All Products
Search

This Product

    Resource Access Management:Global Accelerator (GA)

    Document Center

    Resource Access Management:Global Accelerator (GA)

    Last Updated:Sep 30, 2021

    Resource Access Management (RAM) users or RAM roles must be granted permissions before they can access cloud resources. RAM uses policies to define permissions. A cloud service defines elements that can be used in a policy statement, such as Action, Resource, and Condition. This topic describes the permissions on Global Accelerator (GA).

    The code (RamCode) in RAM that is used to indicate GA is ga. You can grant permissions on GA at the resource level.

    Action

    The following table describes the values that you can use in the Action element of a policy statement. The values are defined by GA. The following list describes the columns in the table:

    • Action: the value that you can use in the Action element to specify the operation on a resource.

    • API: the API operation that you can call to perform the action. In most cases, only one API operation of a cloud service is required to perform an action. In some cases, multiple API operations must be called to perform an action, or an API operation can be called to perform multiple actions.

    • Access level: the access level of each action. The levels are read, write, and list.

    • Resource type: the type of the resource on which you can authorize a RAM user or a RAM role to perform the operation. Take note of the following items:

      • The required resource types are displayed in bold characters.

      • If the permissions cannot be granted at the resource level, All resources is used in the Resource type column of the action.

    • Condition key: the condition keys that are defined by a cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Policy elements.

    • Dependent action: other actions that a RAM user or a RAM role must have permissions to perform the action. To successfully call the action, a RAM user or a RAM role must have the permissions to perform the dependent action.

    Actions

    APIs

    Access level

    Resource types

    Condition keys

    Dependent actions

    ga:AddEntriesToAcl

    AddEntriesToAcl

    Write


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/{#aclId}



    N/A

    N/A

    ga:AssociateAclsWithListener

    AssociateAclsWithListener

    Write


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}



    N/A

    N/A

    ga:AssociateAdditionalCertificatesWithListener

    AssociateAdditionalCertificatesWithListener

    Write


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:AttachDdosToAccelerator

    AttachDdosToAccelerator

    WRITE


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:AttachLogStoreToEndpointGroup

    AttachLogStoreToEndpointGroup

    Write


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/*


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:BandwidthPackageAddAccelerator

    BandwidthPackageAddAccelerator

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:BandwidthPackageRemoveAccelerator

    BandwidthPackageRemoveAccelerator

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:CheckAcceleratorPrivilege

    N/A

    READ


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:CheckListenerPort

    N/A

    Read


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}





    N/A

    N/A

    ga:ConfigEndpointProbe

    ConfigEndpointProbe

    WRITE


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}



    N/A

    N/A

    ga:CreateAccelerator

    CreateAccelerator

    WRITE


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/*



    N/A

    N/A

    ga:CreateAcl

    CreateAcl

    Write


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/*



    N/A

    N/A

    ga:CreateBandwidthPackage

    CreateBandwidthPackage

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*



    N/A

    N/A

    ga:CreateEndpointGroup

    CreateEndpointGroup

    WRITE


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/*


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}







    N/A

    N/A

    ga:CreateEndpointGroups

    CreateEndpointGroups

    Write


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/*


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}







    N/A

    N/A

    ga:CreateForwardingRules

    CreateForwardingRules

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:CreateIpSets

    CreateIpSets

    WRITE


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/*


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:CreateListener

    CreateListener

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/*


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:CreateSpareIps

    CreateSpareIps

    Write


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:DeleteAccelerator

    DeleteAccelerator

    WRITE


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:DeleteAcl

    DeleteAcl

    Write


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/{#aclId}



    N/A

    N/A

    ga:DeleteBandwidthPackage

    DeleteBandwidthPackage

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}



    N/A

    N/A

    ga:DeleteEndpointGroup

    DeleteEndpointGroup

    WRITE


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}



    N/A

    N/A

    ga:DeleteEndpointGroups

    DeleteEndpointGroups

    Write


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}



    N/A

    N/A

    ga:DeleteForwardingRules

    DeleteForwardingRules

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:DeleteIpSet

    DeleteIpSet

    WRITE


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}



    N/A

    N/A

    ga:DeleteIpSets

    DeleteIpSets

    WRITE


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}



    N/A

    N/A

    ga:DeleteListener

    DeleteListener

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:DeleteSpareIps

    DeleteSpareIps

    Write


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:DescribeAccelerator

    DescribeAccelerator

    READ


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:DescribeBandwidthPackage

    DescribeBandwidthPackage

    READ


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}



    N/A

    N/A

    ga:DescribeEndpointGroup

    DescribeEndpointGroup

    READ


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}



    N/A

    N/A

    ga:DescribeIpSet

    DescribeIpSet

    READ


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}



    N/A

    N/A

    ga:DescribeListener

    DescribeListener

    READ


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:DetachDdosFromAccelerator

    DetachDdosFromAccelerator

    WRITE


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:DetachLogStoreFromEndpointGroup

    DetachLogStoreFromEndpointGroup

    Write


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/*


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}





    N/A

    N/A

    ga:DissociateAclsFromListener

    DissociateAclsFromListener

    Write


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:DissociateAdditionalCertificatesFromListener

    DissociateAdditionalCertificatesFromListener

    Write


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:GetAcl

    GetAcl

    Read


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/*



    N/A

    N/A

    ga:GetHealthStatus

    GetHealthStatus

    Read


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:GetSpareIp

    GetSpareIp

    Read


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:ListAccelerators

    ListAccelerators

    LIST


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/*



    N/A

    N/A

    ga:ListAcls

    ListAcls

    List


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/*



    N/A

    N/A

    ga:ListAvailableAccelerateAreas

    ListAvailableAccelerateAreas

    LIST


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:ListBandwidthPackages

    ListBandwidthPackages

    LIST


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*



    N/A

    N/A

    ga:ListBandwidthackages

    ListBandwidthackages

    LIST


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/*



    N/A

    N/A

    ga:ListEips

    N/A

    LIST


    Ga:eip


    acs:ga:{#regionId}:{#accountId}:eip/*



    N/A

    N/A

    ga:ListEndpointGroups

    ListEndpointGroups

    LIST


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/*



    N/A

    N/A

    ga:ListForwardingRules

    ListForwardingRules

    LIST


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:ListIpSets

    ListIpSets

    LIST


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/*



    N/A

    N/A

    ga:ListListenerCertificates

    ListListenerCertificates

    List


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:ListListeners

    ListListeners

    LIST


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/*



    N/A

    N/A

    ga:ListSpareIps

    ListSpareIps

    List


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:RemoveEntriesFromAcl

    RemoveEntriesFromAcl

    Write


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/{#aclId}



    N/A

    N/A

    ga:ReplaceBandwidthPackage

    ReplaceBandwidthPackage

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}



    N/A

    N/A

    ga:UpdateAccelerator

    UpdateAccelerator

    WRITE


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:UpdateAcceleratorConfirm

    UpdateAcceleratorConfirm

    Write


    Ga:Accelerator


    acs:ga:{#regionId}:{#accountId}:ga/{#acceleratorId}



    N/A

    N/A

    ga:UpdateAclAttribute

    UpdateAclAttribute

    Write


    Ga:Acl


    acs:ga:{#regionId}:{#accountId}:acl/{#aclId}



    N/A

    N/A

    ga:UpdateBandwidthPackage

    UpdateBandwidthPackage

    WRITE


    Ga:BandwidthPackage


    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#bandwidthPackageId}



    N/A

    N/A

    ga:UpdateEndpointGroup

    UpdateEndpointGroup

    WRITE


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}



    N/A

    N/A

    ga:UpdateEndpointGroupAttribute

    UpdateEndpointGroupAttribute

    WRITE


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointGroupId}



    N/A

    N/A

    ga:UpdateEndpointGroups

    UpdateEndpointGroups

    Write


    Ga:EndpointGroup


    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#endpointgroupId}



    N/A

    N/A

    ga:UpdateForwardingRules

    UpdateForwardingRules

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    ga:UpdateIpSet

    UpdateIpSet

    WRITE


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}



    N/A

    N/A

    ga:UpdateIpSets

    UpdateIpSets

    WRITE


    Ga:IpSet


    acs:ga:{#regionId}:{#accountId}:ipset/{#ipSetId}



    N/A

    N/A

    ga:UpdateListener

    UpdateListener

    WRITE


    Ga:Listener


    acs:ga:{#regionId}:{#accountId}:listener/{#listenerId}



    N/A

    N/A

    Resource

    The following table describes the values that you can use in the Resource element of a policy statement. The values are defined by GA.

    The Alibaba Cloud Resource Name (ARN) is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:

    • {#} indicates a variable. {#} must be replaced with an actual value. For example, {#regionId} must be replaced with the actual ID of the region where your resource resides.

    • An asterisk (*) is used as a wildcard. Examples:

      • If you specify {#resourceType}/*, all resources are specified.

      • If {#regionId} is set to *, all regions are specified.

      • If {#accountId} is set to *, all Alibaba Cloud accounts are specified.

    Resource type

    ARN

    Accelerator

    acs:ga:{#regionId}:{#accountId}:ga/{#AcceleratorId}

    BandwidthPackage

    acs:ga:{#regionId}:{#accountId}:bandwidthpackage/{#BandwidthPackageId}

    EndpointGroup

    acs:ga:{#regionId}:{#accountId}:endpointgroup/{#EndpointGroupId}

    Listener

    acs:ga:{#regionId}:{#accountId}:listener/{#ListenerId}

    IpSet

    acs:ga:{#regionId}:{#accountId}:ipset/{#IpSetId}

    Acl

    acs:ga:{#regionId}:{#accountId}:acl/{#AclId}

    Condition

    GA does not define service-specific condition keys. For more information about common condition keys that are defined by Alibaba Cloud, see Policy elements.