Tablestore:Custom RAM policy

A single API

"Action": "ots:GetRow"                    

Multiple APIs

"Action": [
"ots:PutRow",
"ots:GetRow"
]                  

All read-only APIs

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ots:BatchGet*",
        "ots:Describe*",
        "ots:Get*",
        "ots:List*",
        "ots:Consume*",
        "ots:Search",
        "ots:ComputeSplitPointsBySize"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}                

All read and write APIs

"Action": "ots:*"               

All SQL operation APIs

"Action": "ots:SQL*"

Resources accessed by management APIs

Management APIs are used primarily for instance-related operations and are called by the console and OpenAPI. The following resource definitions omit the acs:ots:[region]:[user_id]: prefix and show only the instance part.

Resources accessed by data APIs

Data APIs are used primarily for table- and row-related operations and are called by the console and software development kits (SDKs). The Action and Resource definitions for these APIs affect how users use the console. The following resource definitions omit the acs:ots:[region]:[user_id]: prefix and show only the instance and table parts.

Resources accessed by Tunnel APIs

Tunnel APIs are used primarily for channel-related operations and are called by the console and SDKs. The Action and Resource definitions for these APIs affect how users use the console. The following resource definitions omit the acs:ots:[region]:[user_id]: prefix and show only the instance and table parts.

IP address restriction

You can restrict the source IP addresses that can access Tablestore by configuring a whitelist. You can also filter by CIDR block. The following examples show typical configurations:

• Restrict multiple IP addresses.

  The following example allows access only from requests with the source IP address 10.10.XX.XX or 10.11.XX.XX.

  {
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "ots:*",
          "Resource": "acs:ots:*:*:*",
          "Condition": {
              "IpAddress": {
                  "acs:SourceIp": [
                      "10.10.XX.XX",
                      "10.11.XX.XX"
                  ]
              }
          }
      }
  ],
  "Version": "1"
  }                           

• Restrict a single IP address and a CIDR block.

  The following example allows access only from requests with the source IP address 10.10.XX.XX or from the 10.10.XX.XX/24 CIDR block.

  {
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "ots:*",
          "Resource": "acs:ots:*:*:*",
          "Condition": {
              "IpAddress": {
                  "acs:SourceIp": [
                      "10.10.XX.XX",
                      "10.10.XX.XX/24"
                  ]
              }
          }
      }
  ],
  "Version": "1"
  }                            

HTTPS access restriction

You can use a custom policy to restrict access to Tablestore through HTTPS.

The following example requires that requests to access Tablestore must be sent over HTTPS.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "Bool": {
                    "acs:SecureTransport": "true"
                }
            }
        }
    ],
    "Version": "1"
}                    

TLS version restriction

You can use a custom policy to restrict access to Tablestore through TLSv1.2 and TLSv1.3.

The following example requires that requests to access Tablestore must be sent over TLSv1.2 or TLSv1.3.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ots:*",
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringNotEquals": {
                  "ots:TLSVersion": [
                    "TLSv1.2",
                    "TLSv1.3"
                  ]
                }
            }
        }
    ]
}

MFA access restriction

You can use a custom policy to restrict access to Tablestore through MFA.

The following example requires that requests to access Tablestore must be authenticated by MFA.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "Bool": {
                    "acs:MFAPresent ": "true"
                }
            }
        }
    ],
    "Version": "1"
}                    

Access time restriction

You can use a custom policy to restrict access based on the time of a request. This lets you deny requests made after a specific point in time.

The following example allows a user to access Tablestore before 00:00:00 on January 1, 2016 (UTC+8). After this time, access is denied.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": "acs:ots:*:*:*",
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2016-01-01T00:00:00+08:00"
                }
            }
        }
    ],
    "Version": "1"
}                    

Scenario 1: Multiple authorization conditions

Allow users from the 10.10.XX.XX/24 CIDR block to perform read or write operations on all instances named online-01 and online-02, including all tables in the instances. Access is allowed only before 2016-01-01 00:00:00 and must be through HTTPS.

1. Log on to the Resource Access Management (RAM) console with your Alibaba Cloud account. By default, the RAM service is activated.

2. Create a policy.

   1. In the navigation pane on the left, choose Permission Management > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the Script Editor tab. Enter the following content in the policy document and then click OK.

      {
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "ots:*",
              "Resource": [
                  "acs:ots:*:*:instance/online-01",
                  "acs:ots:*:*:instance/online-01/table*",
                  "acs:ots:*:*:instance/online-02",
                  "acs:ots:*:*:instance/online-02/table*"
              ],
              "Condition": {
                  "IpAddress": {
                      "acs:SourceIp": [
                          "10.10.XX.XX/24"
                      ]
                  },
                  "DateLessThan": {
                      "acs:CurrentTime": "2016-01-01T00:00:00+08:00"
                  },
                  "Bool": {
                      "acs:SecureTransport": "true"
                  }
              }
          }
      ],
      "Version": "1"
      }                            

   4. In the Create Policy dialog box, enter a policy name and a description and then click OK.

3. Grant the policy to a RAM user.

   1. In the navigation pane on the left, choose Identities > Users.

   2. On the Users page, find the RAM user that you want to authorize and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, set the permission type to Custom Policy. Search for the policy that you created and select the check box next to it. The policy is added to the Selected section.

   4. Click OK.

   5. Click Close.

Scenario 2: Deny requests

For users with the source IP address 10.10.XX.XX, deny write operations on all tables in instances whose names start with online or product in the China (Beijing) region. This does not include operations on the instances.

1. Log on to the Resource Access Management (RAM) console with your Alibaba Cloud account. By default, the RAM service is activated.

2. Create a policy.

   1. In the navigation pane on the left, choose Permission Management > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the Script Editor tab. Enter the following content in the policy document and then click OK.

      {
          "Statement": [
              {
                  "Effect": "Deny",
                  "Action": [
                      "ots:Create*",
                      "ots:Insert*",
                      "ots:Put*",
                      "ots:Update*",
                      "ots:Delete*",
                      "ots:BatchWrite*"
                  ],
                  "Resource": [
                      "acs:ots:cn-beijing:*:instance/online*/table*",
                      "acs:ots:cn-beijing:*:instance/product*/table*"
                  ],
                  "Condition": {
                      "IpAddress": {
                          "acs:SourceIp": [
                              "10.10.XX.XX"
                          ]
                      }
                  }
              }
          ],
          "Version": "1"
      }                 

   4. In the Create Policy dialog box, enter a policy name and a description and then click OK.

3. Grant the policy to a RAM user.

   1. In the navigation pane on the left, choose Identities > Users.

   2. On the Users page, find the RAM user that you want to authorize and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, set the permission type to Custom Policy. Search for the policy that you created and select the check box next to it. The policy is added to the Selected section.

   4. Click Confirm New Authorization.

   5. Click Close.

Scenario 3: Restrict a RAM user to manage specified instances

Allow a RAM user to manage only specified instances, without granting permissions to view or manage other instances.

1. Log on to the Resource Access Management (RAM) console with your Alibaba Cloud account. By default, the RAM service is activated.

2. Create a policy.

   1. In the navigation pane on the left, choose Permission Management > Policies.

   2. On the Policies page, click Create Policy.

   3. On the Create Policy page, click the Script Editor tab.

   4. Enter the following policy document and then click OK.

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "ots:ListInstance",
              "ots:ListTagResources"
            ],
            "Resource": "acs:ots:*:*:instance/*"
          },
          {
            "Effect": "Allow",
            "Action": "ots:*",
            "Resource": [
              "acs:ots:*:*:instance/yourInstance",
              "acs:ots:*:*:instance/yourInstance/table*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": "cms:Query*",
            "Resource": "*"
          }
        ]
      }

      The following table describes the policy statements.

      Access policy	Description
      { "Effect": "Allow", "Action": [ "ots:ListInstance", "ots:ListTagResources" ], "Resource": "acs:ots:*:*:instance/*" }	Important This item is required to restrict a RAM user to managing specified instances in the console. The Overview page in the Tablestore console needs to request the instance list and tag list. Therefore, grant the RAM user permissions to get the instance list and tag list.
      { "Effect": "Allow", "Action": "ots:*", "Resource": [ "acs:ots:*:*:instance/yourInstance", "acs:ots:*:*:instance/yourInstance/table*" ] }	Grants the RAM user all permissions on the yourInstance instance and its data tables.
      { "Effect": "Allow", "Action": "cms:Query*", "Resource": "*" }	Grants the RAM user permissions on Cloud Monitor to view monitoring data for instances and tables.

3. In the Create Policy dialog box, enter a policy name and a description and then click OK.

4. Grant the policy to a RAM user.

   1. In the navigation pane on the left, choose Identities > Users.

   2. On the Users page, find the RAM user that you want to authorize and click Add Permissions in the Actions column.

   3. In the Add Permissions panel, set the permission type to Custom Policy. Search for the policy that you created and select the corresponding check box. The policy is then added to the Selected section.

   4. Click OK.

   5. Click Close.