Tablestore:Configure access control

Knowledge Store

Memory Store

Knowledge Store

Knowledge store resources support three authorization levels, from coarse to fine.

The resource keywords knowledgebase and subspace are fixed values. $knowledgeBaseName and $subspace come from the request fields with the same names. The authorization level is determined as follows:

• When the request does not include knowledgeBaseName (typical for list operations), authorization is evaluated at the instance level .../instance/$instanceName/*.

• When the request includes a single subspace, authorization is evaluated at the subspace level. When the request spans multiple subspaces, authorization falls back to the knowledge store level .../knowledgebase/$knowledgeBaseName.

• To allow all subspaces under a knowledge store, use the wildcard .../knowledgebase/$knowledgeBaseName/subspace/*, or grant authorization at the knowledge store level, which covers all subspaces.

Memory Store

Memory store resources support three authorization levels, from coarse to fine.

The resource keywords memorystore, appid, tenantid, agentid, and runid are fixed values. $memoryStoreName comes from the request field with the same name. $appId, $tenantId, $agentId, and $runId come from the corresponding fields in the request scope. When the request does not include memoryStoreName, authorization is evaluated at the instance level .../instance/$instanceName/*.

Scope defaults: When the request includes scope but omits one of its fields, the missing field is set to __default__ in the authorization resource. For example, if the request scope specifies only appId=app_a, the authorization resource is constructed as:

acs:ots:$region:$accountId:instance/$instanceName/memorystore/$memoryStoreName/appid/app_a/tenantid/__default__/agentid/__default__/runid/__default__

Read-only access to a specific knowledge store

The following policy allows retrieval and query operations on the knowledge store product_docs_kb. Write operations are not granted.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:DescribeKnowledgeBase",
        "ots:GetDocument",
        "ots:ListDocuments",
        "ots:ListChunks",
        "ots:Retrieve"
      ],
      "Resource": [
        "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb",
        "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb/subspace/*"
      ]
    }
  ]
}

Isolate knowledge store write permissions by subspace

The following policy allows document and chunk read and write operations on the subspace team_a of the knowledge store product_docs_kb. Other subspaces are not affected.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:AddDocuments",
        "ots:GetDocument",
        "ots:ListDocuments",
        "ots:UpdateDocument",
        "ots:DeleteDocuments",
        "ots:ListChunks",
        "ots:UpdateChunks",
        "ots:Retrieve"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb/subspace/team_a"
    }
  ]
}

Isolate memory access by application

The following policy allows read and write operations on all memories under appId=app_a in the memory store agent_mem, without restricting tenant ID, agent ID, or run ID. Memories under other app IDs are not accessible. The unrestricted tenantid, agentid, and runid fields must use * as an explicit placeholder. Do not omit them. For details, see Scope defaults above.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:AddMemories",
        "ots:SearchMemories",
        "ots:ListMemories",
        "ots:GetMemory",
        "ots:UpdateMemory",
        "ots:DeleteMemory"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/memorystore/agent_mem/appid/app_a/tenantid/*/agentid/*/runid/*"
    }
  ]
}

Full management within an instance

The following policy allows all operations on every resource under the instance myinstance.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:*KnowledgeBase",
        "ots:*Document*",
        "ots:*Chunks",
        "ots:Retrieve",
        "ots:*Memory*"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/*"
    }
  ]
}