Tablestore:Configure access permissions

Knowledge Storage

Memory Storage

Knowledge Storage

Knowledge Storage resources support three authorization levels, from coarsest to finest as follows.

The resource keywords knowledgebase and subspace are fixed values. $knowledgeBaseName and $subspace are taken from the fields of the same name in the request. The authorization level is determined by the following rules:

• When the request does not carry knowledgeBaseName (typically a list operation), authorization is enforced at the instance level .../instance/$instanceName/*.

• When the request carries a single subspace, authorization is enforced at the subspace level. When a single request involves multiple subspaces, authorization falls back to the parent knowledge base level .../knowledgebase/$knowledgeBaseName.

• To allow access to all subspaces under a knowledge base, use the wildcard .../knowledgebase/$knowledgeBaseName/subspace/*, or authorize at the knowledge base level (which covers all subspaces).

Memory Storage

Memory Storage resources support three authorization levels, from coarsest to finest as follows.

The resource keywords memorystore, appid, tenantid, agentid, and runid are fixed values. $memoryStoreName is taken from the field of the same name in the request, while $appId, $tenantId, $agentId, and $runId are taken from the corresponding fields of the request scope. When the request does not carry memoryStoreName, authorization is enforced at the instance level .../instance/$instanceName/*.

Scope default values

When the request carries scope but omits a given field, that field defaults to __default__ in the authorization resource. For example, if the request scope specifies only appId=app_a, the authorization resource is constructed as:

acs:ots:$region:$accountId:instance/$instanceName/memorystore/$memoryStoreName/appid/app_a/tenantid/__default__/agentid/__default__/runid/__default__

When you leave certain scope dimensions unrestricted in a RAM policy, you must use the wildcard * (for example, .../agentid/*/runid/*) as an explicit placeholder. Do not omit the corresponding level, otherwise it will match __default__ rather than all values.

Read-only access to a specific knowledge base

The following policy allows retrieval and queries against the knowledge base product_docs_kb and denies all write operations.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:DescribeKnowledgeBase",
        "ots:GetDocument",
        "ots:ListDocuments",
        "ots:ListChunks",
        "ots:Retrieve"
      ],
      "Resource": [
        "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb",
        "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb/subspace/*"
      ]
    }
  ]
}

Isolating write access by subspace

The following policy allows read and write operations on documents and chunks within the team_a subspace of the knowledge base product_docs_kb. Other subspaces are unaffected.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:AddDocuments",
        "ots:GetDocument",
        "ots:ListDocuments",
        "ots:UpdateDocument",
        "ots:DeleteDocuments",
        "ots:ListChunks",
        "ots:UpdateChunks",
        "ots:Retrieve"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/knowledgebase/product_docs_kb/subspace/team_a"
    }
  ]
}

Isolating memory access by application

The following policy allows read and write access to all memories with appId=app_a in the memory store agent_mem (regardless of tenant, agent, and run). Memories of other appIds are not accessible.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:AddMemories",
        "ots:SearchMemories",
        "ots:ListMemories",
        "ots:GetMemory",
        "ots:UpdateMemory",
        "ots:DeleteMemory"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/memorystore/agent_mem/appid/app_a/tenantid/*/agentid/*/runid/*"
    }
  ]
}

The unrestricted tenantid, agentid, and runid dimensions must be explicitly opened with * and cannot be omitted. For the reason, see the scope default values note above.

Full administration within an instance

The following policy allows all operations on all related resources under the instance myinstance.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ots:*KnowledgeBase",
        "ots:*Document*",
        "ots:*Chunks",
        "ots:Retrieve",
        "ots:*Memory*"
      ],
      "Resource": "acs:ots:cn-hangzhou:$accountId:instance/myinstance/*"
    }
  ]
}