Tous les produits
Search

Ce produit

    Resource Management:Autorisation RAM

    Centre de documentation

    Resource Management:Autorisation RAM

    Dernière mise à jour :Sep 08, 2026

    Avant d'utiliser un utilisateur RAM pour appeler les opérations API de Resource Management afin d'accéder aux ressources appartenant à un compte Alibaba Cloud, vous devez utiliser le compte Alibaba Cloud pour créer et attacher la stratégie requise à l'utilisateur RAM. Dans la stratégie, spécifiez les opérations API autorisées dans l'élément Action et les ressources autorisées dans l'élément Resource. Chaque ressource est identifiée par son nom de ressource Alibaba Cloud (ARN).

    La liste suivante décrit les variables utilisées dans l'élément Resource d'une stratégie. Remplacez les variables par des valeurs réelles.

    • <account_id> : ID d'un compte Alibaba Cloud.

    • <resourcegroup_id> : ID d'un groupe de ressources.

    • <policy_name> : nom d'une stratégie.

    • <role_name> : nom d'un rôle RAM.

    • <resource_type> : type d'une ressource.

    • <resource_id> : ID d'une ressource.

    • <region_id> : ID de la région.

    • <product> : code du produit pour le service cloud.

    • <handshake_id> : ID d'une invitation.

    • <policy_id> : ID d'une politique de contrôle d'accès.

    • <resource_directory_path> : RDPath d'un dossier ou d'un membre, indiquant l'emplacement de ce dernier dans un annuaire des ressources.

    • <contact_id> : ID d'un contact.

    Les types de ressources requis sont affichés en gras.

    Liste d'authentification des groupes de ressources

    Le tableau suivant répertorie les opérations API de groupe de ressources que vous pouvez spécifier dans l'élément Action et les formats ARN utilisés dans l'élément Resource.

    Action

    Resource

    ram:CreateResourceGroup

    acs:ram::<account_id>:resourcegroup/

    ram:DeleteResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:UpdateResourceGroup

    acs:ram:*:<account_id>:resourcegroup/<resourcegroup_id>

    ram:CreatePolicy

    acs:ram::<account_id>:policy/

    ram:DeletePolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicies

    acs:ram::<account_id>:policy/

    ram:GetPolicy

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:CreatePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:DeletePolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:ListPolicyVersions

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:GetPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:SetDefaultPolicyVersion

    acs:ram:*:<account_id>:policy/<policy_name>

    ram:AttachPolicy

    • Stratégie :

      acs:ram::system:policy/<policy_name> or acs:ram::<account_id>:policy/<policy_name>

    • Utilisateur RAM :

      acs:ims::<account_id>:user/

    • Groupe IMS :

      acs:ims::<account_id>:group/

    • Rôle RAM :

      acs:ram::<account_id>:role/

    ram:DetachPolicy

    • Stratégie :

      acs:ram::system:policy/<policy_name> or acs:ram::<account_id>:policy/<policy_name>

    • Utilisateur RAM :

      acs:ims::<account_id>:user/

    • Groupe IMS :

      acs:ims::<account_id>:group/

    • Rôle RAM :

      acs:ram::<account_id>:role/

    ram:ListPolicyAttachments

    acs:ram::<account_id>:

    ram:CreateRole

    acs:ram::<account_id>:role/

    ram:GetRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:ListRoles

    acs:ram::<account_id>:role/

    ram:UpdateRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:DeleteRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:CreateServiceLinkedRole

    acs:ram::<account_id>:role/

    ram:DeleteServiceLinkedRole

    acs:ram:*:<account_id>:role/<role_name>

    ram:GetServiceLinkedRoleDeletionStatus

    acs:ram:*:<account_id>:role/<role_name>

    Liste d'authentification de l'annuaire des ressources

    Le tableau suivant répertorie les opérations API de l'annuaire des ressources que vous pouvez spécifier dans l'élément Action et les formats ARN utilisés dans l'élément Resource.

    Action

    Resource

    resourcemanager:AcceptHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:AttachControlPolicy

    • ControlPolicy :

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:BindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CancelHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:CheckAccountDelete

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:CreateCloudAccount

    acs:resourcemanager::<account_id>:

    resourcemanager:CreateControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:CreateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:CreateResourceAccount

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeclineHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:DeleteAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DeleteControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:DeleteFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DeregisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:DestroyResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:DetachControlPolicy

    • ControlPolicy :

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:DisableControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:EnableControlPolicy

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:EnableResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:GetAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionCheckResult

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetAccountDeletionStatus

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:GetControlPolicyEnablementStatus

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:GetFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:GetHandshake

    acs:resourcemanager:*:<account_id>:handshake/<handshake_id>

    resourcemanager:GetPayerForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:GetResourceDirectory

    acs:resourcemanager::<account_id>:

    resourcemanager:InviteAccountToResourceDirectory

    • Handshake :

      acs:resourcemanager::<account_id>:handshake/

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAccounts

    acs:resourcemanager::<account_id>:account/

    resourcemanager:ListAccountsForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListAncestors

    acs:resourcemanager::<account_id>:folder/

    resourcemanager:ListControlPolicies

    acs:resourcemanager::<account_id>:policy/controlpolicy/

    resourcemanager:ListControlPolicyAttachmentsForTarget

    • ControlPolicy :

      acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListDelegatedAdministrators

    acs:resourcemanager::<account_id>:account/

    resourcemanager:ListDelegatedServicesForAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ListFoldersForParent

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:ListHandshakesForAccount

    acs:resourcemanager::<account_id>:handshake/

    resourcemanager:ListHandshakesForResourceDirectory

    acs:resourcemanager::<account_id>:handshake/

    resourcemanager:ListTagKeys

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTagValues

    acs:resourcemanager::<account_id>:

    resourcemanager:ListTargetAttachmentsForControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:ListTrustedServiceStatus

    acs:resourcemanager::<account_id>:

    resourcemanager:MoveAccount

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:PromoteResourceAccount

    acs:resourcemanager::<account_id>:

    resourcemanager:RegisterDelegatedAdministrator

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RemoveCloudAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForBindSecureMobilePhone

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:SendVerificationCodeForEnableRD

    acs:resourcemanager::<account_id>:

    resourcemanager:TagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:UntagResources

    acs:resourcemanager::<account_id>:

    resourcemanager:UpdateAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:UpdateControlPolicy

    acs:resourcemanager:*:<account_id>:policy/controlpolicy/<policy_id>

    resourcemanager:UpdateFolder

    acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    resourcemanager:AddMessageContact

    acs:resourcemanager::<account_id>:messagecontact/

    resourcemanager:CancelMessageContactUpdate

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DeleteMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:GetMessageContactDeletionStatus

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:ListMessageContacts

    acs:resourcemanager::<account_id>:messagecontact/

    resourcemanager:ListMessageContactVerifications

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendEmailVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:SendPhoneVerificationForMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:UpdateMessageContact

    acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:AssociateMembers

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Contact de message :

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:DisassociateMembers

    • Dossier :

      acs:resourcemanager:*:<account_id>:folder/<resource_directory_path>

    • Compte :

      acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    • Contact :

      acs:resourcemanager:*:<account_id>:messagecontact/<contact_id>

    resourcemanager:CancelChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:ChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:RetryChangeAccountEmail

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    resourcemanager:PrecheckForConsolidatedBillingAccount

    acs:resourcemanager:*:<account_id>:account/<resource_directory_path>

    Liste d'authentification du partage de ressources

    Le tableau suivant répertorie les opérations API de partage de ressources que vous pouvez spécifier dans l'élément Action et les formats ARN utilisés dans l'élément Resource.

    Action

    Resource

    resourcesharing:EnableSharingWithResourceDirectory

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:CreateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:UpdateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DeleteResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShares

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceShare

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareAssociations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedResources

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListSharedTargets

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DescribeRegions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceShareInvitations

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AcceptResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:RejectResourceShareInvitation

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:AssociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:DisassociateResourceSharePermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListResourceSharePermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:GetPermission

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissionVersions

    acs:resourcesharing:<region_id>:<account_id>:*

    resourcesharing:ListPermissions

    acs:resourcesharing:<region_id>:<account_id>:*

    Liste d'authentification basée sur les tags

    Le tableau suivant répertorie les opérations API de tag que vous pouvez spécifier dans l'élément Action et les formats ARN utilisés dans l'élément Resource.

    Action

    Resource

    tag:ListTagResources

    acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:TagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:UntagResources

    • acs:tag:<region_id>:<account_id>:<resource_type>/<resource_id>

    • acs:<product>:<region_id>:<account_id>:<resource_type>/<resource_id>

    tag:ListTagKeys

    acs:tag:<region_id>:<account_id>:/

    tag:ListTagValues

    acs:tag:<region_id>:<account_id>:/

    tag:CreateTags

    acs:tag:<region_id>:<account_id>:/

    tag:DeleteTag

    acs:tag:<region_id>:<account_id>:/