configure a password policy for RAM users.

   • OpenAPI Access: If you select OpenAPI Access, an AccessKey pair is automatically created for the RAM user. The RAM user can call API operations or use other development tools to access Alibaba Cloud resources.

   Note

   To ensure the security of your resources, we recommend that you select Console Access for the RAM user. This way, the RAM user can no longer use an AccessKey pair to access Alibaba Cloud resources after the RAM user leaves the organization.

6. Click OK.

Step 2: Grant permissions to the RAM user

Before you use a RAM user, grant the required permissions to the RAM user:

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user that has administrative rights.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user and click Add Permissions in the Actions column.

4. In the Select Policy section of the Add Permissions panel, click the System Policy or Custom Policy tab, enter the policy that you want to add in the search box, click the displayed policy, and then click OK.

   • System policies for coarse-grained authorization

     MSE supports two system policies for coarse-grained authorization. The following table describes the policies.

     Policy	Description
     AliyunMSEFullAccess	The permissions to manage MSE. You can use a RAM user to whom this policy is attached to manage all features in the MSE console the same way you use an Alibaba Cloud account to manage MSE.
     AliyunMSEReadOnlyAccess	The read-only permissions on the resources of MSE. A RAM user to whom this policy is attached can only read all MSE resources of the Alibaba Cloud account.

     Note

     We recommend that you attach the AliyunMSEFullAccess policy to O&M personnel. This way, O&M personnel can create and delete resources. We recommend that you attach the AliyunMSEReadOnlyAccess policy to developers. This way, developers can view resources but cannot delete or create resources. If you want to manage the permissions of developers in a fine-grained manner, you can use one of the following custom policies:

   • Custom policies for fine-grained authorization

     If you want to perform fine-grained authorization, you can create a custom policy for access control.

     For more information about fine-grained authorization and configurations in Nacos registries, see Fine-grained authorization in registries. For more information about fine-grained authorization and configurations in Nacos configuration centers, see Fine-grained authorization in configuration centers.

     The following table describes the MSE permissions to help you configure custom policies.

     Action	Description	Read-only
     CreateCluster	Create an instance	No
     DeleteCluster	Delete an instance	No
     QueryClusterDetail	Query the details of an instance	Yes
     RestartCluster	Restart an instance	No
     RetryCluster	Retry an instance	No
     UpdateCluster	Update an instance	No
     CreateNacosConfig	Create a Nacos configuration	No
     DeleteNacosConfig	Delete a Nacos configuration	No
     DeleteNacosConfigs	Delete Nacos configurations at a time	No
     GetNacosConfig	View a Nacos configuration	Yes
     GetNacosHistoryConfig	View historical details of a Nacos configuration	Yes
     UpdateNacosConfig	Update a Nacos configuration	No
     UpdateNacosInstance	Update a Nacos instance	No
     DeleteNacosService	Delete a Nacos service	No
     CreateNacosService	Create a Nacos service	No
     UpdateNacosService	Update a Nacos service	No
     CreateNacosInstance	Create a Nacos instance	No
     UpdateNacosCluster	Update a Nacos cluster	No

     The permission that is described in the following table can be granted only at the account level. The permission cannot be displayed by instance.

     Action	Description	Read-only
     ListClusters	Query the list of instances	Yes

     The permissions that are described in the following table can be granted only at the instance level. Fine-grained permission display is not supported.

     Action	Description	Read-only
     ListNacosConfigs	Query the list of Nacos configurations	Yes
     ListNacosHistoryConfigs	Query the list of Nacos historical configurations	Yes
     ListAnsServices	Query the list of all services	Yes
     ListAnsServiceClusters	Query the list of clusters of a service	Yes
     ListAnsInstances	Query the list of instances of a service	Yes

   Example 1: Grant a RAM user the read and write permissions on instance mse-cn-0pp1j8om80a.

   Note

   In this example, mse-cn-0pp1j8om80a indicates the ID specified by InstanceId but not the ID specified by ClusterId.

   {
     "Statement": [
       {
         "Action": "mse:ListClusters",
         "Resource": "acs:mse:*:*:*",
         "Effect": "Allow"
       },
       {
         "Action": "mse:*",
         "Resource": "acs:mse:*:*:instance/mse-cn-0pp1j8om80a",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Example 2: Grant a RAM user the read permissions on all instances.

    {
     "Statement": [
       {
           "Action": [
           "mse:List*",
           "mse:Query*",
           "mse:Get*"
         ],
         "Resource": "acs:mse:*:*:*",
         "Effect": "Allow"
       }
     ],
     "Version": "1"
   }

   Example 3: Grant a RAM user the read and write permissions on the configurations of the namespace 3fd98c48-a709-4061-bba1-e341d79d681b in the instance mse-cn-0pp1j8om80a.

   This example shows a complex authorization scenario. The following levels of permissions are required to achieve fine-grained authorization:

   1. The permission to query instances. The permission allows the RAM user to view the instance information.

   2. The read permission on all resources in the instance. The permissions allow the RAM user to access the instance and view all resources of the instance.

   3. The permissions to create and modify the configurations in the namespace.

   {
       "Version": "1",
       "Statement": [{
               "Action": [
                   "mse:ListClusters"
               ],
               "Resource": [
                   "acs:mse:*:*:*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "mse:List*",
                   "mse:Query*",
                   "mse:Get*"
               ],
               "Resource": [
                   "acs:mse:*:*:instance/mse-cn-0pp1j8om8"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "mse:CreateNacosConfig",
                   "mse:UpdateNacosConfig"
               ],
               "Resource": [
                   "acs:mse:*:*:instance/mse-cn-0pp1j8om8/3fd98c48-a709-4061-bba1-e341d79d681b"
               ],
               "Effect": "Allow"
           }
       ]
   }

   Example 4: Grant a RAM user the read and write permissions on the configurations specified by DataId in the instance mse-cn-0pp1j8om80a.

   This example shows a complex authorization scenario. The following levels of permissions are required to achieve fine-grained authorization:

   1. The permission to query instances. The permission allows the RAM user to view the instance information.

   2. The read permission on all resources in the instance. The permission allows the RAM user to access the instance and view all resources of the instance.

   3. The permissions to create and modify the configurations in the namespace.

   4. The permissions to create and modify the configurations in the group.

   5. Resource source: acs:mse:*:*:instance/${instanceId}/${namespaceId}/${groupId}/${dataId}.

   {
       "Version": "1",
       "Statement": [{
               "Action": [
                   "mse:ListClusters"
               ],
               "Resource": [
                   "acs:mse:*:*:*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "mse:List*",
                   "mse:Query*",
                   "mse:Get*"
               ],
               "Resource": [
                   "acs:mse:*:*:instance/mse-cn-0pp1j8om8"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "mse:CreateNacosConfig",
                   "mse:UpdateNacosConfig"
               ],
               "Resource": [
   
                   "acs:mse:*:*:instance/mse-cn-0pp1j8om8/3fd98c48-a709-4061-bba1-e341d79d681b/DEFAULT_GROUP/prod.yaml"
               ],
               "Effect": "Allow"
           }
       ]
   }

   Example 5: Grant a RAM user the read and write permissions on the configurations of the specified service in the instance mse-cn-0pp1j8om80a.

   This example shows a complex authorization scenario. The following levels of permissions are required to achieve fine-grained authorization:

   1. The permission to query instances. The permission allows the RAM user to view the instance information.

   2. The read permission on all resources in the instance. The permission allows the RAM user to access the instance and view all resources of the instance.

   3. The permissions to create and modify the configurations in the namespace.

   4. The permissions to create and modify the configurations in the group.

   5. Resource source: acs:mse:*:*:instance/${instanceId}/${namespaceId}/${groupId}/${serviceName}.

      {
          "Version": "1",
          "Statement": [{
                  "Action": [
                      "mse:ListClusters"
                  ],
                  "Resource": [
                      "acs:mse:*:*:*"
                  ],
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "mse:List*",
                      "mse:Query*",
                      "mse:Get*"
                  ],
                  "Resource": [
                      "acs:mse:*:*:instance/mse-cn-0pp1j8om8"
                  ],
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "mse:CreateNacosConfig",
                      "mse:UpdateNacosConfig"
                  ],
                  "Resource": [
      
                      "acs:mse:*:*:instance/mse-cn-0pp1j8om8/3fd98c48-a709-4061-bba1-e341d79d681b/DEFAULT_GROUP/test-service"
                  ],
                  "Effect": "Allow"
              }
          ]
      }

5. In the Add Permissions panel, view the summary of the authorization information in the Authorization Result section and click Complete.

What to do next