Resource Access Management:Policy elements

Effect

The Effect element is required and specifies whether the statement results in an Allow or a Deny.

Example:

"Effect": "Allow"

Action and NotAction

The Action or NotAction element is required and specifies the API operations governed by the statement. The value is a string or an array of strings in the format ram-code:action-name (such as ecs:DescribeInstances). For more information about each service's RAM code, see Services that work with RAM.

Action lists the operations that the policy allows or denies. NotAction matches every operation except for those listed. Using NotAction can result in granting broad permissions, so it should be used with caution.

You can use wildcards (*) to specify multiple actions. For example, ecs:Describe* matches all ECS operations that start with "Describe".

Example:

"Action": [
  "oss:ListBuckets",
  "ecs:Describe*",
  "rds:Describe*"
]

Example: Allows all actions except for those in RAM.

{
	"Effect": "Allow",
	"NotAction": "ram:*",
	"Resource": "*"
}

Resource

The Resource element is required and specifies the object or objects that the policy statement affects. Resources are identified by their Alibaba Cloud Resource Name (ARN).

The ARN format is acs:<ram-code>:<region>:<account-id>:<relative-id>.

• acs: Stands for Alibaba Cloud Service.

• product: The service's RAM code (such as ecs, oss, and ram). For more information, see Services that work with RAM.

• region: The region where the resource is located. Use an asterisk (*) for global resources. For more information, see Regions and zones.

• account-id: The ID of the Alibaba Cloud account that owns the resource.

• relative-id: The path-like identifier for the specific resource within the service (such as instance/i-12345 or mybucket/dir1/object1.jpg).

Example:

"Resource": [
  "acs:ecs:*:*:instance/inst-001",
  "acs:ecs:*:*:instance/inst-002",
  "acs:oss:*:*:mybucket",
  "acs:oss:*:*:mybucket/*"
]

Condition

The optional Condition element lets you specify conditions for when a policy is in effect. A condition block contains one or more conditions, and each condition consists of an operator, a key, and a value.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ecs:*",
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "acs:SourceIp": [
            "203.0.113.2"
          ]
        },
        "Bool": {
          "acs:MFAPresent": [
            "true"
          ]
        }
      }
    }
  ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "IpAddress": {
                    "acs:SourceIp": [
                        "203.0.113.2"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "acs:MFAPresent": [
                        "true"
                    ]
                }
            }
        }
    ]
}

Principal

The Principal element is used in resource-based policies (such as an OSS bucket policy and a RAM role trust policy) to specify the entity (the principal) that is allowed or denied access to a resource or to assume a role.

You can specify the following types of principals:

• Alibaba Cloud account: Specifies all principals within an account using the root ARN.

  Format: acs:ram::<account-id>:root

• RAM user: Specifies a specific RAM user by its ARN. Wildcards are not supported in the user name.

  Format: acs:ram::<account-id>:user/<user-name>

  Important

  When you save a trust policy, RAM may convert the user ARN to a stable, internal ID. This ID becomes visible if the original RAM user is deleted, preventing the policy from breaking. This ensures that even if a user is deleted and a new user is created with the same name, the new user does not automatically inherit the permissions.

• RAM role: Specifies a specific RAM role by its ARN. Wildcards are not supported in the role name.

  Format: acs:ram::<account-id>:role/<role-name>

  Important

  When you save a trust policy, RAM may convert the role ARN to a stable, internal ID. This ID becomes visible if the original RAM role is deleted, preventing the policy from breaking. This ensures that even if a role is deleted and a new role is created with the same name, the new role does not automatically inherit the permissions.

• Alibaba Cloud service: Specifies a service principal that can assume a role on your behalf.

  Format: <service-name>.aliyuncs.com

• Identity provider (IdP): Specifies a federated principal from a SAML or OIDC provider by its ARN.

  SAML format: acs:ram::<account-id>:saml-provider/<provider-name>

  OIDC format: acs:ram::<account-id>:oidc-provider/<provider-name>

Example of a trust policy allowing two RAM accounts and a service to assume a role:

"Principal": {
  "RAM": [
    "acs:ram::123456789012****:root",
    "acs:ram::987654321098****:root"
  ],
  "Service": "ecs.aliyuncs.com"
}