ALIYUN::RAM::Group resource type reference - Resource Orchestration Service - Alibaba Cloud - Resource Orchestration Service

Syntax

{
  "Type": "ALIYUN::RAM::Group",
  "Properties": {
    "GroupName": String,
    "Comments": String,
    "Policies": List,
    "PolicyAttachments": Map,
    "DeletionForce": Boolean,
    "IgnoreExisting": Boolean
  }
}

Properties

Property	Type	Required	Editable	Description	Constraints
GroupName	String	Yes	No	The name of the user group.	The name must be 1 to 64 characters in length and can contain letters, digits, and hyphens (-).
Comments	String	No	Yes	Remarks	The value must be 1 to 128 characters in length.
DeletionForce	Boolean	No	Yes	Whether to forcibly detach the policies from the RAM user group.	Valid values: true: Forcibly detaches the policies. false (default): Does not forcibly detach the policies.
IgnoreExisting	Boolean	No	No	Whether to ignore existing groups.	Valid values: true: Resource Orchestration Service (ROS) does not check for uniqueness. If a group with the same name exists, the group creation process is ignored. If the group was not created by ROS, it is ignored during the update and delete phases. false: ROS performs a uniqueness check. If a group with the same name exists, an error is reported during creation.
Policies	List	No	Yes	The access policies.	For more information, see Policies properties.
PolicyAttachments	Map	No	Yes	The names of the system and custom policies to attach.	For more information, see PolicyAttachments properties.

Policies syntax

"Policies": [
  {
    "Description": String,
    "PolicyName": String,
    "PolicyDocument": Map,
    "IgnoreExisting": Boolean
  }
]

Policies properties

Property	Type	Required	Editable	Description	Constraints
PolicyDocument	Map	Yes	Yes	The policy document.	The document can be up to 2,048 characters in length. For information about the elements and examples of an access policy, see Basic elements of an access policy and Overview of the access policy example library. For more information, see PolicyDocument properties.
PolicyName	String	Yes	No	The name of the access policy.	The name must be 1 to 128 characters in length and can contain letters, digits, and hyphens (-).
Description	String	No	No	The description.	The description must be 1 to 1,024 characters in length.
IgnoreExisting	Boolean	No	No	Whether to ignore existing policies.	Valid values: true: ROS does not check for uniqueness. If a policy with the same name exists, the policy creation process is ignored. If the policy was not created by ROS, it is ignored during the update and delete phases. false: ROS performs a uniqueness check. If a policy with the same name exists, an error is reported during creation.

PolicyDocument syntax

"PolicyDocument": {
  "Version": String,
  "Statement": List
}

PolicyDocument properties

Property	Type	Required	Editable	Description	Constraints
Statement	List	Yes	No	The rules of the access policy.	For more information, see Statement properties.
Version	String	Yes	No	The version of the access policy.	None

Statement syntax

"Statement": [
  {
    "Condition": Map,
    "Action": List,
    "Resource": List,
    "Effect": String,
    "NotAction": List
  }
]

Statement properties

Property	Type	Required	Editable	Description	Constraints
Action	List	No	No	The operations that the access policy applies to.	None
Condition	Map	No	No	The conditions under which the authorization takes effect.	None
Effect	String	No	No	The authorization effect.	Valid values: Allow: The action is allowed. Deny: Rejects the request.
NotAction	List	No	No	The specified operations that are excluded when Allow or Deny takes effect.	None
Resource	List	No	No	The resources that the access policy applies to.	None

PolicyAttachments syntax

"PolicyAttachments": {
  "System": List,
  "Custom": List
}

PolicyAttachments properties

Property	Type	Required	Editable	Description	Constraints
Custom	List	No	Yes	A list of custom policy names.	The maximum number of policies is 5.
System	List	No	Yes	A list of system policy names.	The maximum number of policies is 20.

Return values

Fn::GetAtt

GroupName: The name of the RAM user group.

Examples

Scenario 1: Create a RAM group with system policies for team read-only access control.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并附加系统权限策略，实现团队只读访问控制。
  en: Create a RAM group with system policies for team read-only access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: >-
        RAM用户组名称，1~64个字符，
        可包含英文字母、数字和短横线。
      en: >-
        RAM group name, 1-64 characters,
        may contain letters, digits and hyphens.
    Default: readonly-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明，1~128个字符。
      en: Comments for the group, 1-128 characters.
    Default: 只读访问权限组，用于运维巡检和审计
    MaxLength: 128
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      PolicyAttachments:
        System:
          - AliyunECSReadOnlyAccess
          - AliyunOSSReadOnlyAccess
          - AliyunRDSReadOnlyAccess
          - AliyunVPCReadOnlyAccess
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并附加系统权限策略，实现团队只读访问控制。",
    "en": "Create a RAM group with system policies for team read-only access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称，1~64个字符，可包含英文字母、数字和短横线。",
        "en": "RAM group name, 1-64 characters, may contain letters, digits and hyphens."
      },
      "Default": "readonly-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明，1~128个字符。",
        "en": "Comments for the group, 1-128 characters."
      },
      "Default": "只读访问权限组，用于运维巡检和审计",
      "MaxLength": 128
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "PolicyAttachments": {
          "System": [
            "AliyunECSReadOnlyAccess",
            "AliyunOSSReadOnlyAccess",
            "AliyunRDSReadOnlyAccess",
            "AliyunVPCReadOnlyAccess"
          ]
        }
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}

Scenario 2: Create a RAM group with inline custom policies for fine-grained access control.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并配置内联自定义策略，限定特定资源的操作权限。
  en: Create a RAM group with inline custom policies for fine-grained access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: RAM用户组名称。
      en: The RAM group name.
    Default: dev-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明。
      en: Comments for the group.
    Default: 开发团队权限组，拥有指定资源的读写权限
    MaxLength: 128
  OssBucketName:
    Type: String
    Label:
      zh-cn: OSS存储桶名称
      en: OSS Bucket Name
    Description:
      zh-cn: 允许开发团队访问的OSS存储桶名称。
      en: The OSS bucket name that the dev team is allowed to access.
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      Policies:
        - PolicyName:
            Fn::Sub: ${GroupName}-oss-policy
          Description: 允许对指定OSS存储桶进行读写操作
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - oss:GetObject
                  - oss:PutObject
                  - oss:DeleteObject
                  - oss:ListObjects
                  - oss:GetBucket
                Resource:
                  - Fn::Sub: acs:oss:*:*:${OssBucketName}
                  - Fn::Sub: acs:oss:*:*:${OssBucketName}/*
        - PolicyName:
            Fn::Sub: ${GroupName}-ecs-policy
          Description: 允许查看和管理ECS实例
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - ecs:DescribeInstances
                  - ecs:DescribeInstanceStatus
                  - ecs:StartInstance
                  - ecs:StopInstance
                  - ecs:RebootInstance
                Resource:
                  - '*'
              - Effect: Deny
                Action:
                  - ecs:DeleteInstance
                Resource:
                  - '*'
      DeletionForce: true
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并配置内联自定义策略，限定特定资源的操作权限。",
    "en": "Create a RAM group with inline custom policies for fine-grained access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称。",
        "en": "The RAM group name."
      },
      "Default": "dev-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明。",
        "en": "Comments for the group."
      },
      "Default": "开发团队权限组，拥有指定资源的读写权限",
      "MaxLength": 128
    },
    "OssBucketName": {
      "Type": "String",
      "Label": {
        "zh-cn": "OSS存储桶名称",
        "en": "OSS Bucket Name"
      },
      "Description": {
        "zh-cn": "允许开发团队访问的OSS存储桶名称。",
        "en": "The OSS bucket name that the dev team is allowed to access."
      }
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "Policies": [
          {
            "PolicyName": {
              "Fn::Sub": "${GroupName}-oss-policy"
            },
            "Description": "允许对指定OSS存储桶进行读写操作",
            "PolicyDocument": {
              "Version": "1",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "oss:GetObject",
                    "oss:PutObject",
                    "oss:DeleteObject",
                    "oss:ListObjects",
                    "oss:GetBucket"
                  ],
                  "Resource": [
                    {
                      "Fn::Sub": "acs:oss:*:*:${OssBucketName}"
                    },
                    {
                      "Fn::Sub": "acs:oss:*:*:${OssBucketName}/*"
                    }
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": {
              "Fn::Sub": "${GroupName}-ecs-policy"
            },
            "Description": "允许查看和管理ECS实例",
            "PolicyDocument": {
              "Version": "1",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecs:DescribeInstances",
                    "ecs:DescribeInstanceStatus",
                    "ecs:StartInstance",
                    "ecs:StopInstance",
                    "ecs:RebootInstance"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Effect": "Deny",
                  "Action": [
                    "ecs:DeleteInstance"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ],
        "DeletionForce": true
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}

Scenario 3: Create a RAM group with both system and custom policy attachments for hybrid access control.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并同时附加系统策略和自定义策略，实现混合权限管理。
  en: Create a RAM group with both system and custom policy attachments for hybrid access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: RAM用户组名称，1~64个字符。
      en: RAM group name, 1-64 characters.
    Default: ops-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明。
      en: Comments for the group.
    Default: 运维团队权限组，拥有系统和自定义混合权限
    MaxLength: 128
  SystemPolicies:
    Type: Json
    Label:
      zh-cn: 系统策略列表
      en: System Policies
    Description:
      zh-cn: >-
        要附加的系统预置策略名称列表，最多20条。
        常用策略：AliyunECSFullAccess、AliyunOSSFullAccess、
        AliyunRDSFullAccess、AliyunVPCFullAccess、AliyunSLBFullAccess。
      en: >-
        List of system policy names to attach, up to 20.
    Default:
      - AliyunECSFullAccess
      - AliyunVPCFullAccess
      - AliyunSLBFullAccess
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: true
        Label:
          zh-cn: 系统策略名称
          en: System Policy Name
  CustomPolicies:
    Type: Json
    Label:
      zh-cn: 自定义策略列表
      en: Custom Policies
    Description:
      zh-cn: >-
        要附加的自定义策略名称列表，最多5条。
        需要提前在RAM控制台创建好自定义策略。
      en: >-
        List of custom policy names to attach, up to 5.
        Custom policies must be created in RAM console first.
    Default: []
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: false
        Label:
          zh-cn: 自定义策略名称
          en: Custom Policy Name
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      PolicyAttachments:
        System:
          Ref: SystemPolicies
        Custom:
          Ref: CustomPolicies
      DeletionForce: true
      IgnoreExisting: true
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并同时附加系统策略和自定义策略，实现混合权限管理。",
    "en": "Create a RAM group with both system and custom policy attachments for hybrid access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称，1~64个字符。",
        "en": "RAM group name, 1-64 characters."
      },
      "Default": "ops-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明。",
        "en": "Comments for the group."
      },
      "Default": "运维团队权限组，拥有系统和自定义混合权限",
      "MaxLength": 128
    },
    "SystemPolicies": {
      "Type": "Json",
      "Label": {
        "zh-cn": "系统策略列表",
        "en": "System Policies"
      },
      "Description": {
        "zh-cn": "要附加的系统预置策略名称列表，最多20条。常用策略：AliyunECSFullAccess、AliyunOSSFullAccess、AliyunRDSFullAccess、AliyunVPCFullAccess、AliyunSLBFullAccess。",
        "en": "List of system policy names to attach, up to 20."
      },
      "Default": [
        "AliyunECSFullAccess",
        "AliyunVPCFullAccess",
        "AliyunSLBFullAccess"
      ],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": true,
          "Label": {
            "zh-cn": "系统策略名称",
            "en": "System Policy Name"
          }
        }
      }
    },
    "CustomPolicies": {
      "Type": "Json",
      "Label": {
        "zh-cn": "自定义策略列表",
        "en": "Custom Policies"
      },
      "Description": {
        "zh-cn": "要附加的自定义策略名称列表，最多5条。需要提前在RAM控制台创建好自定义策略。",
        "en": "List of custom policy names to attach, up to 5. Custom policies must be created in RAM console first."
      },
      "Default": [],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": false,
          "Label": {
            "zh-cn": "自定义策略名称",
            "en": "Custom Policy Name"
          }
        }
      }
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "PolicyAttachments": {
          "System": {
            "Ref": "SystemPolicies"
          },
          "Custom": {
            "Ref": "CustomPolicies"
          }
        },
        "DeletionForce": true,
        "IgnoreExisting": true
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}