Generate a policy for a template with GenerateTemplatePolicy - Resource Orchestration Service - Alibaba Cloud - Resource Orchestration Service

Generates the policy information required by a specified template.

Operation description

If the policies required by the template include Enterprise Distributed Application Service (EDAS), you must log on to your Alibaba Cloud account and upgrade the RAM permissions for the Resource Access Management (RAM) users that require authorization.

This topic provides an example of how to generate access policies for a template whose ID is 5ecd1e10-b0e9-4389-a565-e4c15efc****.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

ros:GenerateTemplatePolicy

list

Template

acs:ros:{#regionId}:{#accountId}:template/{#TemplateId}

None

Request parameters

Parameter	Type	Required	Description	Example
TemplateURL	string	No	The URL of the file that contains the template body. The URL must point to a template located on a web server (HTTP or HTTPS) or in an OSS bucket (for example, oss://ros/template/demo or oss://ros/template/demo?RegionId=cn-hangzhou). The maximum size of the template is 524,288 bytes. Note If the OSS region is not specified, the region specified by the RegionId parameter is used by default. You can specify only one of the following parameters: TemplateBody, TemplateURL, and TemplateId. The maximum length of the URL is 1,024 bytes.	oss://ros/template/demo
TemplateBody	string	No	The structure of the template body. The length is 1 to 524,288 bytes. If the length is large, we recommend that you use HTTP POST with the body parameter to send the parameter in the request body to avoid request failures caused by an excessively long URL. You can specify only one of the following parameters: TemplateBody, TemplateURL, and TemplateId.	{"ROSTemplateFormatVersion":"2015-09-01"}
TemplateId	string	No	The template ID. Shared templates and private templates are supported. You can specify only one of the following parameters: TemplateBody, TemplateURL, and TemplateId.	5ecd1e10-b0e9-4389-a565-e4c15efc****
TemplateVersion	string	No	The template version. This parameter takes effect only when TemplateId is specified.	v1
OperationTypes	array	No	The operation types for which policy information is generated.
	string	No	The operation types for which policy information is generated. Valid values: CreateStack: calls CreateStack to create a stack. UpdateStack: calls UpdateStack to update a stack. DeleteStack: calls DeleteStack to delete a stack. DetectStackDrift: calls DetectStackDrift to perform drift detection on a stack. ListStackOperationRisks: calls ListStackOperationRisks with the OperationType parameter set to DeleteStack to list the risks of deleting a stack. GetTemplateEstimateCost: calls GetTemplateEstimateCost to query the estimated cost of creating resources in the template. GetTemplateParameterConstraints: calls GetTemplateParameterConstraints to query the values of template parameters. ImportResourcesToStack: calls CreateChangeSet with ChangeSetType set resource import resource import resources into a stack. SignalResource: sends a signal to a stack. Note Default value: all valid values.	["CreateStack"]
Parameters	array<object>	No	The input parameters. The input parameters define the parameters that must be specified when you create a stack by using this template. These parameters are used to specify the details of each stack creation, such as the username, password, and environment-specific ECS instance types.
	object	No	The input parameters. The input parameters define the parameters that must be specified when you create a stack by using this template. These parameters are used to specify the details of each stack creation, such as the username, password, and environment-specific ECS instance types.
ParameterKey	string	No	The name of the parameter. If you do not specify the name and value of a parameter defined in the template, Resource Orchestration Service (ROS) uses the default value specified in the template. The maximum value of N is 200. Example values: Parameters.1.ParameterKey: `Name`. Parameters.2.ParameterKey: `Netmode`. Note Parameters is optional. If you specify Parameters, you must specify both Parameters.N.ParameterKey and Parameters.N.ParameterValue.	Domain
ParameterValue	string	No	The value of the parameter defined in the template. The maximum value of N is 200. Note Parameters is optional. If you specify Parameters, Parameters.N.ParameterValue is required.	PostPaid
GenerateOptions	array	No	GenerateOptions controls how the template access policy is generated. This parameter is of the list type and allows you to specify whether to resolve template parameters and the permission scope of the generated policy: ResolveParameters indicates that the policy is generated after resolving conditions and resources based on the specified Parameters or parameter default values. IgnoreParameters indicates that the policy is generated without resolving parameters, using the legacy logic. MandatoryPolicy indicates that only the minimum permissions required for template execution are generated. FullPolicy indicates that a full access policy is generated. ResolveParameters and IgnoreParameters are mutually exclusive. MandatoryPolicy and FullPolicy are mutually exclusive. MandatoryPolicy must be used together with ResolveParameters. If this parameter is not specified, ResolveParameters + FullPolicy is used by default when Parameters is specified. Otherwise, IgnoreParameters + FullPolicy is used by default.
	string	No	The template access policy generation option. For valid values and combination constraints, see the GenerateOptions parameter description.	MandatoryPolicy

For more information about common request parameters, see Common parameters.

Response elements

Element	Type	Description	Example
	object	The root node.
Policy	object	The access policy information.
Version	string	The version number.	1
Statement	array<object>	The specific access policy information.
	array<object>	The policy statement.
Effect	string	The authorization effect. Valid values: Allow: Allowed. Deny: Denied.	Allow
Resource	string	The specific object that is authorized. An asterisk (*) indicates all resources.	*
Action	array	The operation on the specific resource.
	string	The operation on the specific resource.	[ "ram:PassRole" ]
Condition	object	The condition for the authorization to take effect.	{ "StringEquals": { "acs:Service": "fc.aliyuncs.com" } }
RequestId	string	The request ID.	B288A0BE-D927-4888-B0F7-B35EF84B6E6
PolicyFunctions	array<object>	The policy function configurations.
	array<object>	The first element in the policy function list.
Action	string	The action in the policy function.	accept
RequirementLevel	string	The requirement level of the policy function.
ActionPolicyFunctions	array<object>	The policy function list.
	array<object>	The first sub-policy function of the root policy function.
ResourceType	string	The resource type associated with the policy function.	stack
LogicalResourceId	string	The logical resource ID of the policy function.	SLBLoadBalancer_00001
Functions	array<object>	The policy function list.
	object	The first function in the policy function list.
Function	string	The function in the policy function.	notContains
RequirementLevel	string	The requirement level of the function.
OperationType	string	The operation type.	CreateStack
RelatedProperties	array	The related property list.
	string	The first element in the related property list.

Examples

Success response

JSON format

{
  "Policy": {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Resource": "*",
        "Action": [
          "[\n    \"ram:PassRole\"\n]"
        ],
        "Condition": {
          "StringEquals": {
            "acs:Service": "fc.aliyuncs.com"
          }
        }
      }
    ]
  },
  "RequestId": "B288A0BE-D927-4888-B0F7-B35EF84B6E6",
  "PolicyFunctions": [
    {
      "Action": "accept",
      "RequirementLevel": "",
      "ActionPolicyFunctions": [
        {
          "ResourceType": "stack",
          "LogicalResourceId": "SLBLoadBalancer_00001",
          "Functions": [
            {
              "Function": "notContains",
              "RequirementLevel": "",
              "OperationType": "CreateStack",
              "RelatedProperties": [
                ""
              ]
            }
          ]
        }
      ]
    }
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.