All Products
Search
Document Center

Virtual Private Cloud:RAM authorization

Last Updated:May 31, 2024
Resource Access Management (RAM) is a service provided by Alibaba Cloud to manage user identities and resource access permissions. You can use RAM to prevent RAM users from sharing the AccessKey pairs of your Alibaba Cloud account. You can also use RAM to grant minimum permissions to RAM users. RAM uses policies to define permissions.
This topic describes the elements, such as Action, Resource, and Condition, which are defined by VPC. You can use the elements to create policies in RAM. The code (RamCode) in RAM that is used to indicate VPC is vpc. You can grant permissions on VPC at the RESOURCE.

General structure of a policy

Policies can be stored as JSON files. The following code provides an example on the general structure of a policy:
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}
The following list describes the fields in the policy:
  • Effect: specifies the authorization effect. Valid values: Allow, Deny.
  • Action: specifies one or more API operations that are allowed or denied. For more information, see the Action section of this topic.
  • Resource: specifies one or more resources to which the policy applies. You can use an Alibaba Cloud Resource Name (ARN) to specify a resource. For more information, see the Resource section of this topic.
  • Condition: specifies one or more conditions that are required for the policy to take effect. This is an optional field. For more information, see the Condition section of this topic.
    • Condition_operator: specifies the conditional operators. Different types of conditions support different conditional operators. For more information, see Policy elements.
    • Condition_key: specifies the condition keys.
    • Condition_value: specifies the condition values.

Action

VPC defines the values that you can use in the Action element of a policy statement. The following table describes the values.
  • Operation: the value that you can use in the Action element to specify the operation on a resource.
  • API operation: the API operation that you can call to perform the operation.
  • Access level: the access level of each operation. The levels are read, write, and list.
  • Resource type: the type of the resource on which you can authorize the RAM user or the RAM role to perform the operation. Take note of the following items:
    • The required resource types are displayed in bold characters.
    • If the permissions cannot be granted at the resource level, All Resources is used in the Resource type column of the operation.
  • Condition key: the condition keys that are defined by the Alibaba Cloud service. The Condition key column does not list the common condition keys that are defined by Alibaba Cloud. For more information about the common condition keys, see Generic Condition Keyword.
  • Associated operation: other operations that the RAM user or the RAM role must have permissions to perform to complete the operation. To complete the operation, the RAM user or the RAM role must have the permissions to perform the associated operations.
ActionsAPI operationAccess levelResource typeCondition keyAssociated operation
vpc:ActiveFlowLogActiveFlowLogWrite
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
NoneNone
vpc:AddSourcesToTrafficMirrorSessionAddSourcesToTrafficMirrorSessionWrite
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}
NoneNone
vpc:AllocateVpcIpv6CidrAllocateVpcIpv6CidrWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/*
NoneNone
vpc:AssociateHaVipAssociateHaVipWrite
Instance
acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId}
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}
NoneNone
vpc:AssociateNetworkAclAssociateNetworkAclWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:AssociateRouteTableAssociateRouteTableWrite
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#vswitchId}
NoneNone
vpc:AssociateRouteTableWithGatewayAssociateRouteTableWithGatewayWrite
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}
NoneNone
vpc:AssociateRouteTablesWithVpcGatewayEndpointAssociateRouteTablesWithVpcGatewayEndpointWrite
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone
vpc:AssociateVpcCidrBlockAssociateVpcCidrBlockWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:AttachDhcpOptionsSetToVpcAttachDhcpOptionsSetToVpcWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:ChangeResourceGroupChangeResourceGroupWrite
PhysicalConnection
acs:vpc:*:{#accountId}:physicalconnection/{#PhysicalConnectionId}
VirtualBorderRouter
acs:vpc:*:{#AccountId}:virtualborderrouter/{#VbrId}
RouterInterface
acs:vpc:*:{#AccountId}:routerinterface/{#RouterInterfaceId}
NoneNone
vpc:CopyNetworkAclEntriesCopyNetworkAclEntriesWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
NoneNone
vpc:CreateDefaultVSwitchCreateDefaultVSwitchWrite
VSwitch
acs:vpc:{#regionid}:{#accountId}:vswitch/*
NoneNone
vpc:CreateDefaultVpcCreateDefaultVpcWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/*
NoneNone
vpc:CreateDhcpOptionsSetCreateDhcpOptionsSetWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/*
NoneNone
vpc:CreateFlowLogCreateFlowLogWrite
VSwitch
acs:vpc:{#regionid}:{#accountId}:vswitch/{#VSwitchId}
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/*
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:CreateHaVipCreateHaVipWrite
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/*
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:CreateIpv4GatewayCreateIpv4GatewayWrite
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/*
NoneNone
vpc:CreateNetworkAclCreateNetworkAclWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/*
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:CreateRouteEntriesCreateRouteEntriesWrite
RouteEntry
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:CreateRouteEntryCreateRouteEntryWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:CreateRouteTableCreateRouteTableWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/*
NoneNone
vpc:CreateTrafficMirrorFilterCreateTrafficMirrorFilterWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/*
NoneNone
vpc:CreateTrafficMirrorFilterRulesCreateTrafficMirrorFilterRulesWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:CreateTrafficMirrorSessionCreateTrafficMirrorSessionWrite
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/*
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:CreateVSwitchCreateVSwitchWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/*
vpc:tag
None
vpc:CreateVSwitchCidrReservationCreateVSwitchCidrReservationWrite
VSwitchCidrReservation
acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/*
NoneNone
vpc:CreateVpcCreateVpcWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/*
NoneNone
vpc:CreateVpcGatewayEndpointCreateVpcGatewayEndpointWrite
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/*
NoneNone
vpc:CreateVpcPrefixListCreateVpcPrefixListWrite
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/*
NoneNone
vpc:DeactiveFlowLogDeactiveFlowLogWrite
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
NoneNone
vpc:DeleteDhcpOptionsSetDeleteDhcpOptionsSetWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
NoneNone
vpc:DeleteFlowLogDeleteFlowLogWrite
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
NoneNone
vpc:DeleteHaVipDeleteHaVipWrite
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}
NoneNone
vpc:DeleteIpv4GatewayDeleteIpv4GatewayWrite
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}
NoneNone
vpc:DeleteNetworkAclDeleteNetworkAclWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
NoneNone
vpc:DeleteRouteEntriesDeleteRouteEntriesWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}
NoneNone
vpc:DeleteRouteEntryDeleteRouteEntryWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:DeleteRouteTableDeleteRouteTableWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:DeleteTrafficMirrorFilterDeleteTrafficMirrorFilterWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:DeleteTrafficMirrorFilterRulesDeleteTrafficMirrorFilterRulesWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:DeleteTrafficMirrorSessionDeleteTrafficMirrorSessionWrite
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}
NoneNone
vpc:DeleteVSwitchDeleteVSwitchWrite
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:DeleteVSwitchCidrReservationDeleteVSwitchCidrReservationWrite
VSwitchCidrReservation
acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId}
NoneNone
vpc:DeleteVpcDeleteVpcWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
vpc:tag
None
vpc:DeleteVpcGatewayEndpointDeleteVpcGatewayEndpointWrite
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone
vpc:DeleteVpcPrefixListDeleteVpcPrefixListWrite
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
NoneNone
vpc:DeletionProtectionDeletionProtectionWrite
Address
acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}
NoneNone
vpc:DescribeFlowLogsDescribeFlowLogsRead
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/*
NoneNone
vpc:DescribeGrantRulesToCenDescribeGrantRulesToCenList
VirtualBorderRouter
acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#InstanceId}
GrantRuleToCen
acs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId}
NoneNone
vpc:DescribeHaVipsDescribeHaVipsList
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/*
NoneNone
vpc:DescribeNetworkAclAttributesDescribeNetworkAclAttributesRead
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
NoneNone
vpc:DescribeNetworkAclsDescribeNetworkAclsList
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/*
NoneNone
vpc:DescribeRouteEntryListDescribeRouteEntryListRead
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:DescribeRouteTableListDescribeRouteTableListList
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/*
vpc:VRouter
vpc:VBR
None
vpc:DescribeRouteTablesDescribeRouteTablesList
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
vpc:VBR
vpc:VRouter
None
vpc:DescribeTagKeysDescribeTagKeysRead
All Resources
*
NoneNone
vpc:DescribeTagKeysForExpressConnectDescribeTagKeysForExpressConnectList
All Resources
*
NoneNone
vpc:DescribeTagsDescribeTagsRead
All Resources
*
vpc:tag
None
vpc:DescribeVRoutersDescribeVRoutersList
VRouter
acs:vpc:{#regionId}:{#accountId}:vrouter/*
vpc:VPC
None
vpc:DescribeVSwitchAttributesDescribeVSwitchAttributesRead
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:DescribeVSwitchesDescribeVSwitchesList
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/*
vpc:VPC
None
vpc:DescribeVpcAttributeDescribeVpcAttributeRead
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
vpc:tag
None
vpc:DescribeVpcsDescribeVpcsList
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/*
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VPCId}
vpc:tag
None
vpc:DetachDhcpOptionsSetFromVpcDetachDhcpOptionsSetFromVpcWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:DisableVpcClassicLinkDisableVpcClassicLinkWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:DissociateRouteTableFromGatewayDissociateRouteTableFromGatewayRead
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}
NoneNone
vpc:DissociateRouteTablesFromVpcGatewayEndpointDissociateRouteTablesFromVpcGatewayEndpointWrite
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone
vpc:EnableVpcClassicLinkEnableVpcClassicLinkWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:EnableVpcIpv4GatewayEnableVpcIpv4GatewayWrite
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}
NoneNone
vpc:GetDhcpOptionsSetGetDhcpOptionsSetRead
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
NoneNone
vpc:GetFlowLogServiceStatusGetFlowLogServiceStatusRead
FlowLogService
acs:vpc:{#regionId}:{#accountId}:flowlog/*
NoneNone
vpc:GetIpv4GatewayAttributeGetIpv4GatewayAttributeRead
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#Ipv4GatewayId}
NoneNone
vpc:GetTrafficMirrorServiceStatusGetTrafficMirrorServiceStatusRead
All Resources
*
NoneNone
vpc:GetVSwitchCidrReservationUsageGetVSwitchCidrReservationUsageRead
VSwitchCidrReservation
acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId}
NoneNone
vpc:GetVpcGatewayEndpointAttributeGetVpcGatewayEndpointAttributeRead
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone
vpc:GetVpcPrefixListAssociationsGetVpcPrefixListAssociationsRead
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
NoneNone
vpc:GetVpcPrefixListEntriesGetVpcPrefixListEntriesRead
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
NoneNone
vpc:GetVpcRouteEntrySummaryGetVpcRouteEntrySummaryRead
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#vpcId}
NoneNone
vpc:GrantInstanceToCenGrantInstanceToCenWrite
All Resources
*
NoneNone
vpc:ListDhcpOptionsSetsListDhcpOptionsSetsRead
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/*
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
NoneNone
vpc:ListGatewayRouteTableEntriesListGatewayRouteTableEntriesList
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#routetableId}
NoneNone
vpc:ListIpv4GatewaysListIpv4GatewaysList
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/*
NoneNone
vpc:ListPrefixListsListPrefixListsList
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/*
NoneNone
vpc:ListTagResourcesListTagResourcesRead
BandwidthPackage
acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#BandwidthPackageId}
Address
acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}
NatGateway
acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTable}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
VpnGateway
acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
vpc:tag
None
vpc:ListTagResourcesForExpressConnectListTagResourcesForExpressConnectList
PhysicalConnection
acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}
VirtualBorderRouter
acs:vpc:{#regionId}:{#AccountId}:virtualborderrouter/{#VbrId}
RouterInterface
acs:vpc:{#regionId}:{#AccountId}:routerinterface/{#RouterInterfaceId}
NoneNone
vpc:ListTrafficMirrorFiltersListTrafficMirrorFiltersList
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/*
NoneNone
vpc:ListTrafficMirrorSessionsListTrafficMirrorSessionsList
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/*
NoneNone
vpc:ListVSwitchCidrReservationsListVSwitchCidrReservationsList
VSwitchCidrReservation
acs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/*
NoneNone
vpc:ListVpcEndpointServicesByEndUserListVpcEndpointServicesByEndUserList
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/*
NoneNone
vpc:ListVpcGatewayEndpointsListVpcGatewayEndpointsList
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/*
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone
vpc:ModifyFlowLogAttributeModifyFlowLogAttributeWrite
FlowLog
acs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
NoneNone
vpc:ModifyHaVipAttributeModifyHaVipAttributeWrite
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}
NoneNone
vpc:ModifyNetworkAclAttributesModifyNetworkAclAttributesWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
NoneNone
vpc:ModifyRouteEntryModifyRouteEntryWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:ModifyRouteTableAttributesModifyRouteTableAttributesWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
vpc:VRouter
None
vpc:ModifyVRouterAttributeModifyVRouterAttributeWrite
VRouter
acs:vpc:{#regionId}:{#accountId}:vrouter/{#VRouterId}
NoneNone
vpc:ModifyVSwitchAttributeModifyVSwitchAttributeWrite
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:ModifyVSwitchCidrReservationAttributeModifyVSwitchCidrReservationAttributeWrite
All Resources
*
NoneNone
vpc:ModifyVpcAttributeModifyVpcAttributeWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
vpc:tag
None
vpc:ModifyVpcPrefixListModifyVpcPrefixListWrite
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
NoneNone
vpc:MoveResourceGroupMoveResourceGroupWrite
All Resources
*
NoneNone
vpc:OpenFlowLogServiceOpenFlowLogServiceWrite
FlowLogService
acs:vpc:{#regionId}:{#accountId}:flowlog/*
NoneNone
vpc:OpenTrafficMirrorServiceOpenTrafficMirrorServiceWrite
All Resources
*
NoneNone
vpc:RemoveSourcesFromTrafficMirrorSessionRemoveSourcesFromTrafficMirrorSessionWrite
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}
NoneNone
vpc:ReplaceVpcDhcpOptionsSetReplaceVpcDhcpOptionsSetWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:RetryVpcPrefixListAssociationRetryVpcPrefixListAssociationWrite
PrefixList
acs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
NoneNone
vpc:RevokeInstanceFromCenRevokeInstanceFromCenWrite
VirtualBorderRouter
acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VirtualBorderRouterId}
NoneNone
vpc:TagResourcesTagResourcesWrite
BandwidthPackage
acs:vpc:{#regionId}:{#accountId}:combandwidthpackage/{#BandwidthPackageId}
Address
acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}
NatGateway
acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
VpnGateway
acs:vpc:{#regionId}:{#accountId}:vpngateway/{#VpnGatewayId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
vpc:tag
None
vpc:TagResourcesForExpressConnectTagResourcesForExpressConnectWrite
PhysicalConnection
acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}
VirtualBorderRouter
acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}
RouterInterface
acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId}
NoneNone
vpc:UnTagResourcesUnTagResourcesWrite
Address
acs:vpc:{#regionId}:{#accountId}:eip/{#AllocationId}
NatGateway
acs:vpc:{#regionId}:{#accountId}:natgateway/{#NatGatewayId}
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
vpc:tag
None
vpc:UnassociateHaVipUnassociateHaVipWrite
Instance
acs:vpc:{#regionId}:{#accountId}:instance/{#InstanceId}
HaVip
acs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}
NoneNone
vpc:UnassociateNetworkAclUnassociateNetworkAclWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:UnassociateRouteTableUnassociateRouteTableWrite
VSwitch
acs:vpc:{#regionId}:{#accountId}:vswitch/{#VSwitchId}
NoneNone
vpc:UnassociateVpcCidrBlockUnassociateVpcCidrBlockWrite
VPC
acs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
NoneNone
vpc:UntagResourcesForExpressConnectUntagResourcesForExpressConnectWrite
PhysicalConnection
acs:vpc:{#regionId}:{#accountId}:physicalconnection/{#PhysicalConnectionId}
VirtualBorderRouter
acs:vpc:{#regionId}:{#accountId}:virtualborderrouter/{#VbrId}
RouterInterface
acs:vpc:{#regionId}:{#accountId}:routerinterface/{#RouterInterfaceId}
NoneNone
vpc:UpdateDhcpOptionsSetAttributeUpdateDhcpOptionsSetAttributeWrite
DhcpOptionsSet
acs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
NoneNone
vpc:UpdateGatewayRouteTableEntryAttributeUpdateGatewayRouteTableEntryAttributeWrite
RouteTable
acs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
NoneNone
vpc:UpdateIpv4GatewayAttributeUpdateIpv4GatewayAttributeWrite
Ipv4Gateway
acs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#ipv4gatewayId}
NoneNone
vpc:UpdateNetworkAclEntriesUpdateNetworkAclEntriesWrite
NetworkAcl
acs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
NoneNone
vpc:UpdateTrafficMirrorFilterAttributeUpdateTrafficMirrorFilterAttributeWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:UpdateTrafficMirrorFilterRuleAttributeUpdateTrafficMirrorFilterRuleAttributeWrite
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:UpdateTrafficMirrorSessionAttributeUpdateTrafficMirrorSessionAttributeWrite
TrafficMirrorSession
acs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}
TrafficMirrorFilter
acs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
NoneNone
vpc:UpdateVpcGatewayEndpointAttributeUpdateVpcGatewayEndpointAttributeWrite
GatewayEndpoint
acs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
NoneNone

Resource

VPC defines the values that you can use in the Resource. You can attach the policy to a RAM user or a RAM role so that the RAM user or the RAM role can perform a specific operation on a specific resource. The ARN is the unique identifier of the resource on Alibaba Cloud. Take note of the following items:
  • {#}indicates a variable. {#} must be replaced with an actual value. For example, {#ramcode} must be replaced with the actual code of an Alibaba Cloud service in RAM.
  • An asterisk (*) is used as a wildcard. Examples:
    • {#resourceType} is set to *, all resources are specified.
    • {#regionId} is set to *, all regions are specified.
    • {#accountId} is set to *, all Alibaba Cloud accounts are specified.
Resource typeARN
VPCacs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}
FlowLogServiceacs:vpc:{#regionId}:{#accountId}:flowlogservice
TrafficMirrorSessionacs:vpc:{#regionId}:{#accountId}:trafficmirrorsession/{#TrafficMirrorSessionId}
TrafficMirrorFilteracs:vpc:{#regionId}:{#accountId}:trafficmirrorfilter/{#TrafficMirrorFilterId}
Ipv6Gatewayacs:vpc:{#regionId}:{#accountId}:ipv6gateway/{#Ipv6GatewayId}
DhcpOptionsSetacs:vpc:{#regionId}:{#accountId}:dhcpoptionsset/{#DhcpOptionsSetId}
VSwitchacs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/vswitch/{#VSwitchId}
NetworkAclacs:vpc:{#regionId}:{#accountId}:networkacl/{#NetworkAclId}
RouteTableacs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}
GatewayEndpointacs:vpc:{#regionId}:{#accountId}:gatewayendpoint/{#GatewayEndpointId}
GlobalAccelerationInstanceacs:vpc:{#regionId}:{#accountId}:globalaccelerationinstance/{#GlobalAccelerationInstanceId}
Ipv4Gatewayacs:vpc:{#regionId}:{#accountId}:ipv4gateway/{#Ipv4GatewayId}
VSwitchCidrReservationacs:vpc:{#regionId}:{#accountId}:vswitchcidrreservation/{#VSwitchCidrReservationId}
Ipv6Addressacs:vpc:{#regionId}:{#accountId}:ipv6address/{#Ipv6AddressId}
FlowLogacs:vpc:{#regionId}:{#accountId}:flowlog/{#FlowLogId}
PrefixListacs:vpc:{#regionId}:{#accountId}:prefixlist/{#PrefixListId}
Ipv6InternetBandwidthacs:vpc:{#regionId}:{#accountId}:ipv6internetbandwidth/{#Ipv6InternetBandwidthId}
RouteEntryacs:vpc:{#regionId}:{#accountId}:routetable/{#RouteTableId}/routeentry/{#RouteEntryId}
HaVipacs:vpc:{#regionId}:{#accountId}:havip/{#HaVipId}
PublicIpAddressPoolacs:vpc:{#regionId}:{#accountId}:publicipaddresspool/{#PublicIpAddressPoolId}
TrafficMirrorServiceacs:vpc:{#regionId}:{#accountId}:trafficmirrorsessionservice
VRouteracs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/vrouter/{#VRouterId}
Ipv6EgressRuleacs:vpc:{#regionId}:{#accountId}:vpc/{#VpcId}/ipv6gateway/{#Ipv6GatewayId}/ipv6egressrule/{#Ipv6EgressRuleId}
GrantRuleToCenacs:vpc:{#regionId}:{#accountId}:vpc/{#InstanceId}/grantruletocen/{#CenId}

Condition

VPC defines the values that you can use in the Condition element of a policy statement. The following table describes the values. The following table describes the service-specific condition keys. The common condition keys that are defined by Alibaba Cloud also apply to VPC. For more information about the common condition keys, see Generic Condition Keyword.
The data type determines the conditional operators that you can use to compare the value in a request with the value in a policy statement. You must use conditional operators that are supported by the data type. Otherwise, you cannot compare the value in the request with the value in the policy statement. In this case, the authorization is invalid. For more information about the conditional operators that are supported by each data type, see Policy elements.
Condition keyDescriptionData type
vpc:PhysicalConnectionString
vpc:VBRString
vpc:VPCString
vpc:VRouterString
vpc:tagString
vpc:TargetAccountRDIdString

What to do next

You can create a custom policy and attach the policy to a RAM user, RAM user group, or RAM role. For more information, see the following topics: