RAM identities (RAM users and RAM roles) require specific permission policies to manage resource groups. This topic uses a RAM user as an example.
Overview
The required permissions fall into three categories. Grant all three for full access, or follow the principle of least privilege and grant only the permissions that are needed.
-
Manage resource groups: Create, delete, modify, and view resource groups.
-
View resources in a resource group: View resources in a resource group on the Resources tab of the resource group details page.
On the resource group details page, click the Resources tab to view the list of resources in the resource group, including the resource ID/name, region, resource type, and tags. You can also click Transfer In Resources to transfer existing resources into the current resource group.
-
Manage resource group-scoped authorization: Manage RAM authorizations on the Permissions tab of the resource group details page, such as viewing, granting, and revoking permissions.
Manage resource groups
Resource group management permissions
The following policy grants full permissions to manage resource groups, including creating, deleting, modifying, and viewing them. This policy is typically assigned to resource group administrators.
The Action element includes ram:TagResources, ram:UntagResources, and ram:ListTagResources. A RAM identity with this policy can add, remove, and view tags for resources such as resource groups, RAM users, and RAM roles. Grant these permissions with caution.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:*ResourceGroup*",
"ram:*AssociatedTransfer*",
"ram:LookupResourceGroupEvents",
"resourcemanager:*ResourceGroup*",
"resourcemanager:*AutoGrouping*",
"ram:TagResources",
"ram:UntagResources",
"ram:ListTagResources"
],
"Resource": "*"
}
]
}Resource group read-only permissions
To grant a RAM user read-only permissions for resource groups, attach the following policy.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:GetResourceGroup*",
"ram:ListResourceGroup*",
"ram:ListAssociatedTransferSetting",
"ram:LookupResourceGroupEvents",
"resourcemanager:GetResourceGroup*",
"resourcemanager:ListResourceGroup*",
"resourcemanager:GetAutoGrouping*",
"resourcemanager:ListAutoGrouping*",
"ram:ListTagResources"
],
"Resource": "*"
}
]
}View resources in a resource group
For a RAM user to view resources on the Resources tab of a resource group's details page, you must also grant read-only permission for the target resources.
-
Example 1: To let a RAM user view only VPC resources in the ProjectA resource group, grant AliyunVPCReadOnlyAccess at the ProjectA resource group scope.
-
Example 2: To let a RAM user view all resources across all resource groups, grant ReadOnlyAccess at the account level.
Manage resource group-scoped authorization
The following policy allows a RAM user to manage RAM authorizations (such as viewing, granting, and revoking permissions) on the Permissions tab of a resource group's details page. This policy is typically assigned to RAM permission administrators.
The Action element includes ram:AttachPolicy, ram:DetachPolicy, and ram:ListPolicyAttachments. When Resource is set to *, the authorized RAM identity can view, revoke, and grant permissions to any RAM identity at any resource group scope or the account scope. These are high-risk operations. Grant with caution.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:AttachPolicy",
"ram:DetachPolicy",
"ram:ListPolicyAttachments",
"ram:ListPolicies",
"ram:ListUsers",
"ram:ListGroups",
"ram:ListRoles"
],
"Resource": "*"
}
]
}