Referensi tipe resource ALIYUN::RAM::Group - Resource Orchestration Service - Alibaba Cloud - Resource Orchestration Service

ALIYUN::RAM::Group digunakan untuk membuat RAM user group.

Syntax

{
  "Type": "ALIYUN::RAM::Group",
  "Properties": {
    "GroupName": String,
    "Comments": String,
    "Policies": List,
    "PolicyAttachments": Map,
    "DeletionForce": Boolean,
    "IgnoreExisting": Boolean
  }
}

Properties

Property	Type	Required	Editable	Description	Constraints
GroupName	String	Yes	No	Nama grup pengguna.	Nama harus terdiri dari 1 hingga 64 karakter dan dapat berisi huruf, angka, serta tanda hubung (-).
Comments	String	No	Yes	Keterangan	Nilai harus terdiri dari 1 hingga 128 karakter.
DeletionForce	Boolean	No	Yes	Apakah kebijakan akan diputus secara paksa dari RAM user group.	Nilai yang valid: true: Memutus kebijakan secara paksa. false (default): Tidak memutus kebijakan secara paksa.
IgnoreExisting	Boolean	No	No	Apakah grup yang sudah ada diabaikan.	Nilai yang valid: true: Resource Orchestration Service (ROS) tidak memeriksa keunikan. Jika grup dengan nama yang sama sudah ada, proses pembuatan grup diabaikan. Jika grup tersebut tidak dibuat oleh ROS, maka grup tersebut diabaikan selama fase pembaruan dan penghapusan. false: ROS melakukan pemeriksaan keunikan. Jika grup dengan nama yang sama sudah ada, kesalahan dilaporkan selama pembuatan.
Policies	List	No	Yes	Kebijakan akses.	Untuk informasi lebih lanjut, lihat Properti Policies.
PolicyAttachments	Map	No	Yes	Nama kebijakan sistem dan kustom yang akan disambungkan.	Untuk informasi lebih lanjut, lihat Properti PolicyAttachments.

Policies syntax

"Policies": [
  {
    "Description": String,
    "PolicyName": String,
    "PolicyDocument": Map,
    "IgnoreExisting": Boolean
  }
]

Policies properties

Property	Type	Required	Editable	Description	Constraints
PolicyDocument	Map	Yes	Yes	Isi kebijakan.	Dokumen dapat memiliki panjang maksimal 2.048 karakter. Untuk informasi mengenai elemen dan contoh kebijakan akses, lihat Elemen dasar kebijakan akses dan Ikhtisar pustaka contoh kebijakan akses. Untuk informasi lebih lanjut, lihat Properti PolicyDocument.
PolicyName	String	Yes	No	Nama kebijakan akses.	Nama harus terdiri dari 1 hingga 128 karakter dan dapat berisi huruf, angka, serta tanda hubung (-).
Description	String	No	No	Deskripsi.	Deskripsi harus terdiri dari 1 hingga 1.024 karakter.
IgnoreExisting	Boolean	No	No	Apakah kebijakan yang sudah ada diabaikan.	Nilai yang valid: true: ROS tidak memeriksa keunikan. Jika kebijakan dengan nama yang sama sudah ada, proses pembuatan kebijakan diabaikan. Jika kebijakan tersebut tidak dibuat oleh ROS, maka kebijakan tersebut diabaikan selama fase pembaruan dan penghapusan. false: ROS melakukan pemeriksaan keunikan. Jika kebijakan dengan nama yang sama sudah ada, kesalahan dilaporkan selama pembuatan.

PolicyDocument syntax

"PolicyDocument": {
  "Version": String,
  "Statement": List
}

PolicyDocument properties

Property	Type	Required	Editable	Description	Constraints
Statement	List	Yes	No	Aturan kebijakan akses.	Untuk informasi lebih lanjut, lihat Properti Statement.
Version	String	Yes	No	Versi kebijakan akses.	Tidak ada

Statement syntax

"Statement": [
  {
    "Condition": Map,
    "Action": List,
    "Resource": List,
    "Effect": String,
    "NotAction": List
  }
]

Statement properties

Property	Type	Required	Editable	Description	Constraints
Action	List	No	No	Operasi yang tunduk pada kebijakan akses.	Tidak ada
Condition	Map	No	No	Kondisi di mana otorisasi berlaku.	Tidak ada
Effect	String	No	No	Efek otorisasi.	Nilai yang valid: Allow: Operasi diizinkan. Deny: Permintaan ditolak.
NotAction	List	No	No	Operasi tertentu yang dikecualikan saat efek Allow atau Deny berlaku.	Tidak ada
Resource	List	No	No	Sumber daya yang dikenai kebijakan akses.	Tidak ada

PolicyAttachments syntax

"PolicyAttachments": {
  "System": List,
  "Custom": List
}

PolicyAttachments properties

Property	Type	Required	Editable	Description	Constraints
Custom	List	No	Yes	Daftar nama kebijakan kustom.	Jumlah maksimum kebijakan adalah 5.
System	List	No	Yes	Daftar nama kebijakan sistem.	Jumlah maksimum kebijakan adalah 20.

Return values

Fn::GetAtt

GroupName: Nama RAM user group.

Examples

Scenario 1: Buat RAM group dengan kebijakan sistem untuk kontrol akses read-only tim.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并附加系统权限策略，实现团队只读访问控制。
  en: Create a RAM group with system policies for team read-only access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: >-
        RAM用户组名称，1~64个字符，
        可包含英文字母、数字和短横线。
      en: >-
        RAM group name, 1-64 characters,
        may contain letters, digits and hyphens.
    Default: readonly-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明，1~128个字符。
      en: Comments for the group, 1-128 characters.
    Default: 只读访问权限组，用于运维巡检和审计
    MaxLength: 128
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      PolicyAttachments:
        System:
          - AliyunECSReadOnlyAccess
          - AliyunOSSReadOnlyAccess
          - AliyunRDSReadOnlyAccess
          - AliyunVPCReadOnlyAccess
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并附加系统权限策略，实现团队只读访问控制。",
    "en": "Create a RAM group with system policies for team read-only access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称，1~64个字符，可包含英文字母、数字和短横线。",
        "en": "RAM group name, 1-64 characters, may contain letters, digits and hyphens."
      },
      "Default": "readonly-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明，1~128个字符。",
        "en": "Comments for the group, 1-128 characters."
      },
      "Default": "只读访问权限组，用于运维巡检和审计",
      "MaxLength": 128
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "PolicyAttachments": {
          "System": [
            "AliyunECSReadOnlyAccess",
            "AliyunOSSReadOnlyAccess",
            "AliyunRDSReadOnlyAccess",
            "AliyunVPCReadOnlyAccess"
          ]
        }
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}

Scenario 2: Buat RAM group dengan kebijakan kustom inline untuk kontrol akses detail halus.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并配置内联自定义策略，限定特定资源的操作权限。
  en: Create a RAM group with inline custom policies for fine-grained access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: RAM用户组名称。
      en: The RAM group name.
    Default: dev-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明。
      en: Comments for the group.
    Default: 开发团队权限组，拥有指定资源的读写权限
    MaxLength: 128
  OssBucketName:
    Type: String
    Label:
      zh-cn: OSS存储桶名称
      en: OSS Bucket Name
    Description:
      zh-cn: 允许开发团队访问的OSS存储桶名称。
      en: The OSS bucket name that the dev team is allowed to access.
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      Policies:
        - PolicyName:
            Fn::Sub: ${GroupName}-oss-policy
          Description: 允许对指定OSS存储桶进行读写操作
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - oss:GetObject
                  - oss:PutObject
                  - oss:DeleteObject
                  - oss:ListObjects
                  - oss:GetBucket
                Resource:
                  - Fn::Sub: acs:oss:*:*:${OssBucketName}
                  - Fn::Sub: acs:oss:*:*:${OssBucketName}/*
        - PolicyName:
            Fn::Sub: ${GroupName}-ecs-policy
          Description: 允许查看和管理ECS实例
          PolicyDocument:
            Version: '1'
            Statement:
              - Effect: Allow
                Action:
                  - ecs:DescribeInstances
                  - ecs:DescribeInstanceStatus
                  - ecs:StartInstance
                  - ecs:StopInstance
                  - ecs:RebootInstance
                Resource:
                  - '*'
              - Effect: Deny
                Action:
                  - ecs:DeleteInstance
                Resource:
                  - '*'
      DeletionForce: true
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并配置内联自定义策略，限定特定资源的操作权限。",
    "en": "Create a RAM group with inline custom policies for fine-grained access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称。",
        "en": "The RAM group name."
      },
      "Default": "dev-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明。",
        "en": "Comments for the group."
      },
      "Default": "开发团队权限组，拥有指定资源的读写权限",
      "MaxLength": 128
    },
    "OssBucketName": {
      "Type": "String",
      "Label": {
        "zh-cn": "OSS存储桶名称",
        "en": "OSS Bucket Name"
      },
      "Description": {
        "zh-cn": "允许开发团队访问的OSS存储桶名称。",
        "en": "The OSS bucket name that the dev team is allowed to access."
      }
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "Policies": [
          {
            "PolicyName": {
              "Fn::Sub": "${GroupName}-oss-policy"
            },
            "Description": "允许对指定OSS存储桶进行读写操作",
            "PolicyDocument": {
              "Version": "1",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "oss:GetObject",
                    "oss:PutObject",
                    "oss:DeleteObject",
                    "oss:ListObjects",
                    "oss:GetBucket"
                  ],
                  "Resource": [
                    {
                      "Fn::Sub": "acs:oss:*:*:${OssBucketName}"
                    },
                    {
                      "Fn::Sub": "acs:oss:*:*:${OssBucketName}/*"
                    }
                  ]
                }
              ]
            }
          },
          {
            "PolicyName": {
              "Fn::Sub": "${GroupName}-ecs-policy"
            },
            "Description": "允许查看和管理ECS实例",
            "PolicyDocument": {
              "Version": "1",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "ecs:DescribeInstances",
                    "ecs:DescribeInstanceStatus",
                    "ecs:StartInstance",
                    "ecs:StopInstance",
                    "ecs:RebootInstance"
                  ],
                  "Resource": [
                    "*"
                  ]
                },
                {
                  "Effect": "Deny",
                  "Action": [
                    "ecs:DeleteInstance"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ],
        "DeletionForce": true
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}

Scenario 3: Buat RAM group dengan lampiran kebijakan sistem dan kustom untuk kontrol akses hibrida.

YAML

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 创建RAM用户组并同时附加系统策略和自定义策略，实现混合权限管理。
  en: Create a RAM group with both system and custom policy attachments for hybrid access control.
Parameters:
  GroupName:
    Type: String
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: RAM用户组名称，1~64个字符。
      en: RAM group name, 1-64 characters.
    Default: ops-team
  Comments:
    Type: String
    Label:
      zh-cn: 用户组备注
      en: Group Comments
    Description:
      zh-cn: 用户组的备注说明。
      en: Comments for the group.
    Default: 运维团队权限组，拥有系统和自定义混合权限
    MaxLength: 128
  SystemPolicies:
    Type: Json
    Label:
      zh-cn: 系统策略列表
      en: System Policies
    Description:
      zh-cn: >-
        要附加的系统预置策略名称列表，最多20条。
        常用策略：AliyunECSFullAccess、AliyunOSSFullAccess、
        AliyunRDSFullAccess、AliyunVPCFullAccess、AliyunSLBFullAccess。
      en: >-
        List of system policy names to attach, up to 20.
    Default:
      - AliyunECSFullAccess
      - AliyunVPCFullAccess
      - AliyunSLBFullAccess
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: true
        Label:
          zh-cn: 系统策略名称
          en: System Policy Name
  CustomPolicies:
    Type: Json
    Label:
      zh-cn: 自定义策略列表
      en: Custom Policies
    Description:
      zh-cn: >-
        要附加的自定义策略名称列表，最多5条。
        需要提前在RAM控制台创建好自定义策略。
      en: >-
        List of custom policy names to attach, up to 5.
        Custom policies must be created in RAM console first.
    Default: []
    AssociationProperty: List[Parameter]
    AssociationPropertyMetadata:
      Parameter:
        Type: String
        Required: false
        Label:
          zh-cn: 自定义策略名称
          en: Custom Policy Name
Resources:
  Group:
    Type: ALIYUN::RAM::Group
    Properties:
      GroupName:
        Ref: GroupName
      Comments:
        Ref: Comments
      PolicyAttachments:
        System:
          Ref: SystemPolicies
        Custom:
          Ref: CustomPolicies
      DeletionForce: true
      IgnoreExisting: true
Outputs:
  GroupName:
    Label:
      zh-cn: 用户组名称
      en: Group Name
    Description:
      zh-cn: 创建成功的RAM用户组名称。
      en: The name of the created RAM group.
    Value:
      Fn::GetAtt:
        - Group
        - GroupName

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": {
    "zh-cn": "创建RAM用户组并同时附加系统策略和自定义策略，实现混合权限管理。",
    "en": "Create a RAM group with both system and custom policy attachments for hybrid access control."
  },
  "Parameters": {
    "GroupName": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "RAM用户组名称，1~64个字符。",
        "en": "RAM group name, 1-64 characters."
      },
      "Default": "ops-team"
    },
    "Comments": {
      "Type": "String",
      "Label": {
        "zh-cn": "用户组备注",
        "en": "Group Comments"
      },
      "Description": {
        "zh-cn": "用户组的备注说明。",
        "en": "Comments for the group."
      },
      "Default": "运维团队权限组，拥有系统和自定义混合权限",
      "MaxLength": 128
    },
    "SystemPolicies": {
      "Type": "Json",
      "Label": {
        "zh-cn": "系统策略列表",
        "en": "System Policies"
      },
      "Description": {
        "zh-cn": "要附加的系统预置策略名称列表，最多20条。常用策略：AliyunECSFullAccess、AliyunOSSFullAccess、AliyunRDSFullAccess、AliyunVPCFullAccess、AliyunSLBFullAccess。",
        "en": "List of system policy names to attach, up to 20."
      },
      "Default": [
        "AliyunECSFullAccess",
        "AliyunVPCFullAccess",
        "AliyunSLBFullAccess"
      ],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": true,
          "Label": {
            "zh-cn": "系统策略名称",
            "en": "System Policy Name"
          }
        }
      }
    },
    "CustomPolicies": {
      "Type": "Json",
      "Label": {
        "zh-cn": "自定义策略列表",
        "en": "Custom Policies"
      },
      "Description": {
        "zh-cn": "要附加的自定义策略名称列表，最多5条。需要提前在RAM控制台创建好自定义策略。",
        "en": "List of custom policy names to attach, up to 5. Custom policies must be created in RAM console first."
      },
      "Default": [],
      "AssociationProperty": "List[Parameter]",
      "AssociationPropertyMetadata": {
        "Parameter": {
          "Type": "String",
          "Required": false,
          "Label": {
            "zh-cn": "自定义策略名称",
            "en": "Custom Policy Name"
          }
        }
      }
    }
  },
  "Resources": {
    "Group": {
      "Type": "ALIYUN::RAM::Group",
      "Properties": {
        "GroupName": {
          "Ref": "GroupName"
        },
        "Comments": {
          "Ref": "Comments"
        },
        "PolicyAttachments": {
          "System": {
            "Ref": "SystemPolicies"
          },
          "Custom": {
            "Ref": "CustomPolicies"
          }
        },
        "DeletionForce": true,
        "IgnoreExisting": true
      }
    }
  },
  "Outputs": {
    "GroupName": {
      "Label": {
        "zh-cn": "用户组名称",
        "en": "Group Name"
      },
      "Description": {
        "zh-cn": "创建成功的RAM用户组名称。",
        "en": "The name of the created RAM group."
      },
      "Value": {
        "Fn::GetAtt": [
          "Group",
          "GroupName"
        ]
      }
    }
  }
}