To manage resource groups with a RAM identity such as a RAM user or RAM role, you must attach the required permission policies. The following examples use a RAM user.
Overview
The required permissions fall into three categories. Grant all three if the RAM user needs full access, or follow the principle of least privilege and grant only what is needed.
-
Manage resource groups: Create, delete, modify, and view resource groups.
-
View resources in a resource group: View resources in a resource group on the Resources tab of the resource group details page.
-
Manage resource group-scoped authorization: Manage RAM authorizations on the Permissions tab of the resource group details page, such as viewing, granting, and revoking permissions.
Manage resource groups
Resource group management permissions
Attach the following policy to grant a RAM user full permissions to manage resource groups, including creating, deleting, modifying, and viewing them. Typically assigned to resource group administrators.
The Action element includes ram:TagResources, ram:UntagResources, and ram:ListTagResources. A RAM identity with this policy can add, remove, and view tags for resources such as resource groups, RAM users, and RAM roles. Grant these permissions with caution.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:*ResourceGroup*",
"ram:*AssociatedTransfer*",
"ram:LookupResourceGroupEvents",
"resourcemanager:*ResourceGroup*",
"resourcemanager:*AutoGrouping*",
"ram:TagResources",
"ram:UntagResources",
"ram:ListTagResources"
],
"Resource": "*"
}
]
}Resource group read-only permissions
To grant a RAM user read-only permissions for resource groups, attach the following policy.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:GetResourceGroup*",
"ram:ListResourceGroup*",
"ram:ListAssociatedTransferSetting",
"ram:LookupResourceGroupEvents",
"resourcemanager:GetResourceGroup*",
"resourcemanager:ListResourceGroup*",
"resourcemanager:GetAutoGrouping*",
"resourcemanager:ListAutoGrouping*",
"ram:ListTagResources"
],
"Resource": "*"
}
]
}View resources in a resource group
For a RAM user to view resources on the Resources tab of a resource group's details page, also grant read-only permission for the target resources.
-
Example 1: To let a RAM user view only VPC resources in the ProjectA resource group, grant AliyunVPCReadOnlyAccess at the ProjectA resource group scope.
-
Example 2: To let a RAM user view all resources across all resource groups, grant ReadOnlyAccess at the account level.
Manage resource group-scoped authorization
To allow a RAM user to manage RAM authorizations (such as viewing, granting, and revoking authorizations) on the Permissions tab of a resource group's details page, attach the following policy. Intended for RAM permission administrators.
The Action element includes ram:AttachPolicy, ram:DetachPolicy, and ram:ListPolicyAttachments. When Resource is set to *, the authorized RAM identity can view, revoke, and grant permissions to any RAM identity at any resource group scope or the account scope. These are high-risk operations. Grant with caution.
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ram:AttachPolicy",
"ram:DetachPolicy",
"ram:ListPolicyAttachments",
"ram:ListPolicies",
"ram:ListUsers",
"ram:ListGroups",
"ram:ListRoles"
],
"Resource": "*"
}
]
}