Resource Management:Grant a RAM user the permissions to use Resource Center

Related resources

• For information about creating a RAM user and granting permissions, see Create a RAM user and Grant permissions to RAM users.

• For information about creating a custom policy, see Create a custom policy.

Permissions to access Resource Center

Grant permissions following the principle of least privilege. Two options are available:

• System policies

  • AliyunResourceCenterFullAccess: Grants permission to manage Resource Center.

  • AliyunResourceCenterReadOnlyAccess: Grants read-only access to Resource Center.

• Custom policies

  If the system policies do not meet your requirements, create a custom policy. For the authorization information of Resource Center, see RAM authorization.

Permissions to search for resources in Resource Center

Within a single account

• Permissions to view resources

  After a RAM user is granted the read-only permissions on a resource, the user can view the resource in Resource Center.

  For example, attach ReadOnlyAccess to view all resources in the account, or attach AliyunVPCReadOnlyAccess to view only VPC resources.

• Permissions to view resources in a resource group

  To restrict a RAM user to resources in a specific resource group, grant that user read-only access scoped to that resource group. The user will only see resources within that group in Resource Center, which helps isolate resources. For details, see Add RAM authorization.

Across accounts

Attach AliyunResourceCenterFullAccess to a RAM user in the management account of a Resource Directory. That user can then search for resources across all accounts in the directory.

Permissions to manage resource groups in Resource Center

• Permissions to create resource groups

  Grant the RAM user the ram:CreateResourceGroup permission. The user can then create resource groups in Resource Center.

• Permissions to transfer resources across resource groups

  Grant the RAM user the permissions to transfer resources across resource groups. The user can then transfer those resources across resource groups in Resource Center.

The following custom policy grants a RAM user permission to create resource groups and transfer VPCs across resource groups.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceGroup",
        "vpc:MoveResourceGroup"
      ],
      "Resource": "*"
    }
  ]
}

Permissions to manage tags in Resource Center

Attach the AliyunTagAdministratorAccess system policy to the RAM user. The user can then tag and untag resources in Resource Center.