Serverless App Engine:Policies and examples

Resource ARN format

The SAE resource type you can authorize is application. The ARN format is:

acs:sae:${regionid}:${accountid}:application/${namespaceid}/${appid}

ARN examples

The following examples use the China (Shanghai) region (cn-shanghai).

A specific application in the test namespace:

acs:sae:cn-shanghai:*:application/test/0c815215-46a1-46a2-ba1e-0102a740****

All applications in the default namespace:

acs:sae:cn-shanghai:*:application/_default/*

Scenario 1: Grant namespace-level permissions

Goal: Give a RAM user read access across SAE and full write access to specific namespaces and their applications.

In this example, the RAM user is authorized to manage resources related to the default namespace, the namespace with the ID test, and the applications within those namespaces.

This policy grants full write access to the entire test namespace, including all applications in it. The read-only statement in the first row covers all resources in the region, but does not grant write access outside the test namespace. To also grant write access to the default namespace, add a second resource entry for acs:sae:cn-shanghai:*:application/_default/*.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "sae:Query*",
                "sae:List*",
                "sae:Describe*",
                "sae:*Ingress*",
                "sae:*ChangeOrder*",
                "sae:*Pipeline*"
            ],
            "Resource": "acs:sae:cn-shanghai:*:*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "sae:*"
            ],
            "Resource": [
                "acs:sae:cn-shanghai:*:application/test/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Scenario 2: Grant application-level permissions

Goal: Give a RAM user read access across SAE and full write access to specific applications only.

In this example, the RAM user can manage two specific applications:

This policy restricts write access to the two named applications only. The RAM user cannot create, update, or delete other applications in these namespaces, even though the first statement grants read access across the region.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "sae:Query*",
                "sae:List*",
                "sae:Describe*",
                "sae:*Ingress*",
                "sae:*ChangeOrder*",
                "sae:*Pipeline*"
            ],
            "Resource": "acs:sae:cn-shanghai:*:*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "sae:*"
            ],
            "Resource": [
                "acs:sae:cn-shanghai:*:application/test/0c815215-46a1-46a2-ba1e-0102a740****",
                "acs:sae:cn-shanghai:*:application/_default/e468a92b-1529-4d20-8ab1-9d1595dc****"
            ],
            "Effect": "Allow"
        }
    ]
}

Scenario 3: Grant access to associated Alibaba Cloud services

SAE applications often need to call APIs of other Alibaba Cloud services at runtime — for example, to access load balancers, compute instances, or monitoring data. Attach the corresponding system policies to the RAM user for each service they need.

For example, you can grant the RAM user read-only access to ECS (AliyunECSReadOnlyAccess), SLB (AliyunSLBReadOnlyAccess), and ARMS (AliyunARMSReadOnlyAccess).

Attach only the policies for the services your application actually uses.