Otorisasi RAM - Microservices Engine - Alibaba Cloud Documentation Center

Resource Access Management (RAM) adalah layanan Alibaba Cloud yang dirancang untuk manajemen identitas pengguna dan kontrol izin akses resource. Melalui RAM, Anda dapat menerapkan prinsip least privilege tanpa perlu membagikan kunci akun Alibaba Cloud Anda kepada pengguna lain. RAM menggunakan kebijakan izin untuk menentukan otorisasi. Topik ini menjelaskan struktur umum kebijakan RAM, serta elemen pernyataan kebijakan (Action, Resource, dan Condition) yang didefinisikan oleh Microservices Engine untuk kebijakan izin RAM. Kode RAM (RamCode) untuk Microservices Engine adalah mse,microgw , dan granularitas otorisasi yang didukung adalah RESOURCE .

Struktur umum kebijakan

Kebijakan izin menggunakan format JSON dengan struktur umum berikut:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "<Effect>",
      "Action": "<Action>",
      "Resource": "<Resource>",
      "Condition": {
        "<Condition_operator>": {
          "<Condition_key>": [
            "<Condition_value>"
          ]
        }
      }
    }
  ]
}

Berikut adalah penjelasan untuk setiap field dalam kebijakan

Version: Menentukan nomor versi kebijakan. Nilainya tetap 1.
Statement:
- Effect: Menentukan hasil otorisasi. Nilai yang valid: Allow dan Deny.
- Action: Menentukan satu atau beberapa operasi yang diizinkan atau ditolak.
- Resource: Menentukan objek spesifik yang terpengaruh oleh operasi tersebut. Anda dapat menggunakan Alibaba Cloud Resource Names (ARNs) untuk mengidentifikasi resource tertentu.
- Condition: Menentukan kondisi agar otorisasi berlaku. Field ini bersifat opsional.
  - Condition operator: Menentukan operator kondisional. Setiap jenis kondisi mendukung operator kondisional yang berbeda.
  - Condition_key: Menentukan condition key.
  - Condition_value: Menentukan nilai kondisi.

Action

Tabel berikut mencantumkan action yang didefinisikan oleh Microservices Engine. Setiap kolom dalam tabel dijelaskan sebagai berikut:

Action: Dapat digunakan dalam elemen Action pada pernyataan kebijakan RAM untuk memberikan izin guna melakukan operasi tersebut.
API: API yang dipanggil untuk melakukan action tersebut.
Access level: Tingkat akses yang telah ditentukan untuk setiap API. Nilai yang valid: create, list, get, update, dan delete.
Resource type: Jenis resource yang mendukung otorisasi untuk melakukan action tersebut. Ini menunjukkan apakah action tersebut mendukung izin tingkat resource. Resource yang ditentukan harus kompatibel dengan action tersebut; jika tidak, kebijakan tidak akan berlaku.
- Untuk API dengan izin tingkat resource, jenis resource yang diperlukan ditandai dengan tanda bintang (*). Tentukan ARN yang sesuai dalam elemen Resource pada kebijakan.
- Untuk API tanpa izin tingkat resource, ini ditampilkan sebagai All Resources. Gunakan tanda bintang (*) dalam elemen Resource kebijakan.
Condition key: Ditentukan oleh layanan. Kunci ini memungkinkan kontrol yang lebih terperinci, yang berlaku baik untuk action saja maupun untuk action yang terkait dengan resource tertentu. Selain condition key spesifik layanan, Alibaba Cloud menyediakan serangkaian condition key umum yang berlaku di seluruh layanan yang terintegrasi dengan RAM. Untuk informasi lebih lanjut, lihat Common condition keys.
Dependent action: Action dependen yang diperlukan untuk menjalankan action tersebut. Agar action dapat dieksekusi dengan sukses, RAM user atau RAM role harus memiliki izin atas semua action dependen tersebut.

Action	API	Level akses	Tipe resource	Condition key	Action dependen
mse:AddGatewayDomain	AddGatewayDomain	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteSwimmingLane	DeleteSwimmingLane	delete	All Resource ``	None	None
mse:UpdateNacosCluster	UpdateNacosCluster	update	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:ListZooKeeperSaslUser	ListZooKeeperSaslUser	list	All Resource ``	None	None
mse:GetGatewayAuthDetail	GetGatewayAuthDetail	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteFlowRules	DeleteFlowRules	delete	All Resource ``	None	None
mse:TagResources	TagResources	update	All Resource ``	None	None
mse:ListGatewayZone	ListGatewayZone	list	All Resource ``	None	None
mse:UpdateGatewayRouteHTTPRewrite	UpdateGatewayRouteHTTPRewrite	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreatePluginConfig	CreatePluginConfig	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayAuthConsumerResourceStatus	UpdateGatewayAuthConsumerResourceStatus		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateZnode	UpdateZnode	update	All Resource ``	None	None
mse:ListClusterTypes	ListClusterTypes		All Resource ``	None	None
mse:UpdateGatewayAuthConsumerResource	UpdateGatewayAuthConsumerResource	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteGatewayAuthConsumerResource	DeleteGatewayAuthConsumerResource		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateNacosMcpServer	CreateNacosMcpServer	create	All Resource ``	None	None
mse:OrderClusterHealthCheckRiskNotice	OrderClusterHealthCheckRiskNotice	get	All Resource ``	None	None
mse:GetApplicationList	GetApplicationList	get	All Resource ``	None	None
mse:ChangeResourceGroup	ChangeResourceGroup	update	All Resource ``	None	None
mse:ListSSLCert	ListSSLCert	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteGatewayIsolationRule	DeleteGatewayIsolationRule	delete	All Resource ``	None	None
mse:CreateZnode	CreateZnode	create	All Resource ``	None	None
mse:CloneSentinelRuleFromAhas	CloneSentinelRuleFromAhas	create	All Resource ``	None	None
mse:DeleteGatewayService	DeleteGatewayService	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteZnode	DeleteZnode	delete	All Resource ``	None	None
mse:ListClusters	ListClusters	get	All Resource ``	None	None
mse:AddAuthResource	AddAuthResource	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QueryInstancesInfo	QueryInstancesInfo	get	All Resource ``	None	None
mse:ListIsolationRules	ListIsolationRules	list	All Resource ``	None	None
mse:AddGatewaySlb	AddGatewaySlb	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteNamespace	DeleteNamespace	delete	All Resource ``	None	None
mse:CreateGatewayCircuitBreakerRule	CreateGatewayCircuitBreakerRule	create	All Resource ``	None	None
mse:ListMigrationTask	ListMigrationTask	list	All Resource ``	None	None
mse:UpdateCluster	UpdateCluster	update	All Resource ``	None	None
mse:UpdateGatewayIsolationRule	UpdateGatewayIsolationRule	update	All Resource ``	None	None
mse:ListGatewayAuthConsumer	ListGatewayAuthConsumer	list	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpgradeCluster	UpgradeCluster		All Resource ``	None	None
mse:CreateNacosConfig	CreateNacosConfig	get	All Resource ``	None	None
mse:GetGatewayRouteDetail	GetGatewayRouteDetail	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetGatewayAuthConsumerDetail	GetGatewayAuthConsumerDetail	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetKubernetesSource	GetKubernetesSource	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ModifyGovernanceKubernetesCluster	ModifyGovernanceKubernetesCluster	update	All Resource ``	None	None
mse:UpdateNacosInstance	UpdateNacosInstance	update	All Resource ``	None	None
mse:ListInstanceCount	ListInstanceCount	get	All Resource ``	None	None
mse:QueryClusterSpecification	QueryClusterSpecification		All Resource ``	None	None
mse:RetryCluster	RetryCluster	update	*Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
mse:ListGatewayService	ListGatewayService	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateNamespace	CreateNamespace	get	All Resource ``	None	None
mse:ListNacosMcpServers	ListNacosMcpServers	list	All Resource ``	None	None
mse:DeleteGatewaySlb	DeleteGatewaySlb	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteSecurityGroupRule	DeleteSecurityGroupRule	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGatewayFlowRule	ListGatewayFlowRule	list	All Resource ``	None	None
mse:CreateGatewayFlowRule	CreateGatewayFlowRule	create	All Resource ``	None	None
mse:UpdateAcl	UpdateAcl	update	All Resource ``	None	None
mse:GetServiceListeners	GetServiceListeners	get	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:OfflineGatewayRoute	OfflineGatewayRoute		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ExportNacosConfig	ExportNacosConfig	get	Cluster `acs:mse:{#regionId}:{#AccountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:AddGatewayRoute	AddGatewayRoute	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteNacosMcpServer	DeleteNacosMcpServer	delete	All Resource ``	None	None
mse:DeleteIsolationRules	DeleteIsolationRules	delete	All Resource ``	None	None
mse:GetServiceMethodPage	GetServiceMethodPage	get	All Resource ``	None	None
mse:CloneNacosConfig	CloneNacosConfig	create	All Resource ``	None	None
mse:QueryConfig	QueryConfig	get	All Resource ``	None	None
mse:CreateWebFlowRule	CreateWebFlowRule	update	All Resource ``	None	None
mse:ListClusterHealthCheckTask	ListClusterHealthCheckTask	get	All Resource ``	None	None
mse:UpdateGatewayRouteHeaderOp	UpdateGatewayRouteHeaderOp	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QueryClusterInfo	QueryClusterInfo	get	All Resource ``	None	None
mse:UpdateGatewayServiceVersion	UpdateGatewayServiceVersion	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteGatewayAuthConsumer	DeleteGatewayAuthConsumer		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGatewayRoute	ListGatewayRoute	get	All Resource ``	None	None
mse:QueryGovernanceKubernetesCluster	QueryGovernanceKubernetesCluster	get	All Resource ``	None	None
mse:GetServiceListPage	GetServiceListPage	get	All Resource ``	None	None
mse:CreateEngineNamespace	CreateEngineNamespace	create	All Resource ``	None	None
mse:GetMseFeatureSwitch	GetMseFeatureSwitch	get	All Resource ``	None	None
mse:UntagResources	UntagResources	delete	All Resource ``	None	None
mse:UpdateGatewayServiceTrafficPolicy	UpdateGatewayServiceTrafficPolicy	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetGatewayOption	GetGatewayOption	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetNacosMcpServer	GetNacosMcpServer	get	All Resource ``	None	None
mse:CreateCircuitBreakerRule	CreateCircuitBreakerRule	create	All Resource ``	None	None
mse:AddGateway	AddGateway	create	Gateway `acs:mse:{#regionId}:{#accountId}:instance/`	None	None
mse:GetNacosConfig	QueryNacosGrayConfig	get	All Resource ``	None	None
mse:UpdateGatewayRouteRetry	UpdateGatewayRouteRetry	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayService	UpdateGatewayService	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateNacosConfig	UpdateNacosConfig	update	All Resource ``	None	None
mse:ListEurekaServices	ListEurekaServices	get	All Resource ``	None	None
mse:UpdateGatewayCircuitBreakerRule	UpdateGatewayCircuitBreakerRule	update	All Resource ``	None	None
mse:DeleteMigrationTask	DeleteMigrationTask	delete	All Resource ``	None	None
mse:UpdateGatewayRouteTimeout	UpdateGatewayRouteTimeout	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteCircuitBreakerRules	DeleteCircuitBreakerRules	delete	All Resource ``	None	None
mse:ListGatewayAuthConsumerResource	ListGatewayAuthConsumerResource		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayFlowRule	UpdateGatewayFlowRule	update	All Resource ``	None	None
mse:ListNacosHistoryConfigs	ListNacosHistoryConfigs	get	All Resource ``	None	None
mse:BindSentinelBlockFallbackDefinition	BindSentinelBlockFallbackDefinition	update	*GovernanceApplication `acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}/application/{#AppName}`	None	None
mse:UpdateGatewayConfig	UpdateGatewayConfig	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetGovernanceKubernetesCluster	GetGovernanceKubernetesCluster	get	All Resource ``	None	None
mse:ImportZookeeperData	ImportZookeeperData	update	All Resource ``	None	None
mse:ListTagResources	ListTagResources	get	All Resource ``	None	None
mse:UpdateSSLCert	UpdateSSLCert	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetEngineNamepace	GetEngineNamepace	get	All Resource ``	None	None
mse:ListSecurityGroupRule	ListSecurityGroupRule	list	All Resource ``	None	None
mse:RemoveZooKeeperSaslUser	RemoveZooKeeperSaslUser	delete	All Resource ``	None	None
mse:ListAuthPolicy	ListAuthPolicy	get	All Resource ``	None	None
mse:UpdateGatewayRouteCORS	UpdateGatewayRouteCORS	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:FetchLosslessRuleList	FetchLosslessRuleList	get	All Resource ``	None	None
mse:GetImportFileUrl	GetImportFileUrl	get	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:GetNacosConfig	GetNacosConfig	get	*EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:ListAnsServices	ListAnsServices	list	All Resource ``	None	None
mse:ListFlowRules	ListFlowRules	list	All Resource ``	None	None
mse:ListGatewayIsolationRule	ListGatewayIsolationRule	list	All Resource ``	None	None
mse:UpdateNacosService	UpdateNacosService	update	All Resource ``	None	None
mse:GetGateway	GetGateway	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:RestartCluster	RestartCluster	update	*Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
mse:GetAppMessageQueueRoute	GetAppMessageQueueRoute	get	All Resource ``	None	None
mse:QueryAllSwimmingLane	QueryAllSwimmingLane	get	*GovernanceNamespace `acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}`	None	None
mse:GatewayBlackWhiteList	GatewayBlackWhiteList	get	All Resource ``	None	None
mse:ListAnsInstances	ListAnsInstances	list	All Resource ``	None	None
mse:ListNamingTrack	ListNamingTrack	get	*Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
mse:DeleteWebFlowRules	DeleteWebFlowRules	delete	All Resource ``	None	None
mse:AddSSLCert	AddSSLCert	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateIsolationRule	CreateIsolationRule	create	All Resource ``	None	None
mse:GetGatewayConfig	GetGatewayConfig	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetLosslessRuleByApp	GetLosslessRuleByApp	get	All Resource ``	None	None
mse:AddSecurityGroupRule	AddSecurityGroupRule	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewaySpec	UpdateGatewaySpec	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ApplyTagPolicies	ApplyTagPolicies	update	All Resource ``	None	None
mse:DeleteServiceSource	DeleteServiceSource	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QuerySwimmingLaneById	QuerySwimmingLaneById	get	*GovernanceNamespace `acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}`	None	None
mse:CreateOrUpdateSwimmingLane	CreateOrUpdateSwimmingLane	create	*GovernanceNamespace `acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}`	None	None
mse:CreateOrUpdateSwimmingLaneGroup	CreateOrUpdateSwimmingLaneGroup	update	*GovernanceNamespace `acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}`	None	None
mse:UpdateGatewayRouteAuth	UpdateGatewayRouteAuth		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:PreserveHeaderFormat	PreserveHeaderFormat	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteGatewayFlowRule	DeleteGatewayFlowRule	delete	All Resource ``	None	None
mse:UpdateGatewayServiceCheck	UpdateGatewayServiceCheck	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayDomain	UpdateGatewayDomain	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateMessageQueueRoute	UpdateMessageQueueRoute	update	All Resource ``	None	None
mse:GetGatewayDomainDetail	GetGatewayDomainDetail	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QueryNamespace	QueryNamespace	get	All Resource ``	None	None
mse:GetZookeeperDataImportUrl	GetZookeeperDataImportUrl	get	All Resource ``	None	None
mse:ListSecurityGroup	ListSecurityGroup	list	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateMseServiceApplication	CreateMseServiceApplication	get	All Resource ``	None	None
mse:ListClusterVersions	ListClusterVersions		All Resource ``	None	None
mse:ListClusterConnectionTypes	ListClusterConnectionTypes	get	All Resource ``	None	None
mse:QueryClusterDetail	QueryClusterDetail	get	All Resource ``	None	None
mse:GetBlackWhiteList	GetBlackWhiteList	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:AddBlackWhiteList	AddBlackWhiteList	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayAuthConsumer	UpdateGatewayAuthConsumer		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QueryGatewayRegion	QueryGatewayRegion	get	All Resource ``	None	None
mse:UpdateGatewayAuthConsumerStatus	UpdateGatewayAuthConsumerStatus		*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateEngineNamespace	UpdateEngineNamespace	update	All Resource ``	None	None
mse:UpdateGatewayAuth	UpdateGatewayAuth	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListZkTrack	ListZkTrack	list	All Resource ``	None	None
mse:QuerySlbSpec	QuerySlbSpec	list	All Resource ``	None	None
mse:ImportServices	ImportServices	create	All Resource ``	None	None
mse:ListEngineNamespaces	ListEngineNamespaces	list	All Resource ``	None	None
mse:ListExportZookeeperData	ListExportZookeeperData	list	All Resource ``	None	None
mse:ImportNacosConfig	ImportNacosConfig	create	All Resource ``	None	None
mse:GetPluginConfig	GetPluginConfig	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ApplyGatewayRoute	ApplyGatewayRoute	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:QueryMonitor	QueryMonitor	get	All Resource ``	None	None
mse:AddZooKeeperSaslUser	AddZooKeeperSaslUser	create	All Resource ``	None	None
mse:UpdateMigrationTask	UpdateMigrationTask	update	All Resource ``	None	None
mse:ListWebFlowRules	ListWebFlowRules	list	All Resource ``	None	None
mse:EnableProxyProtocol	EnableProxyProtocol	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:EnableHttp2	EnableHttp2	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteNacosInstance	DeleteNacosInstance	delete	All Resource ``	None	None
mse:PullServices	PullServices	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:InitializeServiceLinkRole	InitializeServiceLinkRole	get	All Resource ``	None	None
mse:GetOverview	GetOverview		All Resource ``	None	None
mse:ListApplicationsWithTagRules	ListApplicationsWithTagRules	get	All Resource ``	None	None
mse:UpdateServiceSource	UpdateServiceSource	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ExportZookeeperData	ExportZookeeperData	get	All Resource ``	None	None
mse:UpdateCircuitBreakerRule	UpdateCircuitBreakerRule	update	All Resource ``	None	None
mse:DeleteGateway	DeleteGateway	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGatewayDomain	ListGatewayDomain	list	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListListenersByIp	ListListenersByIp	get	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:CreateApplication	CreateApplication	create	All Resource ``	None	None
mse:ListGatewayCircuitBreakerRule	ListGatewayCircuitBreakerRule	list	All Resource ``	None	None
mse:DeleteEngineNamespace	DeleteEngineNamespace	delete	All Resource ``	None	None
mse:ListZnodeChildren	ListZnodeChildren	list	All Resource ``	None	None
mse:SelectGatewaySlb	SelectGatewaySlb	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:DeleteGatewayAuth	DeleteGatewayAuth	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateNacosInstance	CreateNacosInstance	create	All Resource ``	None	None
mse:UpdateGatewayName	UpdateGatewayName	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetServiceList	GetServiceList	get	All Resource ``	None	None
mse:UpdateClusterSpec	UpdateClusterSpec	update	All Resource ``	None	None
mse:UpdateZooKeeperSaslUser	UpdateZooKeeperSaslUser	update	All Resource ``	None	None
mse:ListConfigTrack	ListConfigTrack	list	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:DeleteNacosService	DeleteNacosService	update	All Resource ``	None	None
mse:QueryClusterDiskSpecification	QueryClusterDiskSpecification	get	All Resource ``	None	None
mse:GetTagsBySwimmingLaneGroupId	GetTagsBySwimmingLaneGroupId	get	All Resource ``	None	None
mse:UpdateBlackWhiteList	UpdateBlackWhiteList	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGateway	ListGateway	get	All Resource ``	None	None
mse:DeletePluginConfig	DeletePluginConfig	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetLocalityRule	GetLocalityRule	get	All Resource ``	None	None
mse:PutClusterHealthCheckTask	PutClusterHealthCheckTask		*Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
mse:UpdateGatewayOption	UpdateGatewayOption	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGatewayRouteOnAuth	ListGatewayRouteOnAuth	list	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateNacosConfig	UpdateNacosGrayConfig	update	All Resource ``	None	None
mse:GetPlugins	GetPlugins	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:AddMigrationTask	AddMigrationTask	create	All Resource ``	None	None
mse:QueryGatewayType	QueryGatewayType	get	All Resource ``	None	None
mse:ListGatewayAuth	ListGatewayAuth	get	All Resource ``	None	None
mse:UpdateIsolationRule	UpdateIsolationRule	update	All Resource ``	None	None
mse:DeleteAuthResource	DeleteAuthResource	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListNacosConfigs	ListNacosConfigs	get	All Resource ``	None	None
mse:AddAuthPolicy	AddAuthPolicy	update	All Resource ``	None	None
mse:ListEurekaInstances	ListEurekaInstances	get	All Resource ``	None	None
mse:DeleteCluster	DeleteCluster	delete	All Resource ``	None	None
mse:GetNacosHistoryConfig	GetNacosHistoryConfig	get	All Resource ``	None	None
mse:CreateCluster	CreateCluster	create	Cluster `acs:mse:{#regionId}:{#accountId}:instance/`	None	None
mse:AddServiceSource	AddServiceSource	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:RemoveApplication	RemoveApplication	delete	All Resource ``	None	None
mse:UpdateAuthPolicy	UpdateAuthPolicy	get	All Resource ``	None	None
mse:GetApplicationInstanceList	GetApplicationInstanceList	get	All Resource ``	None	None
mse:QueryZnodeDetail	QueryZnodeDetail	get	All Resource ``	None	None
mse:ListServiceSource	ListServiceSource	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListNamespaces	ListNamespaces	list	All Resource ``	None	None
mse:DeleteNacosConfigs	DeleteNacosConfigs	delete	All Resource ``	None	None
mse:AddGatewayAuthConsumer	AddGatewayAuthConsumer	create	All Resource ``	None	None
mse:UpdateConfig	UpdateConfig	update	All Resource ``	None	None
mse:DeleteNacosConfig	DeleteNacosConfig	delete	All Resource ``	None	None
mse:ListSentinelBlockFallbackDefinitions	ListSentinelBlockFallbackDefinitions	list	All Resource ``	None	None
mse:ListListenersByConfig	ListListenersByConfig	get	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:DeleteGatewayRoute	DeleteGatewayRoute	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayRoute	UpdateGatewayRoute	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateFlowRule	CreateFlowRule	create	All Resource ``	None	None
mse:CreateNacosService	CreateNacosService	get	All Resource ``	None	None
mse:AddGatewayAuth	AddGatewayAuth	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListGatewaySlb	ListGatewaySlb	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetMseSource	GetMseSource	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListAnsServiceClusters	ListAnsServiceClusters	list	Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}` EngineNamespace `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId}`	None	None
mse:UpdateWebFlowRule	UpdateWebFlowRule	update	All Resource ``	None	None
mse:UpdateImage	UpdateImage	update	*Cluster `acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}`	None	None
mse:DeleteGatewayDomain	DeleteGatewayDomain	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateFlowRule	UpdateFlowRule	update	All Resource ``	None	None
mse:ListCircuitBreakerRules	ListCircuitBreakerRules	list	All Resource ``	None	None
mse:DeleteBlackWhiteList	DeleteBlackWhiteList	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:GetImage	GetImage	get	All Resource ``	None	None
mse:QueryAllSwimmingLaneGroup	QueryAllSwimmingLaneGroup	get	All Resource ``	None	None
mse:DeleteGatewayServiceVersion	DeleteGatewayServiceVersion	delete	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:UpdateGatewayRouteWafStatus	UpdateGatewayRouteWafStatus	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:AddMockRule	AddMockRule		All Resource ``	None	None
mse:UpdatePluginConfig	UpdatePluginConfig	update	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:CreateGatewayIsolationRule	CreateGatewayIsolationRule	create	All Resource ``	None	None
mse:CreateSentinelBlockFallbackDefinition	CreateSentinelBlockFallbackDefinition	update	All Resource ``	None	None
mse:ModifyLosslessRule	ModifyLosslessRule	get	All Resource ``	None	None
mse:ListAppBySwimmingLaneGroupTag	ListAppBySwimmingLaneGroupTag	get	All Resource ``	None	None
mse:GetGatewayServiceDetail	GetGatewayServiceDetail	get	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:ListAppBySwimmingLaneGroupTags	ListAppBySwimmingLaneGroupTags	list	All Resource ``	None	None
mse:DeleteSwimmingLaneGroup	DeleteSwimmingLaneGroup	get	All Resource ``	None	None
mse:UpdateLocalityRule	UpdateLocalityRule	get	All Resource ``	None	None
mse:AddGatewayServiceVersion	AddGatewayServiceVersion	create	*Gateway `acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId}`	None	None
mse:RemoveAuthPolicy	RemoveAuthPolicy	get	All Resource ``	None	None
mse:DeleteGatewayCircuitBreakerRule	DeleteGatewayCircuitBreakerRule	delete	All Resource ``	None	None

Resource

Tabel berikut mencantumkan resource yang ditentukan oleh Microservices Engine. Tentukan resource tersebut dalam elemen Resource pada pernyataan kebijakan RAM untuk memberikan izin terhadap operasi tertentu. Resource tersebut diidentifikasi secara unik menggunakan ARN dengan format: acs:{#ramcode}:{#regionId}:{#accountId}:{#resourceType}:

acs: Singkatan dari Alibaba Cloud service, yang menunjukkan cloud publik Alibaba Cloud.
{#ramcode}: Kode yang digunakan dalam RAM untuk menunjukkan layanan Alibaba Cloud.
{#regionId}: region ID. Jika resource mencakup semua wilayah, atur nilainya menjadi tanda bintang (*).
{#accountId}: ID akun Alibaba Cloud. Jika resource mencakup semua akun Alibaba Cloud, atur nilainya menjadi tanda bintang (*).
{#resourceType}: Identifier resource yang ditentukan oleh layanan. Mendukung struktur hierarkis, mirip dengan path file. Jika pernyataan mencakup resource global, atur nilainya menjadi tanda bintang (*).

Tipe resource	ARN
Gateway	acs:mse:{#regionId}:{#accountId}:instance/{#GatewayUniqueId} acs:mse:{#regionId}:{#accountId}:instance/* acs:mse:{#Region}:{#AccountId}:instance/{#GatewayUniqueId}
Cluster	acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId} acs:mse:{#regionId}:{#accountId}:instance/* acs:mse:{#regionId}:{#accountId}:cluster/{#InstanceId}
EngineNamespace	acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/{#NamespaceId} acs:mse:{#regionId}:{#accountId}:instance/{#InstanceId}/*
GovernanceNamespace	acs:mse:{#Region}:{#AccountId}:namespace/{#Namespace} acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}
NacosConfig	acs:mse:*:{#accountId}:nacosconfig/{#DataId} acs:mse::{#accountId}:nacosconfig/{#DataId}
NacosService	acs:mse:*:{#accountId}:nacosservice/{#ServiceName}
NacosInstance	acs:mse:{#regionId}:{#accountId}:nacosinstance/*
GovernanceApplication	acs:mse:{#Region}:{#AccountId}:namespace/{#Namespace}/application/{#AppName} acs:mse:{#regionId}:{#accountId}:namespace/{#Namespace}/application/{#AppName}

Condition

Microservices Engine tidak mendefinisikan condition key tingkat produk. Namun, Anda dapat menggunakan condition key umum Alibaba Cloud untuk kontrol akses. Untuk informasi lebih lanjut, lihat Common condition keys.

Cara membuat kebijakan RAM kustom?

Anda dapat membuat kebijakan kustom dan memberikannya kepada RAM user, RAM user group, atau RAM role. Untuk caranya, lihat: