Serverless App Engine:SAE permission assistant

Step 1: Create a policy in the SAE console

1. In the left-side navigation pane of the SAE console, select Enterprise Features > Permission Management. Then, on the Permission Assistant page, click Create Policy.

2. In the Create Policy panel's Policy Configuration wizard, complete the following operations and click Next.

   1. Enter the Policy Name and Description.

      Configuration Item	Description
      Policy Name	The custom name of the policy. It must start with a letter and can contain numbers, letters, underscores (_), and hyphens (-), not exceeding 36 characters.
      Description	The description of the policy.

   2. Click Add Policy Statement. In the Add Policy Statement panel, complete the following operations and click Confirm.

      Configuration Item	Description
      Authorized Resource	Select resource dimensions from the drop-down list. Region: Supports single selection. Namespace: Supports single selection. Application or Task: Supports multiple selections.
      Authorized Operation	Select the permissions to be granted in the Optional Permissions check box and view the selected permissions in the Selected Permissions preview box. The limitations of authorized operations are as follows: The Search Operation text box supports fuzzy search and is case-sensitive. The Selected Permissions check box displays the System Default Read Permissions by default. Read and write operations are interactive. Therefore, when selecting read and write permissions, the system automatically determines and selects the relevant permissions for you. For example, when you select Application > Publish Change under write permissions, the system automatically selects the related read permissions.

   You can view the added policy statements in the Policy Configuration wizard and perform operations such as View Permissions, Clone, Edit, or Delete as needed.

   

   Note

   • If you need to set permissions for resources in multiple namespaces, add multiple policy statements.

   • If you need to copy existing policy statements or edit and add new ones based on them, click Clone to enter the Clone Policy Statement panel, edit as needed, and add policy statements.

3. In the Policy Preview wizard, review the generated policy statements and click Complete.

   You can click One-click Copy. The copied RAM authorization statement will be used in Step 2: Create a Custom Policy in the RAM Console.

   The console panel will return to the Permission Assistant page, where you can view the newly created policy and perform operations such as View Permissions, One-click Copy RAM Authorization Statement, Edit, or Delete as needed.

   Important

   • The policies created by the SAE permission assistant apply solely to SAE resources and are limited to a maximum of 20 statements.

   • When SAE introduces new features, you must regenerate the RAM policy statements to ensure that RAM users under the existing policy have permissions for these new features.

Step 2: Create a custom policy in the RAM console

When creating a custom policy in the RAM console, modify the policy document to include the policy statements generated in Step 1: Create a Policy in the SAE Console.

1. Log on to the RAM console as a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

   

4. On the Create Policy page, click the JSON tab.

   

5. Enter the policy content.

   For more information about the syntax and structure of RAM policies, see Policy structure and syntax.

6. Click Optional advanced optimize in the upper part. In the Optional advanced optimize message, click Perform to optimize the policy.

   The system performs the following operations during the advanced optimization:

   • Split resources or conditions that are incompatible with actions.

   • Narrow down resources.

   • Deduplicate or merge policy statements.

7. On the Create Policy page, click OK.

8. In the Create Policy dialog box, configure the Name and Description parameters and click OK.

Step 3: Grant permissions to RAM users in the RAM console

After successfully creating a custom policy, grant permissions to the RAM users who require them in the RAM console. This section describes how to grant permissions to a RAM user on the Users page. For more methods, see Grant Permissions to RAM Users.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Grant Permission panel, grant permissions to the RAM user.

   1. Configure the Resource Scope parameter.

      • Account: The authorization takes effect on the current Alibaba Cloud account.

      • ResourceGroup: The authorization takes effect on a specific resource group.

        Important

        If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

   2. Configure the Principal parameter.

      The principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.

   3. Configure the Policy parameter.

      A policy contains a set of permissions. Policies can be classified into system policies and custom policies. You can select multiple policies at a time.

      • System policies: policies that are created by Alibaba Cloud. You can use but cannot modify these policies. Version updates of the policies are maintained by Alibaba Cloud. For more information, see Services that work with RAM.

        Note

        The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. We recommend that you do not grant unnecessary permissions by attaching high-risk policies.

      • Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.

   4. Click Grant permissions.

5. Click Close.