Server Migration Center:Use tags to implement fine-grained access control

Scenarios

The scenarios in this topic are used to describe how to perform tag-based authentication.

For example, you need to grant a RAM user the permissions only on the SMC resources to which the smc:test tag is bound, as shown in the following figure.

Step 1: Create a custom policy and attach the policy to the RAM user

1. Use your Alibaba Cloud account to log on to the RAM console.
2. In the left-side navigation pane, choose Permissions > Policies.
3. On the Policies page, click Create Policy.
4. On the Create Policy page, click the JSON tab.
5. Configure the policy.
   A policy contains a set of permissions. Each policy includes a version number and one or more individual statements. Each statement includes the following elements: Effect, Action, Resource, and Condition. The Condition element is optional. For more information, see Policy elements and Policy structure and syntax.
   1. Modify the policy as needed and click Next: Edit Basic Information.
      You can configure multiple tag-based conditions for cloud resources in the Condition element of the custom policy to restrict operation permissions. The following table describes supported tag-based authentication conditions.

      Tag-based authentication condition	Description
      acs:RequestTag	Specifies that a specific tag must be included in each API request. If an API request does not include tag-related parameters, the acs:RequestTag condition cannot be used. Otherwise, the authentication fails.
      acs:ResourceTag	Specifies that a specific tag must be attached to the specified resource. If an API request does not include a resource ID, you cannot use the acs:ResourceTag condition. Otherwise, the authentication fails.

      Note When you configure a policy, you can use the acs:RequestTag or acs:ResourceTag condition based on whether you need to specify the resource ID and whether tags can be included in the API request. For more information, see Tag-based authentication of requests to different API operations.

      {
          "Statement": [
              {
                  "Action": "smc:CreateReplicationJob",
                  "Condition": {
                      "StringEquals": {
                          "acs:RequestTag/smc": "test"
                      }
                  },
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                  "Action": "smc:*",
                  "Condition": {
                      "StringEquals": {
                          "acs:ResourceTag/smc": "test"
                      }
                  },
                  "Effect": "Allow",
                  "Resource": "*"
              },
              {
                "Action": [
                      "*:TagResources",
                      "*:UntagResources"  
                   ],
                  "Effect": "Deny",
                  "Resource": "*"
              },
              {
                  "Action": [
                      "*:List*",
                      "*:Describe*"
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
              }
          ],
          "Version": "1"
      }

      The preceding policy can provide access control for the following scenarios.

      Scenario	Policy
      Scenario 1: You can create migration tasks only if the smc:test tag is attached to the tasks.	{ "Statement": [ { "Action": "smc:CreateReplicationJob", "Condition": { "StringEquals": { "acs:RequestTag/smc": "test" } }, "Effect": "Allow", "Resource": "*" }, { "Action": [ "*:List*", "*:Describe*" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }
      Scenario 2: You can modify and delete only the resources to which the smc:test tag is attached.	{ "Statement": [ { "Action": "smc:*", "Condition": { "StringEquals": { "acs:ResourceTag/smc": "test" } }, "Effect": "Allow", "Resource": "*" }, { "Action": [ "*:TagResources", "*:UntagResources" ], "Effect": "Deny", "Resource": "*" }, { "Action": [ "*:List*", "*:Describe*" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }

   2. In the Basic Information section, enter a policy name in the Name field, and then click OK.
6. Attach the policy to the RAM user.
   1. In the left-side navigation pane, choose Identities > Users.
   2. Attach the policy to the RAM user.
      For more information, see Grant permissions to a RAM user.

Step 2: Check whether the policy is in effect

1. Log on to the SMC console or OpenAPI Explorer as a RAM user.
   In this step, the SMC console is used.
2. Check whether the policy is in effect.
   Perform the following operations:

   • Create a migration task:
     • You can create a migration task for a migration source to which you attach the smc:test tag.
     • You cannot create a migration task for a migration source to which you do not attach the smc:test tag. You are prompted that you do not have the permission to create the migration task.
   • Delete a migration source:
     • You can delete a migration source to which you attach the smc:test tag.
     • You cannot delete a migration source to which you do not attach the smc:test tag. You are prompted that you do not have the permission to create the migration task.

Tag-based authentication of requests to different API operations