ALIYUN::RAM::ManagedPolicy - Resource Orchestration Service - Centre de documentation Alibaba Cloud

La ressource ALIYUN::RAM::ManagedPolicy permet de créer une politique Resource Access Management (RAM).

Syntaxe

{
  "Type": "ALIYUN::RAM::ManagedPolicy",
  "Properties": {
    "PolicyName": String,
    "Description": String,
    "Roles": List,
    "PolicyDocumentUnchecked": Map,
    "PolicyDocument": Map,
    "Groups": List,
    "Users": List,
    "IgnoreExisting": Boolean
  }
}

Propriétés

Property	Type	Required	Editable	Description	Constraints
PolicyName	String	Yes	No	Le nom de la politique.	Le nom peut contenir jusqu'à 128 caractères.
Description	String	No	No	La description de la politique.	La description peut contenir jusqu'à 1 024 caractères.
Groups	List	No	No	Les groupes d'utilisateurs auxquels vous souhaitez attacher la politique.	Aucune.
IgnoreExisting	Boolean	No	No	Indique s'il faut ignorer la politique existante portant le même nom que la nouvelle politique.	Valeurs valides : true : ignore la politique existante. Le service Resource Orchestration Service (ROS) ne vérifie pas l'unicité des noms des politiques. Si une politique existante portant le même nom est présente dans la console ROS, elle est ignorée lors de la création de la nouvelle politique par ROS. Si la politique existante n'a pas été créée dans la console ROS, elle est ignorée lors de la mise à jour ou de la suppression de la nouvelle politique par ROS. false : n'ignore pas la politique existante. ROS vérifie l'unicité des noms des politiques. Si une politique existante portant le même nom est présente dans la console ROS, une erreur est signalée lors de la création de la nouvelle politique par ROS.
PolicyDocument	Map	No	Yes	Détails de la politique.	Pour plus d'informations, consultez Propriétés PolicyDocument.
PolicyDocumentUnchecked	Map	No	Yes	Le document de politique qui décrit les actions spécifiques effectuées sur des ressources spécifiques.	Si vous spécifiez cette propriété, PolicyDocument est ignoré.
Roles	List	No	No	Les rôles auxquels vous souhaitez attacher la politique.	Aucune.
Users	List	No	No	Les utilisateurs auxquels vous souhaitez attacher la politique.	Aucune.

Syntaxe de PolicyDocument

"PolicyDocument": {
  "Version": String,
  "Statement": List
}

Propriétés PolicyDocument

Property	Type	Required	Editable	Description	Constraints
Statement	List	Yes	No	Les instructions de la politique.	Pour plus d'informations, consultez Propriétés Statement.
Version	String	Yes	No	La version de la politique.	Aucune.

Syntaxe de Statement

"Statement": [
  {
    "Condition": Map,
    "Action": List,
    "Resource": List,
    "Effect": String,
    "NotAction": List
  }
]

Propriétés Statement

Property	Type	Required	Editable	Description	Constraints
Action	List	No	No	Les actions effectuées en fonction de la politique.	Aucune.
Condition	Map	No	No	La condition requise pour que la politique prenne effet.	Aucune.
Effect	String	No	No	L'effet de l'instruction.	Valeurs valides : Allow Deny
NotAction	List	No	No	Les actions d'exception autorisées ou refusées.	Aucune.
Resource	List	No	No	Les ressources auxquelles vous souhaitez appliquer la politique.	Aucune.

Valeurs de retour

Fn::GetAtt

PolicyName : le nom de la politique.

Exemples

Scénario 1 : Créez une politique OSS en lecture seule et attachez-la à des utilisateurs RAM spécifiés.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建OSS只读权限策略并授权给指定RAM用户。
  en: Create an OSS read-only policy and attach it to specified RAM users.
Parameters:
  PolicyName:
    Type: String
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Description:
      zh-cn: RAM自定义策略名称，最长128个字符。
      en: RAM custom policy name, up to 128 characters.
    Default: oss-readonly-policy
  OssBucketName:
    Type: String
    Label:
      zh-cn: OSS存储桶名称
      en: OSS Bucket Name
    Description:
      zh-cn: 允许只读访问的OSS存储桶名称。
      en: The OSS bucket name to allow read-only access.
  UserName:
    Type: String
    Label:
      zh-cn: RAM用户
      en: RAM User
    Description:
      zh-cn: 要授权的RAM用户名称。
      en: The RAM user to attach this policy to.
    AssociationProperty: ALIYUN::RAM::User
Resources:
  ManagedPolicy:
    Type: ALIYUN::RAM::ManagedPolicy
    Properties:
      PolicyName:
        Ref: PolicyName
      Description:
        Fn::Sub: 允许对OSS存储桶${OssBucketName}进行只读访问
      PolicyDocument:
        Version: '1'
        Statement:
          - Effect: Allow
            Action:
              - oss:GetObject
              - oss:GetObjectAcl
              - oss:ListObjects
              - oss:GetBucket
              - oss:GetBucketInfo
              - oss:ListBuckets
            Resource:
              - Fn::Sub: acs:oss:*:*:${OssBucketName}
              - Fn::Sub: acs:oss:*:*:${OssBucketName}/*
      Users:
        - Ref: UserName
Outputs:
  PolicyName:
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Description:
      zh-cn: 创建成功的RAM自定义策略名称。
      en: The name of the created RAM custom policy.
    Value:
      Fn::GetAtt:
        - ManagedPolicy
        - PolicyName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建OSS只读权限策略并授权给指定RAM用户。",
    "en": "Create an OSS read-only policy and attach it to specified RAM users."
  },
  "Parameters": {
    "PolicyName": {
      "Type": "String",
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Description": {
        "zh-cn": "RAM自定义策略名称，最长128个字符。",
        "en": "RAM custom policy name, up to 128 characters."
      },
      "Default": "oss-readonly-policy"
    },
    "OssBucketName": {
      "Type": "String",
      "Label": {
        "zh-cn": "OSS存储桶名称",
        "en": "OSS Bucket Name"
      },
      "Description": {
        "zh-cn": "允许只读访问的OSS存储桶名称。",
        "en": "The OSS bucket name to allow read-only access."
      }
    },
    "UserName": {
      "Type": "String",
      "Label": {
        "zh-cn": "RAM用户",
        "en": "RAM User"
      },
      "Description": {
        "zh-cn": "要授权的RAM用户名称。",
        "en": "The RAM user to attach this policy to."
      },
      "AssociationProperty": "ALIYUN::RAM::User"
    }
  },
  "Resources": {
    "ManagedPolicy": {
      "Type": "ALIYUN::RAM::ManagedPolicy",
      "Properties": {
        "PolicyName": {
          "Ref": "PolicyName"
        },
        "Description": {
          "Fn::Sub": "允许对OSS存储桶${OssBucketName}进行只读访问"
        },
        "PolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "oss:GetObject",
                "oss:GetObjectAcl",
                "oss:ListObjects",
                "oss:GetBucket",
                "oss:GetBucketInfo",
                "oss:ListBuckets"
              ],
              "Resource": [
                {
                  "Fn::Sub": "acs:oss:*:*:${OssBucketName}"
                },
                {
                  "Fn::Sub": "acs:oss:*:*:${OssBucketName}/*"
                }
              ]
            }
          ]
        },
        "Users": [
          {
            "Ref": "UserName"
          }
        ]
      }
    }
  },
  "Outputs": {
    "PolicyName": {
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM自定义策略名称。",
        "en": "The name of the created RAM custom policy."
      },
      "Value": {
        "Fn::GetAtt": [
          "ManagedPolicy",
          "PolicyName"
        ]
      }
    }
  }
}

Scénario 2 : Créez une politique de gestion ECS avec une condition IP et attachez-la à des groupes d'utilisateurs et à des rôles.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建ECS管理权限策略并附加IP条件限制，授权给用户组和角色。
  en: Create an ECS management policy with IP condition and attach to groups and roles.
Parameters:
  PolicyName:
    Type: String
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Default: ecs-manage-ip-restricted
  AllowedCidrBlock:
    Type: String
    Label:
      zh-cn: 允许的源IP网段
      en: Allowed Source CIDR
    Description:
      zh-cn: >-
        允许发起请求的源IP网段，
        例如10.0.0.0/8或192.168.1.0/24。
      en: >-
        Allowed source IP CIDR block,
        e.g. 10.0.0.0/8 or 192.168.1.0/24.
    Default: 10.0.0.0/8
  GroupName:
    Type: String
    Label:
      zh-cn: RAM用户组
      en: RAM Group
    Description:
      zh-cn: 要授权的RAM用户组名称。
      en: The RAM group to attach this policy to.
    AssociationProperty: ALIYUN::RAM::Group
  RoleName:
    Type: String
    Label:
      zh-cn: RAM角色
      en: RAM Role
    Description:
      zh-cn: 要授权的RAM角色名称。
      en: The RAM role to attach this policy to.
    AssociationProperty: ALIYUN::RAM::Role
Resources:
  ManagedPolicy:
    Type: ALIYUN::RAM::ManagedPolicy
    Properties:
      PolicyName:
        Ref: PolicyName
      Description: ECS实例管理权限，限定源IP访问，禁止删除和释放操作
      PolicyDocument:
        Version: '1'
        Statement:
          - Effect: Allow
            Action:
              - ecs:DescribeInstances
              - ecs:DescribeInstanceStatus
              - ecs:DescribeInstanceAttribute
              - ecs:StartInstance
              - ecs:StopInstance
              - ecs:RebootInstance
            Resource:
              - '*'
            Condition:
              IpAddress:
                acs:SourceIp:
                  - Ref: AllowedCidrBlock
          - Effect: Deny
            Action:
              - ecs:DeleteInstance
              - ecs:ModifyInstanceAttribute
            Resource:
              - '*'
      Groups:
        - Ref: GroupName
      Roles:
        - Ref: RoleName
Outputs:
  PolicyName:
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Description:
      zh-cn: 创建成功的RAM自定义策略名称。
      en: The name of the created RAM custom policy.
    Value:
      Fn::GetAtt:
        - ManagedPolicy
        - PolicyName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建ECS管理权限策略并附加IP条件限制，授权给用户组和角色。",
    "en": "Create an ECS management policy with IP condition and attach to groups and roles."
  },
  "Parameters": {
    "PolicyName": {
      "Type": "String",
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Default": "ecs-manage-ip-restricted"
    },
    "AllowedCidrBlock": {
      "Type": "String",
      "Label": {
        "zh-cn": "允许的源IP网段",
        "en": "Allowed Source CIDR"
      },
      "Description": {
        "zh-cn": "允许发起请求的源IP网段，例如10.0.0.0/8或192.168.1.0/24。",
        "en": "Allowed source IP CIDR block, e.g. 10.0.0.0/8 or 192.168.1.0/24."
      },
      "Default": "10.0.0.0/8"
    },
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "RAM用户组",
        "en": "RAM Group"
      },
      "Description": {
        "zh-cn": "要授权的RAM用户组名称。",
        "en": "The RAM group to attach this policy to."
      },
      "AssociationProperty": "ALIYUN::RAM::Group"
    },
    "RoleName": {
      "Type": "String",
      "Label": {
        "zh-cn": "RAM角色",
        "en": "RAM Role"
      },
      "Description": {
        "zh-cn": "要授权的RAM角色名称。",
        "en": "The RAM role to attach this policy to."
      },
      "AssociationProperty": "ALIYUN::RAM::Role"
    }
  },
  "Resources": {
    "ManagedPolicy": {
      "Type": "ALIYUN::RAM::ManagedPolicy",
      "Properties": {
        "PolicyName": {
          "Ref": "PolicyName"
        },
        "Description": "ECS实例管理权限，限定源IP访问，禁止删除和释放操作",
        "PolicyDocument": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ecs:DescribeInstances",
                "ecs:DescribeInstanceStatus",
                "ecs:DescribeInstanceAttribute",
                "ecs:StartInstance",
                "ecs:StopInstance",
                "ecs:RebootInstance"
              ],
              "Resource": [
                "*"
              ],
              "Condition": {
                "IpAddress": {
                  "acs:SourceIp": [
                    {
                      "Ref": "AllowedCidrBlock"
                    }
                  ]
                }
              }
            },
            {
              "Effect": "Deny",
              "Action": [
                "ecs:DeleteInstance",
                "ecs:ModifyInstanceAttribute"
              ],
              "Resource": [
                "*"
              ]
            }
          ]
        },
        "Groups": [
          {
            "Ref": "GroupName"
          }
        ],
        "Roles": [
          {
            "Ref": "RoleName"
          }
        ]
      }
    }
  },
  "Outputs": {
    "PolicyName": {
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM自定义策略名称。",
        "en": "The name of the created RAM custom policy."
      },
      "Value": {
        "Fn::GetAtt": [
          "ManagedPolicy",
          "PolicyName"
        ]
      }
    }
  }
}

Scénario 3 : Créez une politique d'accès inter-services et attachez-la à des utilisateurs, des groupes d'utilisateurs et des rôles pour une autorisation complète.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建跨服务权限策略并同时授权给用户、用户组和角色，实现全面的权限分发。
  en: Create a cross-service policy and attach to users, groups and roles for comprehensive authorization.
Parameters:
  PolicyName:
    Type: String
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Description:
      zh-cn: RAM自定义策略名称。
      en: RAM custom policy name.
    Default: cross-service-devops-policy
  UserNames:
    Type: Json
    Label:
      zh-cn: RAM用户列表
      en: RAM User List
    Description:
      zh-cn: 要授权的RAM用户名称列表。
      en: List of RAM user names to attach this policy to.
    Default: []
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: false
        AssociationProperty: ALIYUN::RAM::User
        Label:
          zh-cn: RAM用户
          en: RAM User
  GroupNames:
    Type: Json
    Label:
      zh-cn: RAM用户组列表
      en: RAM Group List
    Description:
      zh-cn: 要授权的RAM用户组名称列表。
      en: List of RAM group names to attach this policy to.
    Default: []
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: false
        AssociationProperty: ALIYUN::RAM::Group
        Label:
          zh-cn: RAM用户组
          en: RAM Group
  RoleNames:
    Type: Json
    Label:
      zh-cn: RAM角色列表
      en: RAM Role List
    Description:
      zh-cn: 要授权的RAM角色名称列表。
      en: List of RAM role names to attach this policy to.
    Default: []
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: false
        AssociationProperty: ALIYUN::RAM::Role
        Label:
          zh-cn: RAM角色
          en: RAM Role
Resources:
  ManagedPolicy:
    Type: ALIYUN::RAM::ManagedPolicy
    Properties:
      PolicyName:
        Ref: PolicyName
      Description: 跨服务DevOps权限策略，覆盖ECS、RDS、SLB、VPC和CloudMonitor
      PolicyDocumentUnchecked:
        Version: '1'
        Statement:
          - Effect: Allow
            Action:
              - ecs:Describe*
              - ecs:StartInstance
              - ecs:StopInstance
              - ecs:RebootInstance
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - rds:Describe*
              - rds:ModifyDBInstanceSpec
              - rds:SwitchDBInstanceHA
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - slb:Describe*
              - slb:SetBackendServers
              - slb:AddBackendServers
              - slb:RemoveBackendServers
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - vpc:Describe*
            Resource:
              - '*'
          - Effect: Allow
            Action:
              - cms:Describe*
              - cms:QueryMetric*
            Resource:
              - '*'
          - Effect: Deny
            Action:
              - ecs:DeleteInstance
              - rds:DeleteDBInstance
              - slb:DeleteLoadBalancer
            Resource:
              - '*'
      Users:
        Ref: UserNames
      Groups:
        Ref: GroupNames
      Roles:
        Ref: RoleNames
      IgnoreExisting: true
Outputs:
  PolicyName:
    Label:
      zh-cn: 策略名称
      en: Policy Name
    Description:
      zh-cn: 创建成功的RAM自定义策略名称。
      en: The name of the created RAM custom policy.
    Value:
      Fn::GetAtt:
        - ManagedPolicy
        - PolicyName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建跨服务权限策略并同时授权给用户、用户组和角色，实现全面的权限分发。",
    "en": "Create a cross-service policy and attach to users, groups and roles for comprehensive authorization."
  },
  "Parameters": {
    "PolicyName": {
      "Type": "String",
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Description": {
        "zh-cn": "RAM自定义策略名称。",
        "en": "RAM custom policy name."
      },
      "Default": "cross-service-devops-policy"
    },
    "UserNames": {
      "Type": "Json",
      "Label": {
        "zh-cn": "RAM用户列表",
        "en": "RAM User List"
      },
      "Description": {
        "zh-cn": "要授权的RAM用户名称列表。",
        "en": "List of RAM user names to attach this policy to."
      },
      "Default": [],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": false,
          "AssociationProperty": "ALIYUN::RAM::User",
          "Label": {
            "zh-cn": "RAM用户",
            "en": "RAM User"
          }
        }
      }
    },
    "GroupNames": {
      "Type": "Json",
      "Label": {
        "zh-cn": "RAM用户组列表",
        "en": "RAM Group List"
      },
      "Description": {
        "zh-cn": "要授权的RAM用户组名称列表。",
        "en": "List of RAM group names to attach this policy to."
      },
      "Default": [],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": false,
          "AssociationProperty": "ALIYUN::RAM::Group",
          "Label": {
            "zh-cn": "RAM用户组",
            "en": "RAM Group"
          }
        }
      }
    },
    "RoleNames": {
      "Type": "Json",
      "Label": {
        "zh-cn": "RAM角色列表",
        "en": "RAM Role List"
      },
      "Description": {
        "zh-cn": "要授权的RAM角色名称列表。",
        "en": "List of RAM role names to attach this policy to."
      },
      "Default": [],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": false,
          "AssociationProperty": "ALIYUN::RAM::Role",
          "Label": {
            "zh-cn": "RAM角色",
            "en": "RAM Role"
          }
        }
      }
    }
  },
  "Resources": {
    "ManagedPolicy": {
      "Type": "ALIYUN::RAM::ManagedPolicy",
      "Properties": {
        "PolicyName": {
          "Ref": "PolicyName"
        },
        "Description": "跨服务DevOps权限策略，覆盖ECS、RDS、SLB、VPC和CloudMonitor",
        "PolicyDocumentUnchecked": {
          "Version": "1",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "ecs:Describe*",
                "ecs:StartInstance",
                "ecs:StopInstance",
                "ecs:RebootInstance"
              ],
              "Resource": [
                "*"
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "rds:Describe*",
                "rds:ModifyDBInstanceSpec",
                "rds:SwitchDBInstanceHA"
              ],
              "Resource": [
                "*"
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "slb:Describe*",
                "slb:SetBackendServers",
                "slb:AddBackendServers",
                "slb:RemoveBackendServers"
              ],
              "Resource": [
                "*"
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "vpc:Describe*"
              ],
              "Resource": [
                "*"
              ]
            },
            {
              "Effect": "Allow",
              "Action": [
                "cms:Describe*",
                "cms:QueryMetric*"
              ],
              "Resource": [
                "*"
              ]
            },
            {
              "Effect": "Deny",
              "Action": [
                "ecs:DeleteInstance",
                "rds:DeleteDBInstance",
                "slb:DeleteLoadBalancer"
              ],
              "Resource": [
                "*"
              ]
            }
          ]
        },
        "Users": {
          "Ref": "UserNames"
        },
        "Groups": {
          "Ref": "GroupNames"
        },
        "Roles": {
          "Ref": "RoleNames"
        },
        "IgnoreExisting": true
      }
    }
  },
  "Outputs": {
    "PolicyName": {
      "Label": {
        "zh-cn": "策略名称",
        "en": "Policy Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM自定义策略名称。",
        "en": "The name of the created RAM custom policy."
      },
      "Value": {
        "Fn::GetAtt": [
          "ManagedPolicy",
          "PolicyName"
        ]
      }
    }
  }
}