If the system policies of Microservices Engine (MSE) cannot meet your requirements, you can create custom policies to implement the principle of least privilege. Custom policies allow you to implement fine-grained control over permissions and improve resource access security. This topic describes how to use custom policies for MSE and provides examples of custom policies.
What is a custom policy?
Resource Access Management (RAM) policies are classified into system policies and custom policies. You can manage custom policies based on your business requirements.
After you create a custom policy, you must attach the policy to a RAM user, RAM user group, or RAM role. This way, the permissions that are specified in the policy can be granted to the principal.
You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, before you can delete the RAM policy you must detach the RAM policy from the principal.
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.
References
Create a custom policy on the Visual editor tab
Log on to the RAM console as a RAM user who has administrative rights.
In the left-side navigation pane, choose .
On the Policies page, click Create Policy.
On the Create Policy page, click the Visual editor tab.
Configure the policy.
In the Effect section, select Allow or Deny.
In the Service section, select an Alibaba Cloud service.
NoteThe Alibaba Cloud services that you can select are displayed in the Service section.
In the Actions section, select All action(s) or Select action(s).
The system displays the actions that can be configured based on the Alibaba Cloud service you select in the Service section. If you select Select action(s), you must select actions.
In the Resources section, select All Resources or Specified resource(s).
The system displays the resources that can be configured based on the actions you select in the Action section. If you select Specified resource(s), you must click Add resource to configure one or more Alibaba Cloud Resource Names (ARNs). You can also click Match all to select all resources for each action that you select.
NoteThe resource ARNs that are required for an action are tagged with Required. We strongly recommend that you configure the resource ARNs that are tagged with Required. This ensures that the custom policy takes effect as expected.
In the Condition section, click Add Condition to configure conditions.
Conditions include Alibaba Cloud common conditions and service-specific conditions. The system displays the conditions that can be configured based on the Alibaba Cloud service and the actions that you select. You need to only select a condition key and set the Operator and Value parameters.
Click Add statement and repeat the preceding steps to configure multiple custom policy statements.
Check and optimize the content of the custom policy.
Basic optimization
The system automatically optimizes the policy statement. The system performs the following operations during basic optimization:
Delete unnecessary conditions.
Deletes unnecessary arrays.
(Optional) Advanced optimization
To perform advanced optimization, hover over Optional: advanced optimize and click Execute. Advanced optimization includes the following tasks:
Split resources or conditions that are incompatible with actions.
Narrows down resources.
Deduplicates or merges policy statements.
Enter the policy Name and Remarks.
Click OK.
Examples of common custom policies for Microservices Registry
Grant a user read-only permission on services in specific instances.
{ "Version": "1", "Statement": [ { "Action": [ "mse:QueryNacosNaming" ], "Resource": [ "acs:mse:*:*:instance/${instanceId1}", "acs:mse:*:*:instance/${instanceId2}" ], "Effect": "Allow" } ] }Grant a user read and update permissions on services in specific instances.
{ "Version": "1", "Statement": [ { "Action": [ "mse:QueryNacosNaming", "mse:UpdateNacosNaming" ], "Resource": [ "acs:mse:*:*:instance/${instanceId1}", "acs:mse:*:*:instance/${instanceId2}" ], "Effect": "Allow" } ] }Note${instanceId1}and${instanceId2}represent the IDs of the registry instances.Grant a user read-only permission on services in a specific namespace of an instance.
{ "Statement": [ { "Effect": "Allow", "Action": "mse:QueryNacosNaming", "Resource": "acs:mse:*:*:instance/${instance_id}/${namespaceId}" } ], "Version": "1" }Grant a user read and update permissions for services in the
${group}group in a specific namespace of an instance.{ "Statement": [ { "Effect": "Allow", "Action": [ "mse:QueryNacosNaming", "mse:UpdateNacosNaming" ], "Resource": "acs:mse:*:*:instance/${instance_id}/${namespaceId}/${group}" } ], "Version": "1" }Grant a user read-only permission for the
${serviceName}service in the${group}group.{ "Statement": [ { "Effect": "Allow", "Action": "mse:QueryNacosNaming", "Resource": "acs:mse:*:*:instance/${instance_id}/${namespaceId}/${group}/naming/${serviceName}" } ], "Version": "1" }Grant a user read and update permissions for the
${serviceName}service in the${group}group.{ "Statement": [ { "Effect": "Allow", "Action": [ "mse:QueryNacosNaming", "mse:UpdateNacosNaming" ], "Resource": "acs:mse:*:*:instance/${instance_id}/${namespaceId}/${group}/naming/${serviceName}" } ], "Version": "1" }
Examples of common custom policies for Microservices Governance
Read-only access to all applications
Grant this policy to team members who need to monitor application status and metrics but must not modify any configurations.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"mse:QueryNamespace",
"mse:GetApplicationListWithMetircs",
"mse:ListNamespaces",
"mse:GetEventFilterOptions",
"mse:ListEventRecords",
"mse:GetEventDetail",
"mse:FetchLogConfig",
"mse:QueryBusinessLocations",
"mse:GetApplicationInstanceList",
"mse:listGrayTag",
"mse:QueryServiceDetailWithMetrics",
"mse:GetEventDetail",
"mse:ListEventsPage",
"mse:ListEventsByType",
"mse:GetApplicationTagList"
],
"Resource": "acs:mse:*:*:*"
},
{
"Effect": "Allow",
"Action": "mse:GetApplicationList",
"Resource": "acs:mse:*:*:namespace/${ns}"
}
]
}Full access to a specific application
Grant this policy to application owners who manage their own application but must not modify others. The policy combines full permissions for one application with read-only access to everything else.
The policy has three statements:
Statement 1: Full permissions (
mse:*) scoped to the target application.Statements 2--3: Read-only access to all applications for console navigation.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "mse:*",
"Resource": "acs:mse:*:*:namespace/${ns}/application/${appName}"
},
{
"Effect": "Allow",
"Action": [
"mse:QueryNamespace",
"mse:GetApplicationListWithMetircs",
"mse:ListNamespaces",
"mse:GetEventFilterOptions",
"mse:ListEventRecords",
"mse:GetEventDetail",
"mse:FetchLogConfig",
"mse:QueryBusinessLocations",
"mse:GetApplicationInstanceList",
"mse:listGrayTag",
"mse:QueryServiceDetailWithMetrics",
"mse:GetEventDetail",
"mse:ListEventsPage",
"mse:ListEventsByType",
"mse:GetApplicationTagList"
],
"Resource": "acs:mse:*:*:*"
},
{
"Effect": "Allow",
"Action": "mse:GetApplicationList",
"Resource": "acs:mse:*:*:namespace/${ns}"
}
]
}Full access to a specific namespace
Grant this policy to testers who manage all applications in a test environment but must not access production resources.
The policy has three statements:
Statement 1: Full permissions for all applications in the target namespace.
Statement 2: Read-only access to console-wide resources, including application lists, traffic lane configurations, auth policies, and service lists.
Statement 3: Namespace-level permissions for application listing and traffic lane management.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "mse:*",
"Resource": "acs:mse:*:*:namespace/${ns}/application/*"
},
{
"Effect": "Allow",
"Action": [
"mse:QueryNamespace",
"mse:GetApplicationListWithMetircs",
"mse:ListNamespaces",
"mse:GetEventFilterOptions",
"mse:ListEventRecords",
"mse:GetEventDetail",
"mse:FetchLogConfig",
"mse:QueryBusinessLocations",
"mse:GetApplicationInstanceList",
"mse:listGrayTag",
"mse:QueryServiceDetailWithMetrics",
"mse:GetEventDetail",
"mse:ListEventsPage",
"mse:ListEventsByType",
"mse:GetApplicationTagList",
"mse:QueryAllSwimmingLaneGroup",
"mse:QueryAllSwimmingLane",
"mse:ListAppBySwimmingLaneGroupTags",
"mse:ListAppBySwimmingLaneGroupTag",
"mse:QuerySwimmingLaneById",
"mse:GetTagsBySwimmingLaneGroupId",
"mse:ListSwimmingLaneGateway",
"mse:ListSwimmingLaneGatewayRoute",
"mse:ListAuthPolicy",
"mse:GetServiceList",
"mse:GetServiceListPage"
],
"Resource": "acs:mse:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"mse:GetApplicationList",
"mse:CreateOrUpdateSwimmingLaneGroup",
"mse:CreateOrUpdateSwimmingLane",
"mse:DeleteSwimmingLaneGroup",
"mse:DeleteSwimmingLaneGroup",
"mse:DeleteSwimmingLane"
],
"Resource": "acs:mse:*:*:namespace/${ns}"
}
]
}Policy examples for Cloud-native Gateway
Grant a user or role the permissions on all resources
If you want to grant a RAM user or role the operation permissions on all cloud-native gateways, you can attach the following system policies to the RAM user or role:
Read-only permission: AliyunMSEReadOnlyAccess
Read and write permissions: AliyunMSEFullAccess
Grant a user or role the permissions on specific gateway resources
If you want to grant a RAM user or role the operation permissions on a specific gateway, you can grant resource-level permissions to the RAM user or role.
Example 1: Grant a RAM user the read-only permission on the cloud-native gateway named gw-8090caa2a3ab447a8bc5fdf3********.
{ "Version": "1", "Statement": [ { "Action": [ "mse:Query*", "mse:List*", "mse:Get*", "mse:Select*", "mse:Pull*", "mse:GatewayBlackWhite*", "mse:GatewayHealthCheckList", "mse:GatewayQueryMonitor", "mse:UploadWasmFile" ], "Resource": "acs:mse:*:*:instance/gw-8090caa2a3ab447a8bc5fdf3********", "Effect": "Allow" }, { "Action": [ "mse:QueryDefaultAlertStatus", "mse:ListGatewayZone", "mse:ListUpgradableGatewayVersions", "mse:ListTagResources", "mse:ListGatewayIngressMigrateTask", "mse:ListEventRecords", "mse:GetEventFilterOptions", "mse:GetEventDetail", "mse:GetGatewaySelection", "mse:GetGatewayAlarms", "mse:GetGatewayMigrateNamespacedServices", "mse:GetGatewayIngressMigrateTaskDetail", "mse:GetPluginGuide", "mse:GetRegExpCheck", "mse:GetRegExpTest", "mse:CheckPluginLua" ], "Resource": "acs:mse:*:*:*", "Effect": "Allow" }, { "Action": [ "log:DescribeService", "log:ListProject", "log:GetProductDataCollection" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "arms:SearchContactGroup" ], "Resource": "*", "Effect": "Allow" } ] }Example 2: Grant a RAM user the read and write permissions on a cloud-native gateway named gw-8090caa2a3ab447a8bc5fdf3********.
{ "Version": "1", "Statement": [ { "Action": [ "mse:*" ], "Resource": "acs:mse:*:*:instance/gw-8090caa2a3ab447a8bc5fdf3********", "Effect": "Allow" }, { "Action": [ "mse:QueryDefaultAlertStatus", "mse:CreateDefaultAlert", "mse:ListGatewayZone", "mse:ListUpgradableGatewayVersions", "mse:ListEventRecords", "mse:GetEventFilterOptions", "mse:GetEventDetail", "mse:GetGatewaySelection", "mse:GetGatewayAlarms", "mse:GetGatewayMigrateNamespacedServices", "mse:GetPluginGuide", "mse:GetRegExpCheck", "mse:GetRegExpTest", "mse:CheckPluginLua", "mse:*TagResources", "mse:*CustomPlugin", "mse:*GatewayIngressMigrateTask*" ], "Resource": "acs:mse:*:*:*", "Effect": "Allow" }, { "Action": [ "log:DescribeService", "log:ListProject", "log:GetProductDataCollection", "log:OpenProductDataCollection" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "arms:SearchContactGroup" ], "Resource": "*", "Effect": "Allow" } ] }
Usage notes
The preceding permissions can only allow you to perform required operations in the MSE console. Specific capabilities of cloud-native gateways depend on other cloud services. You can configure permissions for your RAM user or role based on the permission configuration documentation of other cloud services. This allows your RAM user or role to use all the features of cloud-native gateways. The following table describes the mappings between the cloud services on which cloud-native gateways depend and related cloud-native gateway modules.
Alibaba Cloud service | Cloud-native gateway module | References |
Simple Log Service |
| |
ARMS |
|