Create a RAM user and grant permissions to the RAM user - Microservices Engine

Microservices Engine (MSE) uses Resource Access Management (RAM) to control access to the Microservices Governance Center. Instead of sharing your Alibaba Cloud account credentials, create RAM users and grant each one only the permissions they need. You can grant permissions in the console or by calling OpenAPI operations.

Scenarios

In a typical enterprise, team members have different responsibilities and need different levels of access:

Role	Access level	Example
O&M engineer	Full access	Create, configure, and delete MSE resources
Developer	Rule configuration	Configure application rules
Application owner	Scoped full access	Manage one application, view all others
Tester	Namespace-scoped	Manage all applications in the test namespace only

With RAM, you can:

Grant each team member only the permissions their role requires.
Keep all resource costs under the enterprise account -- no separate billing for RAM users.
Revoke permissions or delete a RAM user at any time.

Step 1: Create a RAM user

Create a RAM user for each team member who needs access. For instructions, see Create a RAM user.

Step 2: Grant permissions to the RAM user

Before a RAM user can work with MSE, you must grant the required permissions.

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the RAM user and click Add Permissions in the Actions column. To grant the same permissions to multiple users at once, select the users and click Add Permissions at the bottom of the page.
In the Add Permissions panel, select an access policy type. In the text box, enter a keyword for the policy that you want to add. Click the policy in the search results to add it to the Selected Policy list on the right, and then click OK.
Confirm the authorization result and click Close.

System policies and custom policies

RAM provides two types of access policies: system policies for broad access control, and custom policies for fine-grained restrictions.

System policies (coarse-grained)

MSE provides two built-in system policies:

Policy name	Description	Recommended for
AliyunMSEFullAccess	Full permissions for all MSE operations. This policy is equivalent to the permissions of an Alibaba Cloud account.	O&M engineers who create and manage resources
AliyunMSEReadOnlyAccess	Read-only access to the MSE console	Developers who only need to view configurations and metrics

Custom policies (fine-grained)

When system policies are too broad, create custom policies to restrict access to specific namespaces, applications, or API actions. For instructions, see Create a custom policy.

The following sections provide ready-to-use policy templates for common scenarios.

Custom policy examples

Resource identifier format

MSE policies use the following resource ARN patterns:

Scope	Resource ARN
All MSE resources	`acs:mse:::*`
A specific namespace	`acs:mse:::namespace/${ns}`
All applications in a namespace	`acs:mse:::namespace/${ns}/application/*`
A specific application	`acs:mse:::namespace/${ns}/application/${appName}`

Replace ${ns} with the namespace ID and ${appName} with the application name.

Read-only access to all applications

Grant this policy to team members who need to monitor application status and metrics but must not modify any configurations.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mse:QueryNamespace",
        "mse:GetApplicationListWithMetircs",
        "mse:ListNamespaces",
        "mse:GetEventFilterOptions",
        "mse:ListEventRecords",
        "mse:GetEventDetail",
        "mse:FetchLogConfig",
        "mse:QueryBusinessLocations",
        "mse:GetApplicationInstanceList",
        "mse:listGrayTag",
        "mse:QueryServiceDetailWithMetrics",
        "mse:GetEventDetail",
        "mse:ListEventsPage",
        "mse:ListEventsByType",
        "mse:GetApplicationTagList"
      ],
      "Resource": "acs:mse:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": "mse:GetApplicationList",
      "Resource": "acs:mse:*:*:namespace/${ns}"
    }
  ]
}

Full access to a specific application

Grant this policy to application owners who manage their own application but must not modify others. The policy combines full permissions for one application with read-only access to everything else.

The policy has three statements:

Statement 1: Full permissions (mse:*) scoped to the target application.
Statements 2--3: Read-only access to all applications for console navigation.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "mse:*",
      "Resource": "acs:mse:*:*:namespace/${ns}/application/${appName}"
    },
    {
      "Effect": "Allow",
      "Action": [
        "mse:QueryNamespace",
        "mse:GetApplicationListWithMetircs",
        "mse:ListNamespaces",
        "mse:GetEventFilterOptions",
        "mse:ListEventRecords",
        "mse:GetEventDetail",
        "mse:FetchLogConfig",
        "mse:QueryBusinessLocations",
        "mse:GetApplicationInstanceList",
        "mse:listGrayTag",
        "mse:QueryServiceDetailWithMetrics",
        "mse:GetEventDetail",
        "mse:ListEventsPage",
        "mse:ListEventsByType",
        "mse:GetApplicationTagList"
      ],
      "Resource": "acs:mse:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": "mse:GetApplicationList",
      "Resource": "acs:mse:*:*:namespace/${ns}"
    }
  ]
}

Full access to a specific namespace

Grant this policy to testers who manage all applications in a test environment but must not access production resources.

The policy has three statements:

Statement 1: Full permissions for all applications in the target namespace.
Statement 2: Read-only access to console-wide resources, including application lists, traffic lane configurations, auth policies, and service lists.
Statement 3: Namespace-level permissions for application listing and traffic lane management.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "mse:*",
      "Resource": "acs:mse:*:*:namespace/${ns}/application/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "mse:QueryNamespace",
        "mse:GetApplicationListWithMetircs",
        "mse:ListNamespaces",
        "mse:GetEventFilterOptions",
        "mse:ListEventRecords",
        "mse:GetEventDetail",
        "mse:FetchLogConfig",
        "mse:QueryBusinessLocations",
        "mse:GetApplicationInstanceList",
        "mse:listGrayTag",
        "mse:QueryServiceDetailWithMetrics",
        "mse:GetEventDetail",
        "mse:ListEventsPage",
        "mse:ListEventsByType",
        "mse:GetApplicationTagList",
        "mse:QueryAllSwimmingLaneGroup",
        "mse:QueryAllSwimmingLane",
        "mse:ListAppBySwimmingLaneGroupTags",
        "mse:ListAppBySwimmingLaneGroupTag",
        "mse:QuerySwimmingLaneById",
        "mse:GetTagsBySwimmingLaneGroupId",
        "mse:ListSwimmingLaneGateway",
        "mse:ListSwimmingLaneGatewayRoute",
        "mse:ListAuthPolicy",
        "mse:GetServiceList",
        "mse:GetServiceListPage"
      ],
      "Resource": "acs:mse:*:*:*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "mse:GetApplicationList",
        "mse:CreateOrUpdateSwimmingLaneGroup",
        "mse:CreateOrUpdateSwimmingLane",
        "mse:DeleteSwimmingLaneGroup",
        "mse:DeleteSwimmingLaneGroup",
        "mse:DeleteSwimmingLane"
      ],
      "Resource": "acs:mse:*:*:namespace/${ns}"
    }
  ]
}

Permissions for quick integration

A RAM user who runs the quick integration wizard needs the following minimum permissions to discover clusters, install agents, and manage namespaces.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mse:CheckServiceLinkRole",
        "mse:GetUserStatus",
        "mse:QueryNamespace",
        "mse:ListCsKubernetesClusters",
        "mse:CheckEciRole",
        "mse:ListCsKubernetesClusters",
        "mse:CheckCsRole",
        "mse:GetClusterOnePilotInfo",
        "mse:GetGovernanceKubernetesCluster",
        "mse:InstallOnePilot",
        "mse:CreateNamespace",
        "mse:ModifyGovernanceKubernetesCluster",
        "mse:QueryGovernanceKubernetesCluster",
        "mse:ListNamespaces"
      ],
      "Resource": "*"
    }
  ]
}

Full read and write access to all governed resources

Warning

This policy grants unrestricted access to every MSE governance resource. Use it only for permission testing. Do not apply it in production.

The following policy lists every MSE governance API action. In production, replace Action with mse:* and Resource with acs:mse:*:*:* for the same effect with less maintenance.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "mse:AddAuthPolicy",
        "mse:AddServiceTimeConfig",
        "mse:AddWhiteScreenRule",
        "mse:ApplyGlobalReadWriteSplitRule",
        "mse:ApplyReadWriteSplitRule",
        "mse:ApplyTagPolicies",
        "mse:BatchUpdateRulesEnable",
        "mse:BindSentinelBlockFallbackDefinition",
        "mse:CheckCanaryPolicy",
        "mse:CheckCsRole",
        "mse:CheckEciRole",
        "mse:CheckRole",
        "mse:CheckServiceLinkedRoleForDeleting",
        "mse:CheckUserReadinessConfig",
        "mse:CheckXTraceServiceStatus",
        "mse:CloneSentinelRuleFromAhas",
        "mse:CreateApplication",
        "mse:CreateCircuitBreakerRule",
        "mse:CreateFlowRule",
        "mse:CreateGovernanceKubernetesCluster",
        "mse:CreateHotParamRule",
        "mse:CreateIsolationRule",
        "mse:CreateLicenseKey",
        "mse:CreateMseServiceApplication",
        "mse:CreateNamespace",
        "mse:CreateOrUpdateEmptyPushSetting",
        "mse:CreateOrUpdateSwimmingLane",
        "mse:CreateOrUpdateSwimmingLaneGroup",
        "mse:CreateSentinelBlockFallbackDefinition",
        "mse:CreateWebFlowRule",
        "mse:DeleteCircuitBreakerRules",
        "mse:DeleteFaultInjectionRule",
        "mse:DeleteFlowRules",
        "mse:DeleteGovernanceKubernetesCluster",
        "mse:DeleteHotParamRules",
        "mse:DeleteIsolationRules",
        "mse:DeleteNamespace",
        "mse:DeleteSentinelBlockFallbackDefinition",
        "mse:DeleteSwimmingLane",
        "mse:DeleteSwimmingLaneGroup",
        "mse:DeleteWebFlowRules",
        "mse:DeleteWhiteScreenRule",
        "mse:DescribeAppAgentStatus",
        "mse:FetchAppLogConfig",
        "mse:FetchDataSourceConfig",
        "mse:FetchGlobalReadWriteSplitRules",
        "mse:FetchLogConfig",
        "mse:FetchLosslessRuleList",
        "mse:FetchReadWriteSplitRules",
        "mse:FetchRoutePolicyList",
        "mse:FetchWhiteScreenRule",
        "mse:GenerateAgentLogSts",
        "mse:GetAppMessageQueueRoute",
        "mse:GetApplicationDetail",
        "mse:GetApplicationInstanceList",
        "mse:GetApplicationInstancesWithMetircs",
        "mse:GetApplicationList",
        "mse:GetApplicationListWithMetircs",
        "mse:GetApplicationTagList",
        "mse:GetAuthPolicyInfo",
        "mse:GetCanaryStatus",
        "mse:GetClusterOnePilotInfo",
        "mse:GetDubboServicePageWithMetrics",
        "mse:GetDubboTestMethod",
        "mse:GetGovernanceKubernetesCluster",
        "mse:GetGovernanceKubernetesClusterList",
        "mse:GetLicenseKey",
        "mse:GetLocalityDistributionMetrics",
        "mse:GetLocalityRule",
        "mse:GetLosslessRuleByApp",
        "mse:GetMockRuleByConsumerAppId",
        "mse:GetMockRuleById",
        "mse:GetMockRuleByProviderAppId",
        "mse:GetNetworkInfo",
        "mse:GetOpenSergoInfoByClusterId",
        "mse:GetOutlierPolicyInfo",
        "mse:GetOverview ",
        "mse:GetResourcePackageStatus",
        "mse:GetResourcePackageStatusWithVersion",
        "mse:GetRetryRule",
        "mse:GetRoutePolicy",
        "mse:GetServiceConsumersPage",
        "mse:GetServiceDetail",
        "mse:GetServiceList",
        "mse:GetServiceListPage",
        "mse:GetServiceMethodPage",
        "mse:GetServiceMethodPageWithMetrics",
        "mse:GetServiceProvidersPage",
        "mse:GetSpringCloudTestMethod",
        "mse:GetTagKey",
        "mse:GetTagVal",
        "mse:GetTagsBySwimmingLaneGroupId",
        "mse:GetTrace",
        "mse:GetUserStatus",
        "mse:InstallOnePilot",
        "mse:InvokeDubboTestMethod",
        "mse:InvokeIstioTestMethod",
        "mse:InvokeSpringCloudTestMethod",
        "mse:ListAdaptiveOverloadProtectionConfig",
        "mse:ListAppBySwimmingLaneGroupTag",
        "mse:ListAppBySwimmingLaneGroupTags",
        "mse:ListAppResource",
        "mse:ListAppResourceWithMetrics",
        "mse:ListApplicationTagInstancese",
        "mse:ListApplicationsWithTagRules",
        "mse:ListAuthPolicy",
        "mse:ListCircuitBreakerRules",
        "mse:ListConnectedSwimmingLaneGroup",
        "mse:ListCsKubernetesClusters",
        "mse:ListDefaultCircuitBreakerRules",
        "mse:ListEventOfReource",
        "mse:ListEventRecords",
        "mse:ListEventsByType",
        "mse:ListEventsPage",
        "mse:ListEventsPageByType",
        "mse:ListFlowRules",
        "mse:ListHotParamRules",
        "mse:ListIpOrHosts",
        "mse:ListIsolationRules",
        "mse:ListKubernetesNamespace",
        "mse:ListLogSpanServices",
        "mse:ListMscEventRecords",
        "mse:ListNamespaces",
        "mse:ListProtectedAppResourceWithMetrics",
        "mse:ListResourceWhiteListConfigs",
        "mse:ListResources",
        "mse:ListSentinelBlockFallbackDefinitions",
        "mse:ListSpanNames",
        "mse:ListSwimPathPercent",
        "mse:ListSwimmingLaneGatewayRoute",
        "mse:ListWebFlowRules",
        "mse:ModifyAdaptiveOverloadProtectionConfig",
        "mse:ModifyGovernanceKubernetesCluster",
        "mse:ModifyLosslessRule",
        "mse:ModifyNamespace",
        "mse:OpenXTraceService",
        "mse:QueryAhasUserStatus",
        "mse:QueryAllSwimmingLane",
        "mse:QueryAllSwimmingLaneGroup",
        "mse:QueryAppDataSourceList",
        "mse:QueryAppListMetrics",
        "mse:QueryAppMethodMetrics",
        "mse:QueryAppMethodMetricsWithSentinel",
        "mse:QueryAppRPCMacMetrics",
        "mse:QueryAppResourceMetrics",
        "mse:QueryAppResourceMetricsByInstance",
        "mse:QueryAppSummaryMetricsOverview",
        "mse:QueryAppSummaryMetricsOverviewWithSentinel",
        "mse:QueryAppSystemMetricsOfGroup",
        "mse:QueryAppSystemMetricsOfGroupByInstance",
        "mse:QueryAppTopNMacs",
        "mse:QueryDatabaseRoute",
        "mse:QueryEmptyPushSetting",
        "mse:QueryEventOverview",
        "mse:QueryGovernanceKubernetesCluster",
        "mse:QueryMetricsAveragedByInstance",
        "mse:QueryNamespace",
        "mse:QueryNginxIngressGateway",
        "mse:QueryResourceTopN",
        "mse:QueryServiceDetailWithMetrics",
        "mse:QuerySwimmingLaneById",
        "mse:RemoveApplication",
        "mse:RemoveApplications",
        "mse:RemoveAuthPolicy",
        "mse:RemoveOutlierPolicy",
        "mse:RemoveRoutePolicy",
        "mse:ReportAgentInfoForm",
        "mse:ReportAgentStartupStatus",
        "mse:ReportAppProfile",
        "mse:ReportEventBatchForm",
        "mse:ReportMetadataForm",
        "mse:ReportOneAgentInfo",
        "mse:ReportOnePilotInfo",
        "mse:ReportSpanStatInfoForm",
        "mse:RevertApplicationRoutePolicy",
        "mse:SearchTraces",
        "mse:TagResources",
        "mse:UnbindSentinelBlockFallbackDefinition",
        "mse:UpdateAppLogConfig",
        "mse:UpdateAuthPolicy",
        "mse:UpdateCircuitBreakerRule",
        "mse:UpdateCircuitBreakerRulesStatus",
        "mse:UpdateDatabaseRoute",
        "mse:UpdateDefaultCircuitBreakerRule",
        "mse:UpdateFlowRule",
        "mse:UpdateFlowRulesStatus",
        "mse:UpdateGovernanceServiceSubscribe",
        "mse:UpdateHotParamRule",
        "mse:UpdateHotParamRulesStatus",
        "mse:UpdateInstanceRegisterStatus",
        "mse:UpdateIsolationRule",
        "mse:UpdateIsolationRulesStatus",
        "mse:UpdateLocalityRule",
        "mse:UpdateLogConfig",
        "mse:UpdateMessageQueueRoute",
        "mse:UpdateOpenSergoStatusByClusterId",
        "mse:UpdateResourceWhiteListConfig",
        "mse:UpdateSentinelBlockFallbackDefinition",
        "mse:UpdateWebFlowRule",
        "mse:UpdateWebFlowRulesStatus",
        "mse:UpdateWhiteScreenRule",
        "mse:listGrayTag"
      ],
      "Resource": "acs:mse:*:*:*"
    }
  ]
}