Use RAM roles to manage VPC permissions

Basic information

Attach a custom policy to a RAM user

1. Create a custom policy.
   For more information, see Create a custom policy and Examples.
2. In the left-side navigation pane, choose Permissions>Policies.
3. On the Policies page, find the policy that you want to manage and click its name.
4. Click the References tab and click Grant Permission.
5. In the Principal section, enter the username or ID of the RAM user.
6. Click OK.
7. Click Complete.
   Note You can also attach existing policies to a RAM user or a RAM user group. For more information, see Grant permissions to a RAM user and Grant permissions to a RAM user group.

Examples

• Example 1: Authorize a RAM user to manage all VPCs.

  Assume that the ID of your Alibaba Cloud account is 253460731706911258 and you want to authorize a RAM user to manage all VPCs that belong to the Alibaba Cloud account. In this case, attach the following policy to the RAM user:

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:*"
              ],
              "Resource": [
                  "acs:vpc:*:253460731706911258:*/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:*Describe*"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
  }

• Example 2: Authorize a RAM user to manage the vSwitches in a VPC.

  Assume that you want to authorize a RAM user to manage vSwitches in the China (Qingdao) region. More specifically, the RAM user can create and delete vSwitches, and associate and disassociate subnet routes. However, the RAM user can only view vSwitches in other regions. In this case, attach the following policy to the RAM user:

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:*Describe*",
                  "vpc:*VSwitch*",
                  "vpc:*RouteTable*"
              ],
              "Resource": [
                  "acs:vpc:cn-qingdao:*:*/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:*Describe*"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
  }

• Example 3: Authorize a RAM user to manage the route tables and routes in a specific region.

  Assume that the ID of your Alibaba Cloud account is 283117732402483989 and you have created VPCs in multiple regions. You want to authorize a RAM user to manage VPCs in the China (Hangzhou) region. More specifically, the RAM user can add and delete routes, create subnet routes, and associate subnet routes with vSwitches in the China (Hangzhou) region. However, the RAM user can only view cloud resources in other regions. In this case, attach the following policy to the RAM user:

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:*Describe*"
              ],
              "Resource": [
                  "*"
              ],
              "Condition": {}
          },
          {
              "Effect": "Allow",
              "Action": [
                  "slb:*Describe*"
              ],
              "Resource": [
                  "*"
              ],
              "Condition": {}
          },
          {
              "Effect": "Allow",
              "Action": [
                  "rds:*Describe*"
              ],
              "Resource": [
                  "*"
              ],
              "Condition": {}
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:*Describe*",
                  "vpc:*RouteEntry*",
                  "vpc:*RouteTable*"
              ],
              "Resource": [                
  "acs:vpc:cn-hangzhou:283117732402483989:*/*"
              ],
              "Condition": {}
          }
      ]
  }

• Example 4: Authorize a RAM user to add routes to or delete routes from a specified route table

  To authorize a RAM user to add routes to or delete routes from a specified route table, attach the following policy to the RAM user:

  {
      "Version": "1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:*RouteEntry*"
              ],
              "Resource": [
                  "acs:vpc:cn-qingdao:*:routetable/vtb-m5e64ujkb7xn5zlq0xxxx"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:*Describe*"
              ],
              "Resource": [
                  "*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:*Describe*"
              ],
              "Resource": [
                  "*"
              ]
          }
      ]
  }